FCA fine Tesco Bank £16.4m – The cost of an inadequate Cyber breach response plan is significant
In November 2017, we wrote some thoughts in the aftermath of the Tesco Bank cyber attack. Just over a week ago, so it became clear what the attack cost the bank; a £16.4m fine imposed by the FCA in addition to the £2.26m actually stolen from customers. The FCA found that the attack was “largely avoidable” highlighting a sequence of basic errors and a failure to respond promptly. Tesco Bank Financial Crime Operations Team took 21 hours from the outset of the attack to contact its own Fraud Strategy Team due to a failure to follow a documented procedure. When combined with the issuance of debit cards with sequential PAN and other errors, the problems quickly compounded themselves.
Board Responsibility
As the FCA pointed out in their press release, it is the responsibility of boards of directors to ensure system and process resilience;
“Cyber security requires resilience. A financial institution’s board is ultimately responsible for ensuring that its cyber crime controls are designed to meet standards of resilience. The board must set an appropriate cyber crime risk appetite and ensure that its institution’s cyber-crime controls are designed to anticipate and reduce the risk of a successful attack. Where an attack is successful, the board should ensure that the bank’s response plans are clear, well designed and well-rehearsed and that the bank recovers quickly from the incident. Following an attack the financial institution should commission a root cause analysis and understand and ameliorate the vulnerabilities that made the institution susceptible to the attack to reduce the risk of future attacks.“
Our view
Experience with clients shows there is a significant tendency for a board of directors to respond to cyber risk with policies that are high level, principles-based and often attached to procedures that are not sufficiently comprehensive. Hence, in our view, it is all about your response plan; a dynamic, thoroughly and regularly tested plan. It should involve all parts of the business from operations and legal to marketing and PR; therefore, every part of an organisation has a key role in the event of a cyber breach. The issue is whether what has to be done is clear, appropriate and understood. Also, do not confuse a cyber response plan with a regular disaster recovery plan; the two are quite different things. An independent review, audit and benchmark of the response plan should be commissioned periodically.
Cyber Attack Prevention is not possible
Cyber attack prevention is not possible. Budgets for cybersecurity could be as large as the national health service; whatever is spent is still insufficient. Security breaches at several large, tech-reliant companies such as Google, Facebook, LivingSocial, and Twitter are notable; certainly, no set of security measures are completely infallible.
The systems we increasingly rely on as an integral part of life involve significant coding and appropriate deployment. With customer demand and market competitiveness as its key driver, so companies develop software, platforms and services. The same market pressures provide context to the problem; services often deploying in advance of complete testing and validation; it is a very complex process and bugs clearly exist post-deployment. Seeking out exploits in such systems is relatively inexpensive. With parties ranging from State-sponsored actors to eager teenagers proving how good they are; the reasons for a cyber attack are varied.
Appropriate prioritisation is key
Cyber risk appetite must identify the most critical systems and data requiring the greatest protection. Establishing a protection priority within the risk management framework with resources allocated accordingly is essential. You can ask a lot of questions or one key question – what are you not protecting and why?
European regulators and the FCA paying careful attention to this area. The issue for banks and other highly regulated businesses is to determine if what they are doing in this area would pass the reasonable person test. Tesco Bank mitigated their headline fine of £33.6m through excellent co-operation with the FCA and the prompt implementation of a redress scheme for their customers.
Hence, with a more comprehensive and regularly tested breach response plan in operation, a better outcome would have resulted. Testing such plans is not easy, time-consuming and quite costly. We encourage clients to replicate live systems fully in safe “test” environments as a requisite. With this in place, a full test of all parts of the response plan for effectiveness is easier. Certainly, a significant investment; but when compared reputation loss, it provides a better return on investment than the outlay of a fine.
