One way to better cyber resilience in the financial sector: The Danish approach

Abstract

The increasing cyberthreat facing Denmark and, in particular, the Danish financial sector and its critical infrastructure requires action in order to ensure the country’s financial stability. As a result, the Danish Central Bank (Danmarks Nationalbank) has taken a number of initiatives in order to increase the overall cyber resilience of the Danish financial sector. Most of these initiatives have been carried out by the Financial Sectorforum for Operational Robustness (FSOR) which Danmarks Nationalbank established in 2016. The forum — consisting of the key players in the Danish financial sector — has produced several results: a crisis management setup has been established and tested; a comprehensive mapping and risk analysis on the critical infrastructure has been carried out; several initiatives on knowledge sharing have been completed; and recently, an agreement has been reached on establishing a Danish intel-led red-team test programme to carry out red-team testing in the coming years for the most critical financial institutions. While the results are, of course, the most visible evidence of the work of FSOR, it is also interesting to note both the preconditions and the processes which led to the results, as this might inspire similar efforts in other countries. The preconditions include a description of the public/private partnership model with a voluntary but obligating participation in FSOR. The paper also shares the authors’ knowledge and experiences in FSOR with sections on ‘lessons learned’.