Quicktake: cyber war gaming and why UAE banks are doing it

The Central Bank of the UAE and the UAE Banks Federation conducted a simulation drill last month

The average annualised cost of cyber crime for financial organisations worldwide increased to $18.5 million, according to a 2019 report by Accenture. EPA

Cyber attacks on financial institutions surged 238 per cent globally between February and April last year, as more consumers began transacting online at the peak of coronavirus-induced lockdowns, according to cyber security firm VMware Carbon Black.

Last month, the Central Bank of the UAE and the UAE Banks Federation conducted a ‘cyber war gaming’ exercise or a simulation drill to assess the preparedness of the country's banking sector amid potential cyber threats.

“The war gaming exercise as a community has never been more important … in order to rehearse, train, test our ecosystems, make quicker decisions and build muscle memory,” Mohammed Darwish Azad, group chief information and security officer of Emirates NBD, Dubai's biggest lender by assets, said.

The Covid-19 pandemic has accelerated digitisation – a trend that was already underway in the UAE – at an unprecedented rate.

“Digital banking offers customers convenience and faster processing of financial transactions … it [also] heightens vulnerabilities that banks spend years pre-empting and preparing for,” Hariprasad Chede, head of information security risk at National Bank of Fujairah, said.

The National looks at the importance of cyber simulation drills in the banking sector.

What is cyber war gaming?

It involves a cyber attack orchestrated through KPMG’s proprietary platforms that includes multiple scenarios and attack vectors such as malicious email attachments, pop-up messages and chat rooms.

All participating banks respond to these scenarios, testing their incident response and crisis management capabilities in real time.

“The cyber simulation is [a] cross-functional exercise … it requires us to conduct detailed planning, complex scenario building, designing the cyber range for technical teams, training and awareness, testing the range and collaborating across banks,” said Mr Azad, who is also the UBF's information security chairperson.

Banks’ response

In the last month’s drill, technical team members from different banks were challenged to react to real life scenarios by detecting, containing and responding to diverse online threats.

Management and executive management team members were challenged to collaborate, apply their respective cyber response strategies and take quick decisions at critical moments.

“Our preparations involved constant dry runs and connecting the story line before the training and simulation days … [and] supporting our leaders to power through the exercise,” Mr Azad said.

Top takeaways

Cyber resilience is critical for modern financial systems, as disruptions can have a “far-reaching impact for banks and the economy”, according to Jamal Saleh, UBF director general. He added that the Covid-19 pandemic has highlighted the importance of cyber resilience to protect the integrity of the banking system.

Cyber war gaming is one of the tools to help the banking sector test and evaluate institutional preparedness, he said.

“Conducting simulation drill of multiple scenarios and attack vectors is one of the innovative ways to collaborate at the national level with banks and relevant stakeholders to deal with cyber threat scenarios,” Mr Saleh said.

Effective communication and being prepared for the unknown are important to deal with such crises, Mr Azad said.

How serious is the threat?

A 2019 report by Accenture revealed that the average annualised cost of cyber crime for financial organisations worldwide increased to $18.5 million – the highest of all industries included in the study. It was almost 40 per cent higher than the average cost of $13m per firm across other industries.

“Our biggest strength is the culture we have built with our employees, partners and customers as we continue to invest in awareness campaigns and sessions to ensure they are fully equipped to counter potential cyber security threats,” Mr Chede said.

“As a result, after measuring our staff’s readiness to cyber security, we can report that their ability to mitigate threats has increased by 90 per cent over the last five years,” he added.