CHAPTER 16A Scenario in Cyber Risk
16.1 DEFINITION
16.1.1 The First Cyber Attacks: Card Data Breaches
When we started working on operational risk, 10–15 years ago, some of our clients considered IT risk and logistics as a common risk domain. This seemed justified at that time, since these are support functions that are not directly linked to the banking business. Compared to other support functions, such as human resources or accounting, IT and logistics are much more technical and require extensive expert knowledge. The nature of the knowledge involved makes communication between risk analysts, business experts, and technical experts sometimes difficult.
By considering buildings, power supply, telecommunications, and information technology within a broad logistics function, the types of risks considered were implicitly limited to external supply failures or internal errors or failures.
If this seems like a distant past to you, it is worth remembering that in 2001, less than 20% of American households had an online bank account, and only 50% banked online in 2009. An interesting infographic on this topic is available on the Wells Fargo website1.
The only domain for which the explicit notion of attack was identified was card payment. France, a country considered to be the inventor of the smart card2, has always been a pioneer in the field of credit card payment. The creation by French banks of an economic interest grouping, “GIE Carte Bancaires”3, to share the technical infrastructure ...
Get Operational Risk Modeling in Financial Services now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
