|
Control failures KRIs
Overdue vulnerability patching
Overdue penetration tests/overdue resolution of penetration
tests recommendations
Software obsolescence
Results of phishing tests, of password cracking attempts
# inadequate access and overdue revisions of access
Stress KRIs
% change in # workload/change request/issues per IT
managers
% vacancies in IT/cybersecurity teams
Overcapacity usage of systems
Causal KRIs
Conduct metrics on employee compliance
Breach of conduct and information rules on social media
“Repeat offenders” (staff failing more than one phishing
test) in sensitive data areas
Devices or access cards lost/stolen
206
RISING OPERATIONAL RISKS
At a technical level and for cyberattacks and access breaches, most – if not
all – monitoring will take place in the IT department. However, in many firms the
information security department is separate from IT, reflecting the fact that infor-
mation security involves more than just securing the business against cyberattacks.
The information security department should design, maintain and monitor a blend
of behavioral and technical controls, where deviations and failings constitute KRIs.
Table 18.3 lists possible KRIs for information security, using the KRI typology
presented in Chapter 14.
CHAPTER
19
Operational Risks in
Cryptocurrencies
C O N T E X T A N D A C A D E M I C R E S E A R C H
The cryptocurrency Bitcoin experienced a bubble at the end of 2017 that was com-
parable to the tulip mania of the 17th century, when heady speculation pushed the
price of tulip bulbs to ridiculous levels before the price crashed abruptly. The sudden
widespread interest in the cryptocurrency and associated speculation brought Bitcoins
to the evening news. Its future is uncertain, but blockchain, the distributed ledger
technology that underpins Bitcoin, is viewed by many as one of the most promising
developments for monetary transfer and, more generally, for secure transactions in a
peer-to-peer network.
In 2014, when Bitcoin and blockchain began to be discussed keenly in universities
and by some payment providers but had yet to capture the public imagination, I had
the pleasure of working with UCL colleagues on an academic paper on the risks and
implications of virtual currencies from a banking regulation perspective. The paper,
pioneering at the time of its publication, looked at some of the main operational risks
that banks would face if they decided to trade cryptocurrencies; its section on oper-
ational risk is summarized in this chapter. For further detail, please refer to the full
publication and its references.
1
S U M M A R Y
The paper presented the first basic operational risk perspective for key risk management
issues associated with the emergence of new forms of electronic currency in the real
1
Peters, G., Chapelle, A. and Panayi, E. (2015) “Opening discussion on banking sector risk
exposures and vulnerabilities from virtual currencies: an operational risk perspective,”
Journal
of Banking Regulation
, September, 1–34). The working paper is available at: https://ssrn.com/
abstract=2491991
207
Operational Risk Management: Best Practices in the Financial Services Industry, First Edition.
Ariane Chapelle.
© 2019 John Wiley & Sons Ltd. Published 2019 by John Wiley & Sons Ltd.
208
RISING OPERATIONAL RISKS
economy. In particular, we focused on understanding the development of new risk types
and the evolution of current risk types as new components of financial institutions arise
to cater for an increasing demand for electronic money, micro-payment systems, virtual
money and cryptocurrencies.
We proposed a risk identification and assessment framework for virtual and cryp-
tocurrencies from a banking regulation perspective. The framework addressed the need
to understand key operational risk vulnerabilities and exposure risk drivers within the
Basel II/III banking regulation, and specifically those associated with virtual and cryp-
tocurrencies.
We highlighted how some of the features of virtual and cryptocurrencies are impor-
tant drivers of operational risk, posing both management and regulatory challenges that
must be addressed by regulators, central banks and security exchanges.
We proposed a structure of risk analysis starting with the vulnerabilities and expo-
sures of virtual and cryptocurrencies as the drivers of operational risk for these new
means of exchange. Then, by using risk drivers, our approach allowed us to highlight
the sources of possible adverse consequences when using or generating virtual and
cryptocurrencies. These were then mapped into the risks associated with the Basel
categories, providing an easier view of the regulatory response and better mitigation
techniques. In addition, this helps to identify and address the root causes of the oper-
ational risks associated with virtual and cryptocurrencies, rather than just presenting
their symptoms.
B I T C O I N
Bitcoin is the most famous cryptocurrency but it is by no means the only one. Cryp-
tocurrencies are a type of digital token that use cryptography to form chains of digital
signatures that create token transfers, with processing via a decentralized peer-to-peer
networking system architecture.
Bitcoin relies on public-key cryptography, an asymmetric key encryption scheme
used for encrypting messages and verifying the originator of a message. A user wishing
to communicate with a public-key cryptography scheme would have two keys: a public
key that is available for everybody to access and a private key that must be kept secret.
As an example, consider two users, A and B. User A wants to send a message to user
B in a public-key cryptography scheme. For that, A would have to obtain B’s public
key, obtain the “ciphertext” (or the encryption transformation of the message defined
by the public key) and send it to B. User B could then decrypt this message using her
private key.
In addition, Bitcoin uses the concept of digital signatures to ensure non-repudiation:
that is, a third party can easily verify whether a particular signatory has signed a
message, using only information that is publicly available (the signatories private
key). It is important, then, to keep secret the key belonging to the owner of the
Do'stlaringiz bilan baham: |
