Cyber risk quantification: stress testing and cyber resilience

What it is about

Federico Muller, country manager of Microsoft, explained at the Second Annual Risk Conference (September 27, 2024) why cybersecurity went from being a technical problem to a matter of resilience and of the State, and how stress tests help quantify cyber risk.

The 26 slides start from cyberattack cases with large losses, show how cybersecurity's priority changed between 2014 and 2024, contrast prevention with resilience (designing to recover), list the main resilience risks and close with the lessons from the ECB's 2024 cyber resilience stress test and the outlook for the DORA regulation.

Objectives

• Explain why cyber risk is today a business, macroeconomic and State risk.
• Distinguish cybersecurity from cyber resilience and what designing to recover means.
• Draw lessons from a supervised cyber stress test to quantify impact.

Key takeaways

1. Cybersecurity went from being a technical problem in 2014 to a business priority in 2020, a matter of organizational existence in 2022 and a State and macroeconomic problem in 2024.
2. The approach shifts from preventing every possible attack to assuming compromise: protect, detect and respond across the whole chain.
3. Resilience is the ability to recover from errors and keep operating; regularly running cyber stress tests increases stakeholder confidence.
4. In the ECB's 2024 test, the scenario was the encryption of the core banking system's main database by an unknown attacker; recovery deadlines were often missed.
5. There are no standardized processes or methods to quantify damage, which calls for a multidisciplinary approach to economic impact.