| ICT risk ICT risks (non categories exhaustive13 ) ICT security Cyber-attacks and risks other external ICT based attacks | Risk description Attacks performed from the internet or outside networks for different purposes (e.g. fraud, espionage, activism / sabotage, cyber terrorism) using a variety of techniques (e.g. social engineering, intrusion attempts through the exploitation of vulnerabilities, deployment of malicious software) resulting in taking control of internal ICT systems. Execution of fraudulent payment transactions by hackers through the breaking or circumvention of the security of e-banking and payment services and/or by attacking and exploiting security vulnerabilities in the internal payment systems of the institution. Execution of fraudulent securities transactions by hackers through the breaking or circumvention of the security of the e-banking services that also provide access to the customer’s securities accounts. Attacks on communication connections and conversations of all kinds or ICT systems with the objective of collecting information and/or committing frauds. | Examples Different • • • • • • • • | types of attacks: APT (Advanced Persistent Threat) for taking control of internal systems or stealing information (e.g. identity theft related information, credit card information). Malicious software (e.g. ransomware) that encrypts data with the aim of blackmail. Infection of internal ICT systems with Trojan horses for committing malicious system actions in a hidden manner. Exploitation of ICT system and/or (web) application vulnerabilities (e.g. SQL injection …) to gain access to the internal ICT system. Attacks against e-banking or payment services, with objective to commit unauthorised transactions. The creation and sending out of fraudulent payment transactions from within the internal payment systems of the institution (e.g. fraudulent SWIFT messages). Pump and dump attacks where the attackers gain access to e-banking securities accounts of customers and place fraudulent buying or selling orders to influence the market price and /or make gains based on previously established securities positions. Eavesdropping/intercepting unprotected transmission of authentication data in plain-text. |
| Inadequate internal ICT | Gaining unauthorised access to critical ICT systems from within the institution for different purposes (e.g. | • | Installing key stroke loggers (key loggers) to steal user IDs and passwords to gain unauthorised access |
| ICT risk ICT risks (non categories exhaustive13 ) security | Risk description fraud, performing and hiding rogue trading activities, data theft, activism / sabotage) by a variety of techniques (e.g. abusing and/or escalating privileges, identity theft, social engineering, exploiting vulnerabilities in ICT systems, deployment of malicious software). Unauthorised ICT manipulations due to inadequate ICT access management procedures and practices. Security threats due to lack of security awareness whereby employees do not understand, neglect or fail to adhere to ICT security policies and procedures. The unauthorised storage or transfer of confidential information outside the institution. | Examples • • • • • • • • | to confidential data and/or commit fraud. Cracking/guessing weak passwords to gain illegitimate or elevated access rights. System administrator uses operating systems or database utilities (for direct database modifications) to commit fraud. Failure to disable or delete unnecessary accounts such as those of staff that changed functions and/or left the institution, including guests or suppliers who no longer need access, providing unauthorised access to ICT systems. Granting excessive access rights and privileges, allowing unauthorised accesses and/or making it possible to hide rogue activities. Employees that are deceived into providing assistance for an attack (i.e. social engineering). Bad practices regarding credentials: sharing passwords, using ‘easy’ to guess passwords, using the same password for many different purposes, etc. Storage of unencrypted confidential data on laptops and potable data storage solutions (e.g. USB keys) that can be lost or stolen. Persons stealing or deliberately leaking or smuggling out confidential information to unauthorised persons or the public. |
| Inadequate physical ICT security | Misuse or theft of ICT assets via physical access causing damage, loss of assets or data or to make other threats possible. Deliberate or accidental damage to physical ICT assets | • • | Physically breaking into office buildings and/or data centres to steal ICT equipment (e.g. computers, laptops, storage solutions) and/or to copy data by physically accessing ICT systems. Physical terrorism (i.e. terrorist bombs) or sabotage |
| ICT risk ICT risks (non categories exhaustive13 ) | Risk description caused by terrorism, accidents or unfortunate/erroneous manipulations by staff of the institution and/or third parties (suppliers, repairman). Insufficient physical protection against natural disasters resulting in partial or complete destruction of ICT systems/datacentres by natural disasters. | Examples • • | of ICT assets. Destruction of data centre caused by fire, water leakage or other factors. Earthquakes, extreme heat, wind storms, heavy snowstorms, floods, fire, lightning. |
| ICT change risks Inadequate controls over ICT system changes and ICT development | Incidents caused by undetected errors or vulnerabilities as a result of change (e.g. unforeseen effects of a change or a poorly managed change due to a lack of testing or improper change management practices) to e.g. software, ICT systems and data . | • • • • • | Release into production of insufficiently tested software or configuration changes with unexpected adverse effects on data (e.g. corruption, deletion) and/or ICT system performance (e.g. breakdown, performance degradation). Uncontrolled changes to ICT systems or data in the production environment. Release into production of ill-secured ICT systems and internet applications, creating opportunities for hackers to attack the provided internet services and /or to breach the internal ICT systems. Uncontrolled changes in the source code of internally developed software. Insufficient testing due to the absence of adequate testing environments. |
| Inadequate ICT architecture | A weak ICT architecture management when designing, building and maintaining ICT systems (e.g. software, hardware, data) can lead, over time, to complex, difficult, costly to manage and rigid ICT systems, that are no longer sufficiently aligned with business needs and are falling short compared to actual risk management requirements. | • • | Inadequately managed changes to ICT systems, software and/or data over a prolonged period of time, leading to complex, heterogeneous and difficult to manage ICT systems and architectures, causing many adverse business and risk management impacts (e.g. lacking flexibility and agility, ICT incidents and failures, high operating cost, weakened ICT security and resiliency, reduced data quality and reporting capabilities). Excessive customisation and extension of |
| ICT risk ICT risks (non categories exhaustive13 ) | Risk description | Examples | commercial software packages with internally developed software, leading to the incapacity to implement future releases and upgrades of the commercial software and the risk of no longer being supported by the vendor. |
| Inadequate lifecycle and patch management | The failure to maintain an adequate inventory of all ICT assets in support of, and in combination with, sound life-cycle and patch management practices. This leads to insufficiently patched (and thus more vulnerable) and outdated ICT systems that may not support business and risk management needs. | • | Unpatched and outdated ICT systems that may cause adverse business and risk management impacts (e.g. lacking flexibility and agility, ICT outages, weakened ICT security and resilience). |
| ICT data Dysfunctional ICT integrity risks data processing or handling | Due to system, communication and/or application errors or failures, or erroneously executed data extraction, transfer and load (ETL) process, data could be corrupted or lost. | • • • | IT system error in batch processing, causing incorrect balances in client’s bank accounts. Wrongly executed queries. Data loss due to data replication (backup) error. |
| Ill designed data validation controls in ICT systems | Errors relating to missing or ineffective automated data input and acceptance controls (e.g. for used third party data), data transfer, processing and output controls in the ICT systems (e.g. input validity controls, data reconciliations). | • • • • | Insufficient or invalid formatting/validation of data inputs in applications and/or user interfaces. Absence of data reconciliation controls on produced outputs Absence of controls on the executed data extraction processes (e.g. database queries) leading to erroneous data. Use of faulty external data. |
| Ill controlled data changes in the production ICT systems. Ill designed and/or managed data architecture, data flows, data | Data errors introduced due to lack of controls on the correctness and justified nature of data manipulations performed in the production of ICT systems Ill managed data architectures, data models, data flows or data dictionaries may result in multiple versions of the same data across the ICT systems, which are no longer consistent due to differently applied data | • • | Developers or database administrators directly accessing and changing the data in the production ICT systems in a non-controlled way e.g. in the case of an ICT incident. The existence of different customer databases per product or business unit with different data definitions and fields, resulting in unreconciled and difficult to compare an integrate customer data at |
| ICT risk ICT risks (non categories exhaustive13 ) models or data dictionaries ICT outsourcing Inadequate risks resilience of third party or another Group entity services Inadequate outsourcing governance | Risk description models or data definitions, and/or differences in the underlying data generation and change process. The non-availability of critical outsourced ICT services, telecommunication services and utilities. Loss or corruption of critical/sensitive data entrusted to the service provider Major service degradation or failures due to inefficient preparedness or control processes of the outsourced service provider. Ineffective outsourcing governance may result in a lack of appropriate skills and capabilities to fully identify, assess, mitigate and monitor the ICT risks and can limit institutions’ operational capabilities. | Examples • • • • • | the level of the whole financial institution or group. Unavailability of core services as a result of failures in suppliers (outsourced) ICT systems or applications. Disruption of telecommunication links. Power supply shortage. Poor incident handling procedures, contractual control mechanisms and guarantees built into the service provider agreement that increase key man dependency on third parties and vendors. Inappropriate change management controls concerning the service provider ICT environment can cause major service degradation or failure. |
| Inadequate security of third party or another Group entity | Hacking of the third party service providers’ ICT systems, with a direct impact on the outsourced services or critical/confidential data stored at the service provider. Service provider staff gaining unauthorised access to critical/sensitive data stored at the service provider | • • | Hacking of service providers by criminals or terrorists, as an entry point into the institutions’ ICT systems or to access /destroy critical or sensitive data stored at the service provider. Malicious insiders at the side of the service provider try to steal and sell sensitive data. |