The Bank of England is working with banks on deep cyber-recovery options, its deputy governor Sarah Breeden said on Thursday, arguing they can no longer assume their defences are impenetrable in the face of AI-enabled cyberattacks.
Breeden said the BoE is also surveying banks on their readiness for the risks that quantum computing poses to encryption and will use the results to shape a system-wide response for the financial sector.
Regulators globally are stepping up efforts to contain growing cyber risks which could threaten financial stability, Reuters reported on Tuesday, including in Britain where supervisors have been encouraging the largest banks to examine bare metal recovery plans.
The main concern is either hackers or hostile states weaponising advanced AI models to exploit vulnerabilities in banks’ IT systems. Regulators also worry about the risk of rogue AI agents circumventing safeguards and acting in unexpected ways.
Breeden told the Institute of International Finance annual meeting in Bangkok that AI advancements meant the technology now posed a “systemic risk” to the global financial system.
The International Monetary Fund warned on Tuesday that an AI-enabled cyber attack on a critical service of a financial institution could undermine confidence.
“It’s not enough now to assume that the cyber attackers won’t get through,” Breeden said.
“We need to be thinking about what are the bare metal recovery options … that we need for the core services, and we need to think about that end-to-end across the financial system,” she said.
Bare metal systems are entirely independent from a bank’s main tech set-up and can kick in if primary operating systems are compromised.
“Cyber is always the thing that I say keeps me up at night. The thing that I worry about the most is waking up and one of our most systemically important banks or a bit of core infrastructure has been attacked and is paralysed,” she said.
QUANTUM CRYPTOGRAPHY
Quantum computing is widely expected to eventually be capable of breaking some of the encryption standards used to secure financial systems, creating a potentially significant cyber risk for banks and other institutions.
While the timing of such a breakthrough remains uncertain, Breeden said that was no reason to delay preparations.
“We are surveying the firms to understand where they are. We’ll use that intelligence to then look alongside the guidance that the National Cyber Security Centre for the UK has put out, and then I think we need to engage with industry to put a system-wide plan together,” she said.
Lionel Martellini, founding director of the EDHEC Quantum Institute, said that unlike conventional cyber threats, a quantum breakthrough could undermine the cryptographic foundations of the entire financial system simultaneously, including payments, clearing and financial communications.
“The G7 has already laid out a roadmap for coordinated action. The real question is whether the industry can move fast enough before the quantum clock runs out,” Martellini said.