A major cyber-attack is being simulated on the financial sector on Tuesday in an exercise called Waking Shark II.
Workers in financial firms are being subjected to a series of announcements designed to imitate a major attack on computer systems.
The simulations are being co-ordinated by the Bank of England, Treasury and Financial Conduct Authority, who are keenly watching every large bank to see if they can withstand a sustained cyber-attack.
The exercise comes two years after the original Waking Shark simulation, a much smaller operation held in the auditorium of Credit Suisse at Canary Wharf on 11 March 2011.
That revealed that financial firms had a number of channels to discuss the business impacts of a disruption, but far fewer comparable ways to share information in between IT departments. Additionally, the companies knew about the existence of relevant bodies, but had little understanding of how they could actually help.
"It’s reached a point where experiencing a cyber-attack must be thought of as a ‘when, not if’ for most businesses," said Ross Brewer, a vice-president at cyber-security firm LogRhythm. "If they aren’t ready and waiting, many will find themselves like proverbial rabbits in headlights before too long.
"There are a number of industries that play a critical role in keeping the country operational and it’s essential that these sectors are fully prepared for disaster."
The exercise comes a few months before the Treasury and financial regulators are required to submit action plans for cyber-attacks to the Financial Policy Committee of the Bank of England.
In the FPC's September meeting (pdf), it required that, by the first quarter of 2014, the relevant bodies must "ensure that there [is] a concrete plan in place to deliver a high level of protection against cyber-attacks for each institution at the core of the financial system, including banks and infrastructure providers, recognising the need to adapt to evolving threats."
"The world’s largest companies have been targeted over recent months by increasingly sophisticated hackers," said Stephen Bonner, a partner in KPMG’s Information Protection & Business Resilience team. "It is now not just a lone hacker sitting in their bedroom but, in many cases, serious organisations backed by the resources of nation states who are leading the charge.
“Incidents which involve the loss or theft of commercial rather than personal data often go largely unreported. Hacking is now widespread and the attackers range from the intellectually curious through to sophisticated nation states, the targets range from safety-critical processing systems through to price-sensitive deal data."
In September, eight men were arrested in connection with a £1.3m theft from Barclays using a compromised computer. A bogus IT engineer fitted a wireless device to a system in a branch of the bank, and used it to transfer money to a bank account under their control.
• "We have a level of trust in certain organisations and criminals exploit that trust."
