Research: cyber risk and financial stability
A Federal Reserve FEDS Note I co-wrote on how a cyber incident could spread through the financial system, and what that means for keeping it stable.
In May 2022 the Federal Reserve Board published “Implications of Cyber Risk for Financial Stability,” a FEDS Note I co-wrote with Antonis Kotidis, Anna Kovner, Michael Lee and Stacey Schreft.
Most cyber events at financial firms are stopped by the firms’ own defenses. The note looks past individual firms and asks a system-level question: when one does get through, how could the financial system amplify it?
The framework
We fit cyber risk into the Fed’s existing financial stability framework:
- Shocks: cyber events, malicious or not.
- Firm-level weaknesses: gaps in a firm’s controls, defenses and ability to recover, which turn an event into an incident.
- System-level amplifiers: shared technology and third-party providers, data and operational dependencies, critical services with no substitutes, time-sensitive payments, and loss of confidence that can lead to runs and fire sales.
Losses can spread in two ways. Many firms can be hit at once through something they share, like a common software update (the “popcorn effect”), or the damage can pass from one firm to the next through their links (the “domino effect”).
What we concluded
- Cyber risk fits within the financial stability framework, but traditional mitigants such as capital and liquidity may need to be supplemented.
- More research is needed on how cyber vulnerabilities spread and what reduces them.
- Significant data gaps make it hard to assess and mitigate cyber vulnerabilities, both inside the financial system and at its service providers.
Read it: Implications of Cyber Risk for Financial Stability (doi: 10.17016/2380-7172.3077)