New ITU cyber resilience toolkit builds trust in digital finance
A new toolkit from the International Telecommunication Union (ITU) provides expert guidance in assessing and guarding against cybersecurity risks to infrastructure critical to digital financial services.
The cybersecurity resilience assessment toolkit details how regulators and other stakeholders in digital financial services can evaluate the resilience of business ecosystems amid evolving cybersecurity threats.
The toolkit is a product of the ITU Security Lab for Digital Financial Services, developed with the collaboration of Deloitte Consulting.
By working with the lab, regulators in emerging economies can ensure secure infrastructure and applications to expand financial inclusion.
The toolkit aims to help regulators understand the cybersecurity readiness of critical infrastructure for digital financial services operated by the information and communication technology (ICT) and financial services sectors.
This understanding can help regulators steer their respective national business ecosystems in the right direction. In effect, this means knowing each market’s level of cybersecurity maturity and how government agencies, companies and other groups can work together to be resilient to cyber threats.
“Sharing information among countries, between sectors and across different value chains greatly enhances resilience,” said Vijay Mauree, ITU’s lead for digital financial services. “Inclusive knowledge-sharing can help all stakeholders to align with globally recognized cybersecurity legislation, technical standards and best practices.”
Six pillars of resilience
ITU’s toolkit provides expert guidance in six areas essential to cybersecurity resilience.
Users are asked to respond to questions, which yield scores for resilience in key areas, or pillars, as well as overall.
Those scores, also presented visually as radar charts, help regulators gauge and improve their market’s cybersecurity maturity.
The six pillars in the resilience toolkit are:
- Risk management – comprehensive identification and management of potential cybersecurity risks, through processes for risk assessment, monitoring and review, and treatment.
- Governance – addressing roles and responsibilities, communication channels, and the availability of official documentation.
- Testing – includingred teaming, penetration testing, vulnerability scanning, simulations, war games, and other methods.
- Training and awareness – fostering a culture of cyber resilience and information sharing on best practices among employees and business partners.
- Protection – based on robust internal and peripheral defense mechanisms.
- Incident response – including governance and reporting mechanisms, for an effective incident-response lifecycle.
Collaborate with the lab
The ITU Security Lab for Digital Financial Services runs Security Clinics that offer coaching in the adoption of the recommendations for secure digital finance developed by the Financial Inclusion Global Initiative.
The technical assistance provided by the lab empowers regulators to conduct security audits of mobile payment applications to determine their compliance with the security recommendations.
The lab’s knowledge-transfer programme is helping regulators in emerging economies to establish their own security labs to test the security of their countries’ mobile payment applications. The programme, extended in 2023 to include cyber resilience assessment, is benefitting regulators in Uganda, Tanzania, and Peru, and will soon also serve The Gambia, Zimbabwe, and Rwanda.
The programme also helps countries coordinate their regulatory actions for secure digital finance, with the support of an ITU-recommended Memorandum of Understanding between a country’s ICT regulator and central bank.
Contact the lab for technical assistance in:
- Cyber resilience assessment.
- Sharing security threat intelligence.
- Security audits of mobile payment applications.
- Applying international standards for secure digital finance.
- Mechanisms to share information on security incidents and vulnerabilities.
- Knowledge transfer for conducting security audits of mobile payment apps.
Image credit: Adobe Stock
