FINTECH FOCUS: CYBERSECURITY The TIBER framework is different to many earlier cybersecurity testing procedures. Instead of working in an isolated environment, separate from main operations, TIBER is live. Providing far more meaningful results, TIBER tests companies’ systems in the real world. This adds a level of risk that must be managed meticulously, both by the organisation and its testing provider. The consequences of not doing so are serious. CBEST was the first testing framework to operate in a live environment. Specialist red teams have been highly trained (and CREST-accredited) to deliver CBEST testing that’s secure, legally compliant, and ethical. At Nettitude, we believe the TIBER framework must learn from this high level of service. So, finding the right TIBER test provider for your financial organisation is crucial. You’ll want a secure test, but there’s huge value in knowing how to act on the results to protect your operations. An obvious question exists: should you opt for a local provider in your country or choose a larger, global tester? We consider both here.
GOING LOCAL…
Firms should consider their choices carefully when asking a company to punch a big hole in their cyber defences to test their resilience. Here, Nettitude’s Anthony Long, Head of Threat Intelligence & Advisory Consulting outlines the options 88
TheFintechMagazine | Issue 21
It can be tempting to keep TIBER testing local. A familiar provider in the same country can seem reassuring. If timelines are tight, engaging an existing provider will be faster than appointing a new one. They’ll already know how you operate and won’t have language differences or limited cultural insight. But local testing providers are, by their very nature, smaller operators. When handling live TIBER testing, this is a risk. Generally, local operators have less testing experience, smaller teams and fewer qualified individuals. Also, their knowledge of cybersecurity beyond finance could be limited. This might not seem significant, but they’ll lack the broader insight of new and emerging risks that financial organisations and their regulators are yet to consider. A local TIBER tester could seem like the more convenient option. But you might find it’s a less safe one.
OR GLOBAL… Just like many financial organisations, global TIBER test providers operate in many countries. Global banks and other www.fintechf.com
