BoG commissions Financial Industry Command Security Operations Centre
In its quest to ensure the delivery of a safer digital financial industry, the Bank of Ghana (BoG) has inaugurated an advanced command centre known as the ‘Financial Industry Command Security Operations Centre (FICSOC)’.
The move forms part of efforts to curb the numerous cybersecurity risks in the country and to create a secure cybersecurity environment in the financial sector.
In October 2018, the Bank of Ghana issued the Cyber and Information Security Directive (CISD) for banks and other Bank of Ghana-regulated financial institutions with expectation that all regulated financial institutions would implement the required Information Security Management Systems (ISMS) controls to ensure the delivery of a safer digital financial Industry.
The implementation of the Directive was phased over 36 months, and through effective monitoring and supervision among regulated banks.
As these institutions worked towards full implementation of the Directive, it became evident that the Bank of Ghana had to establish an industry Security Information and Event Management (SIEM) system to enable those institutions implementing SIEMs to send logs/alerts, aggregate information and reports.
Delivering the keynote at the commissioning of the centre, Vice President, Dr. Mahamudu Bawumia is calling for deepened collaboration between institutions within the banking and financial industry to improve the cyber security structure in the country.
This he believes will also improve information security resiliency.
He also noted that the project will contribute significantly to improving cybersecurity issues among financial sector institutions.
He said the use of digital technologies continues to transform the business models of financial institutions with new revenue and value-producing opportunities: “While these digital technologies support banking services and enable banking strategies, the underlying security vulnerabilities pose key cyber risks among those institutions.
The BoG issued its Cyber and Information Security Directive (CISD) in October 2018 – which largely defines the industry’s approach to cybersecurity defence and response.
The directive required that each regulated financial institution implement a SIEM technology that provides real-time analysis of the security alerts which network, hardware and applications generate, and create a Security Operations Centre (SOC) to be operated by designated employees to serve as its cyber nerve-centre.
The Central Bank was to establish an industry SIEM system to receive logs/alerts, aggregate information and reports from each institution’s SIEM. These requirements, he said, formed the FICSOC project’s foundation.
As of April 2023, he said, all commercial banks had been connected to the FICSOC; and reporting of cyber threat intelligence in the form of FICSOC alerts and FICSOC advisories is being communicated to these banks.
FICSOC is a threat intelligence-sharing platform designed for secure sharing and collaboration, as well as to facilitate the analysis and prioritisation of risks, the allocation of resources, and the understanding of threats tailored to each regulated financial institution and the banking industry.
With a coordinated approach between the regulator and member-banks, he said, FICSOC will support regulated financial institutions to collaboratively fight cybersecurity threats while maintaining independence and confidentiality in day-to-day operations.
On his part, Governor of the Bank of Ghana, Dr. Ernest Addison, said that the FICSOC will help provide real-time visibility into cyber threats and attacks targetting the banking sector.
As a result, the Bank of Ghana and the cybersecurity authority are collaborating to improve the banking sector’s cybersecurity posture.
In particular, he stated, the two institutions are discussing various ways to approach implementation of the Cybersecurity Act 2020, Act 1038, for the sector.
Source: Ghana Business
