2025-06-29-IMF-秘鲁_金融部门网络安全战略技术援助报告（英）_49页_711kb

Cybersecurity Strategy for the Financial Sector in Peru

Core Content

This Technical Assistance Report outlines a comprehensive cybersecurity strategy for Peru's financial sector, developed by the IMF's Monetary and Capital Markets Department (MCM) in response to a request from the Superintendency of Banking, Insurance and Private Pension Fund Administrators (SBS). The report is structured around eight key elements and provides recommendations to enhance the sector's resilience against cyber threats.

Main Viewpoints

• Cybersecurity is a critical issue for Peru's financial sector, with cyberattacks posing significant threats to financial stability and public trust.
• The current cyber threat landscape includes denial of service attacks, data breaches, phishing, malware, ransomware, and fake fingerprint fraud.
• Inter-agency coordination is lacking, and there is no centralized forum for discussing cybersecurity strategies across the financial sector.
• Resource constraints affect the SBS's ability to supervise cybersecurity risks effectively, necessitating increased staffing and funding.
• Cyber mapping is essential to understand the financial system's vulnerabilities and interconnectedness.
• Threat-led penetration testing and a sector-specific CERT (FinCERT) are recommended to improve detection, response, and recovery capabilities.
• Information sharing is fragmented and lacks standardization, requiring the establishment of a sector-wide threat intelligence platform and standardized incident reporting framework.
• Public awareness campaigns are needed to educate consumers and reduce the impact of cyber threats.
• Continuous learning and updating of the cybersecurity strategy are crucial due to the evolving nature of cyber threats and the emergence of new technologies like AI and quantum computing.

Key Information

Element 1: Cybersecurity Strategy and Framework

• A high-level inter-agency committee is recommended to coordinate national cybersecurity initiatives.
• A public-private Cyber Resilience Forum should be established to foster collaboration and information sharing.

Element 2: Governance

• Increased resources are needed for cybersecurity risk supervision.
• Enhanced cybersecurity regulation should be developed to align with international standards and address current gaps.

Element 3: Risk and Control Assessment

• Cyber mapping of the financial system and cyber network is necessary to identify vulnerabilities and systemic risks.
• This includes mapping third-party service providers and assessing the impact of cyberattacks on interconnected systems.

Element 4: Monitoring

• A Cyber Threat Landscape Report for the Peruvian financial sector should be developed to document unique threats and patterns.
• Onsite supervision of cybersecurity risks should be increased, particularly for domestic systemically important banks.
• A comprehensive testing framework, such as threat-led penetration testing (TLPT), is needed to simulate real-world cyber threats.

Element 5: Response

• A sector-specific CERT (FinCERT) should be established to enhance the financial sector's ability to detect, respond to, and mitigate cyber threats.
• Integration with the national CERT is essential for coordinated response efforts.

Element 6: Recovery

• Comprehensive cyberattack simulation exercises should be conducted, involving all relevant authorities and institutions.
• A cross-authorities response framework is needed to ensure coordinated recovery efforts.

Element 7: Information Sharing

• A sector-wide threat intelligence platform and standardized incident reporting framework are required for effective information sharing.
• A comprehensive cyber education and public awareness program, including a Cyber Month campaign, is recommended to improve consumer understanding and preparedness.

Element 8: Continuous Learning

• A formal survey should be conducted to identify cybersecurity skills gaps and develop a cyber competency roadmap.
• The cybersecurity strategy and framework should be regularly reviewed and updated to respond to emerging threats and technologies.

Recommendations and Time Frames

Stakeholders and Coordination

• The SBS, BCRP, SMV, and MEF are the key authorities responsible for implementing the recommendations.
• Collaboration with other governmental bodies such as the ANPD, CNSD, and OSIPTEL is also essential.
• Annual reviews, ongoing stakeholder consultations, and monitoring of the evolving cyber threat landscape are recommended to ensure the strategy remains effective and up-to-date.

Challenges and Considerations

• The implementation of the cybersecurity strategy may face challenges due to the complexity of coordination and resource allocation.
• Sector coordination and collective action are vital to address cyber threats effectively.
• Legal and institutional mandates and resource availability will influence the prioritization and sequencing of recommendations.

Conclusion

The report emphasizes the importance of a holistic and coordinated approach to cybersecurity in the financial sector. It outlines actionable steps for enhancing resilience, response, recovery, and information sharing while promoting continuous learning and innovation. The strategy aims to ensure the stability and security of Peru's financial system in the face of evolving cyber threats.