Exercising Caution in Times of Heightened Cyber Threat

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Exercising Caution in Times of Heightened Cyber Threat The Malta Financial Services Authority (the “Authority”) would like to remind Authorised Persons about their expectation to conduct proper situational awareness and regularly assess their exposures to developing ICT and cybersecurity threats, whilst taking timely measures to address them. The Authority expects Boards of Directors to ensure that ICT and cybersecurity risks are adequately being discussed, that clear roles and responsibilities are set and that ICT and cybersecurity risks are being managed. Authorised Persons are expected to continue to follow developments from reputable sources, revisit and re-assess their ICT and security risks (including third party risks) taking into consideration emerging threats and vulnerabilities, and ensure that they have business continuity and disaster recovery plans in place that address severe but plausible scenarios. In particular, Authorised Persons are to ensure that their backup and recovery processes are functioning correctly and in line with secure backup best practices. The Authority could not stress further, the importance of continuing to train staff at all levels (for instance on social engineering trends), and where applicable, releasing timely information to consumers in relation to any known threats possibly directed at them (for instance, known occurrences of cybersquatting). At an international level, ENISA and CERT-EU issued a Joint Publication – Boosting your Organisation’s Cyber Resilience intended for decision makers and security practitioners to support organisational risk management. An analysis of the rise in major threats is available on both ENISA’s latest Annual Threat Landscape Report and the Threat Landscape Report published by CERT-EU. At a national level, CSIRTMalta has published a set of best practices in order to strengthen resilience. The Authority would like to remind Authorised Persons to continue to follow and make the best use of information published by CSIRTMalta on its information dissemination channels. The Authority would also like to remind Authorised Persons of their expectation to report Major ICT Related Incidents to the Authority in a timely manner. Authorised Persons may request further information by sending an email to the Supervisory ICT Risk and Cybersecurity function within the MFSA on sirc@mfsa.mt. 17 March 2022