The following podcast contains advertising.

To access an ad-free version of the LawFair podcast,

become a material supporter of LawFair at patreon.com slash law fair.

That's patreon.com slash law fair.

Also, check out LawFair's other podcast offerings,

rational security, chatter, law fair no bull, and the aftermath.

One of the mistakes that we make on the cybersecurity side a lot is when we think about cyber risk.

We're almost always talking about what's the cyber risk inside to my company.

The unit of an analysis is almost always the company.

And that's useful, right? If we're thinking about financial risk, yeah, you can think about what's how risky is this particular firm.

But there's also, I mean, the whole point of systemic stability is looking at even if every unit is making good risk decisions,

there's still this risk between them and how that risk can get transmitting.

So a lot of what we've had to do in our work is try to pull ourselves out of just thinking about the cybersecurity risk for that individual company itself.

Ten years ago, in the financial crisis, many financial institutions or companies or individuals that themselves made the right risk decisions.

Got toppled over by those that didn't.

I'm Susan Hennessy, and you're listening to the LawFair podcast November 3rd, 2018.

The rate and intensity of cyber attacks on financial institutions has increased in recent years.

But the risk that these attacks pose to our financial stability remains understudied in the financial industry and among regulators and policymakers.

What would it look like if malicious actors took direct aim at the systemic stability of US financial institutions?

On October 11th, I spoke to three senior research scholars from Columbia School of International and Public Affairs,

were taking early steps to find the answer.

Katherine Rosen, former deputy assistant treasury secretary for financial institution policy, Jason Healey, former White House Cyber Advisor in the Bush administration,

...