FAQ

Egypt Financial Computing Incident Response Team (EG-FinCIRT) is the first sectorial computer incident response team (CIRT) in the country.

The Central Bank of Egypt established EG-FinCIRT as part of its regulatory and strategic roles to coordinate the stability of financial services provision in the country. This is especially important in light of the sector’s rapid expansion due to the focus on modernizing the financial ecosystem, inclusion, and digital banking, as well as to improve cybersecurity resilience and reduce risks and threats.

EG-FinCIRT is designed as an agile, competent, and task-fit organization with a broader range of capabilities that enable performing 24/7 security monitoring for constituents, cooperation and sharing of relevant, actionable cyber threat information, warnings, and effective security policies and practices for the benefit of all within the Egyptian Financial sector. Additionally, EG-FinCIRT offers its constituents a number of important cybersecurity services, including Penetration Testing, Incident Response, Digital Forensics and Artifact Analysis.

  • Security monitoring to detect any malicious/suspicious activities and ensure that every detected incident is handled.
  • Incident handling and providing support for any constituent under attack.
  • Threat hunting and gathering threat intelligence data to improve the accuracy of security incident detection. (processing of intelligence and disseminated to banks)
  • Providing professional digital forensic services, in case of cyber incidents, including reverse engineering and artifact analysis.
  • Provide penetration testing, code review, information security and vulnerability assessment for constituents.
  • Promoting cyber security awareness, expertise transfer and training programs in the financial and banking sector.

See the link below for more information on the services offered by EG-FinCIRT: https://www.egfincirt.org.eg/services/.

Incidents can be reported through different channels

  • EG-FinCIRT Website can be used for incident reporting, simply click “REPORT INCIDENT” Button in the Website Header and enter the Incident information. Your data will be transmitted securely to EG-FinCIRT servers.
  • You can contact EG-FinCIRT via e-mail at egfincirt@cbe.org.eg or cirt@egfincirt.org.eg. To encrypt sensitive information, we may use our PGP key, which is available at https://www.egfincirt.org.eg/contacts/

Any relevant information about the incident should be provided. As an example of the type of data that should be provided, consider the Report an Incident form https://www.egfincirt.org.eg/report-incident/

After reporting the incident, The Concerned Team in EG-FinCIRT will contact the reporting party for incident handling or any clarification required.

EG-FinCIRT Constituents can report cyber security Incidents that include exploitable security vulnerabilities, phishing, denial of service, malicious code (malware, viruses, ransomware, etc.), website defacement, compromised email accounts, any Bank’s related sites hacked or defaced, attacks on systems or any other cyber security related incidents

Moreover, any cyber Security incidents that is related to the Egyptian Financial sector should be reported to EG-FinCIRT.

Any non-cyber security incidents not related to the Egyptian financial sector.

  1. To Adhere to Central Bank Of Egypt Mandates.
  2. To receive technical assistance in handling the incident, and mitigating any damage that may result from the reported incident.
  3. To decrease the probability of such attacks and incidents recurring in the future as much as possible.
  4. To assist EG-FinCIRT in raising cyber security resilience among the financial and banking sector, as well as to assist other constituents in avoiding such a reported incident.
  5. To assist EG-FinCIRT in disseminating more accurate statistics on cybercrime in the financial and banking sector.
  6. To assist CBE Cyber Security Sector in developing better security guidelines and controls for the Financial sector in Egypt.
  • Contact EG-FinCIRT immediately. 
  • Follow EG-FinCIRT Recommendations that may include but not limited to:
    1. Identify the source machine(s) that are affected by the security incident
    2. Isolate the discovered machine(s).
    3. Keep all infected devices (if any) running without shutting them down or modification till further notification from EG-FinCIRT.

Member of