Operational Aspects of Cyber Crimes & Fraud Risk Management in Cyber Tech
Principles & Practices of Banking | Module C · Chapter 49
Covers the operational security landscape of modern banking — the distinction between fraud and cybercrime, 9 types of risks from cyber attacks, threat actors, Defence-in-Depth strategy, Security Operations Centre (SOC), Cyber SOC (C-SOC) per RBI guidelines, SIEM, VAPT, Network Behaviour Anomaly Detection (NBAD), and the 6-phase Cyber Incident Response Plan.
📌 Why This Chapter Matters in JAIIB
Expect 4–6 questions from this chapter. Key exam focus areas: Fraud vs Cybercrime (Fraud = intentional deception for financial gain; Cybercrime = any criminal act involving computers/networks; cybercrime can be non-financial — political, passion, vulnerability discovery); Threat actors(Cybercriminals, Business competitors, Current/former employees — answer is always "All of the above"); 8 mitigation strategies (Patching applications AND operating systems = remediate KNOWN security vulnerabilities; Application whitelisting = control execution of unauthorised software; MFA = protect against credential theft); Defense-in-Depth (succession of security controls; prevents single point of failure; no single mitigation can prevent all threats); SOC (headed by CISO; detects, analyses, responds; staffed by security analysts, engineers, managers); SIEM (combines SIM + SEM; analyses events against rules in real-time; used for detecting/analysing/responding to threats — MCQ answer); VAPT (VA = internal organisational security; PT = external real-world threat; High/Medium/Low classification; all three — network, server, system infrastructure — are objectives: MCQ answer = All of above); NBAD (detects zero-day attacks and encrypted threat traffic where signature-based systems cannot); Incident Response Plan (Proactive = Preparation + Detection Analysis; Responsive = Containment + Eradication + Recovery).
Key Facts & References — Chapter 49 at a Glance
Introduction, Fraud vs Crime & Risks from Cyber Attacks
FreeIntroduction
Because of the virtual presence of banks, cybercrime is growing at an alarming rate and may soon replace many conventional financial crimes. Threat actors can easily commit these offences thanks to the internet's anonymity and ease of use. Unauthorized access to devices, identity theft, and online bank information theft are among the most common types of cyberattacks. As more and more banking transactions are conducted online, financial institutions must not only combat fraud but also protect customer-facing portals from Man-in-the-Middle and Distributed Denial of Service attacks. Banks have developed Security Operations Centres (SOCs) to counter cyber attacks under regulatory guidance.
Fraud vs Crime — Key Distinction
| Dimension | Fraud | Cybercrime |
|---|---|---|
| Definition | Intentional use of deception to acquire an unfair advantage over another individual — most typically in the form of money | Any criminal act that involves the use of computers or networks |
| Motivation | Always financial gain | Financial gain, political motivation, personal passion, OR even just because a vulnerability was discovered |
| Scope | Against individuals AND corporations | Against individuals and organisations; broader than fraud |
| Key differences | Narrower: financial in nature; specific skill set; specific delivery means | Broader: political/passion/discovery motivations possible; different skill set and delivery mechanisms |
💡 Key exam point
Fraud is a type of crime committed for financial gain. Cybercrime is broader — it can have non-financial motivations (political, passion, vulnerability discovery). Two other significant differences: skill set required and means by which the event is delivered.
Risks for Banks from Cyber Attacks (9 types)
Threat Actors, Cyber Threats & Risk Mitigation Strategies
FreeWho Are the Threat Actors? (3 Categories)
A threat actor is an individual or group that takes part in a malicious act intended to harm IT assets — computers, devices, systems, or networks.
Cybercriminals
Individuals or groups that cause a malicious cyber attack on the business. Includes:
- •Criminals — after financial gain or information; disrupt business
- •Clients — compromise information with malicious intent
Business Competitors
Your competitors in the same line of business who use cyber means to gain competitive advantage.
Current or Former Employees
Who accidentally or intentionally compromise your information or data — insider threats.
⚠️ MCQ answer — threat actors
In cyberspace, a threat actor can be: Cybercriminal, Business competitor, Present or former employee. Answer: (d) All of the above.
Various Cyber Threats to Banks
Banks and financial institutions process billions of transactions daily, making them the primary target of cybercriminals globally. Organisations must monitor user activity proactively, react to alerts in real-time, and remediate threats from both external hackers and malicious insiders.
Cyber Risk Mitigation Strategies — 8 Essential Controls
Cyber risk mitigation divides into three categories: Prevention, Detection, and Remedy. Banks must adopt mitigation tactics that evolve to keep pace with evolving threat actor techniques.
| # | Mitigation Strategy | Purpose |
|---|---|---|
| 1 | Application Whitelisting | Control the execution of unauthorised software |
| 2 | Patching Applications | Remediate known security vulnerabilities (in applications) |
| 3 | Configuring Microsoft Office Macro Settings | Block untrusted macros |
| 4 | Application Hardening | Protect against vulnerable functionality |
| 5 | Restricting Administrative Privileges | Limit powerful access to systems |
| 6 | Patching Operating Systems | Remediate known security vulnerabilities (in OS) |
| 7 | Multifactor Authentication (MFA) | Protect against risky activities and credential theft |
| 8 | Daily Backups | Maintain the availability of uninfected critical data |
⚠️ MCQ trap — Patching OS vs patching apps
Both patching applications AND patching operating systems are done to "remediate known security vulnerabilities." Patching OS is option (a) — answer for "Patching operating systems is done to remediate against..." is (a) known security vulnerabilities, NOT "DDoS attacks" or "execution of unauthorized software."
Defence-in-Depth & Common Measures Adopted by Banks
Defense-in-Depth Strategy
Definition
Defence-in-Depth is a security strategy in which a succession of security procedures and controls are carefully placed throughout a computer network to safeguard the network and the information within it.
Key Characteristics
- →No single mitigation can prevent ALL cyber dangers from occurring
- →When multiple controls work together, they provide protection against a variety of threats
- →Also provides redundancy if one method fails
- →Prevents any SINGLE POINT OF FAILURE
- →Significantly increases the time and complexity required to successfully compromise a network
- →Requires more effort and resources from attackers
Defence-in-Depth Layers
Common Measures Adopted by Banks Against Cyber Threats
Security of Bank's digital assets governed by: (1) RBI Security Framework for Baseline Guidelines — dt. 02.06.2016 and (2) Master Direction on Digital Payment Security Controls — dt. 18.02.2021.
NGF
Next-Generation Firewalls
IDS/IPS
Intrusion Detection / Prevention Systems
Anti-APT
Anti Advanced Persistent Threat
Anti-DDoS
Anti Distributed Denial of Service
Anti-Phishing
Anti-Phishing, Malware Monitoring
PIM
Privileged Identity Management
FIM
File Integrity Management
WAF
Web Application Filtering
Cyber Insurance
Insurance against cyber incident losses
SOC
Security Operations Centre to monitor threats
VAPT
Vulnerability / Penetration Testing
Staff Awareness
Involvement of Top Management + Staff/Customer Cyber Security Awareness
Best Practices
Adopting Best Practices and Frameworks (e.g. ISO 27001, NIST)
NBAD
Network Behaviour Anomaly Detection
SOC, Cyber SOC (C-SOC), SIEM, VAPT & NBAD
Security Operations Centre (SOC)
What is SOC?
A SOC consists of an information security team that is in charge of continuously monitoring and assessing an organisation's security posture. Typically headed by the Chief Information Security Officer (CISO).
SOC Team Purpose
- →Detect, analyse, and respond to cybersecurity issues
- →Uses a combination of technology solutions and a solid set of processes
- →Personnel collaborate closely with incident response teams
- →Ensure security vulnerabilities are addressed as soon as discovered
SOC Staffing
What SOC Monitors
Cyber SOC (C-SOC) — As per RBI Guidelines
Banks must set up and operationalize a Cyber SOC (C-SOC) as per RBI guidelines.
C-SOC System Requirements (what must be in place)
Management Briefing
Top Management/Board Briefing on Threat Intelligence
Dashboards & Oversight
Dashboards and oversight systems for real-time security posture visibility
Policy & Enforcement
Policy, measurement and enforcement (key metrics, reporting structure)
Stakeholder Management
Informing stakeholders, stakeholder participation
Incident Investigation
Incident investigation, forensics and deep packet analysis
Root Cause Analysis
Methods to identify root cause of attacks, classify into categories, contain further attacks of similar types
Dynamic Behaviour Analysis
Preliminary static & dynamic analysis and collecting Indicators of Compromise (IOC)
Geo-location Analytics
Analytics with good dashboard showing geo-location of IPs
Counter Response
Counter response and Honeypot services
⚠️ MCQ answer — C-SOC aspects
Which is NOT part of C-SOC requirements? Answer: (a) Forensic investigation of financial frauds. The C-SOC covers: Dashboards and oversight, Policy/measurement/enforcement, Dynamic Behaviour Analysis (IOC), Counter response/Honeypots, Geo-location analytics — NOT standalone financial fraud forensics.
SIEM — Security Information and Event Management
SIEM = SIM + SEM
Combines Security Information Management (SIM) + Security Event Management (SEM). Analyses application and network hardware security alarms in real-time.
How SIEM Works
- →Analyses events against rules and analytics engines
- →Indexes events for search in milliseconds
- →Uses information acquired from around the world
- →Provides security teams with both insight into AND a record of events in IT environment
SIEM Capabilities
⚠️ MCQ answer — tool for detecting/analysing/responding
Which is used for detecting, analysing, and responding to security threats? Answer: (c) SIEM. Not Firewall (blocks) or IDS (detects only).
VAPT — Vulnerability Assessment & Penetration Testing
VAPT aims at identifying vulnerabilities in the network, server, and system infrastructure. Both are security services with distinct but complementary goals.
| Component | Focus |
|---|---|
| VA — Vulnerability Assessment | Internal organisational security — finds weaknesses inside the system |
| PT — Penetration Testing | External real-world threat — simulates an actual attack from outside |
How Banks Conduct VAPT
- →Conducted periodically through approved third-party vendors
- →Observations classified into: High, Medium, and Low risks
- →Mandatory to mitigate vulnerabilities and report to top management
⚠️ MCQ answer — VAPT objective
VAPT identifies vulnerabilities in: (a) network, (b) server, (c) system infrastructure. Answer: (d) All of the above.
NBAD — Network Behaviour Anomaly Detection
How NBAD Works
- →NIDS (Network Intrusion Detection Systems): monitors packets on the network and looks for patterns matching a database of signatures of known security threats
- →NBAD is particularly helpful where signature-based systems CANNOT detect:
- →(i) New ZERO-DAY attacks (signatures don't exist yet)
- →(ii) When threat traffic is ENCRYPTED — e.g. command and control channel for certain Botnets
- →Tracks critical network characteristics in real-time
- →Generates an alarm if a strange event or trend is detected
Network Characteristics NBAD Monitors
Baseline & Anomaly Detection
For NBAD to be optimally effective: a baseline of normal network/user behaviour must be established over a period of time. Any departure from defined normal parameters is flagged as anomalous.
4 Application Domains of NBAD
Phases of an Effective Cyber Incident Response (CIR) Plan
6-Phase Cyber Incident Response Plan
As cyber-attacks take a toll on business operations and reputation, banks must develop a robust Cyber Incident Response (CIR) plan to stay ahead of the cybersecurity curve. Banks need both proactive and responsive capabilities that can rapidly adapt to cyber incidents.
Preparation
Develop the CIR plan before an incident occurs. Establish team roles, communication protocols, tools, and training. Create and maintain an asset inventory. Define escalation procedures.
Detection & Analysis
Identify and confirm that a security incident has occurred. Use SIEM, NBAD, and SOC tools to detect anomalies. Analyse indicators of compromise (IOC). Determine scope and severity of the incident.
Containment
Limit the spread and impact of the incident. Isolate affected systems. Implement short-term and long-term containment strategies. Preserve evidence for forensic investigation.
Eradication
Identify and eliminate the root cause of the incident. Remove malware, close exploited vulnerabilities, patch systems. Ensure all affected systems are clean before restoration.
Recovery
Restore affected systems and services to normal operations. Validate that systems are fully clean and functional. Monitor closely for any signs of residual issues. Communicate recovery status to stakeholders.
Post-Incident Activity (Lessons Learned)
Conduct a thorough review of the incident. Identify what worked and what didn't. Update the CIR plan. Report to RBI and senior management as required. Improve defences based on findings.
| Phase Type | Phases Included | When |
|---|---|---|
| Proactive Capabilities | Preparation + Detection & Analysis | Before / as incident begins |
| Responsive Capabilities | Containment + Eradication + Recovery | After incident is identified |
Chapter 49 — MCQ Quick Reference
Patching operating systems is done to remediate against...
✓ (a) Known security vulnerabilities
NOT DDoS attacks or execution of unauthorized software
In cyberspace, a threat actor can be...
✓ (d) All of the above
Cybercriminal, Business competitors, Present or former employee — all three
Which tool is used for detecting, analysing, and responding to security threats?
✓ (c) SIEM
SIEM combines SIM+SEM for real-time analysis. NOT Firewall or IDS alone.
Which is NOT among C-SOC requirements?
✓ (a) Forensic investigation of financial frauds
C-SOC covers: dashboards, policy/enforcement, Dynamic Behaviour Analysis, counter response — not standalone financial fraud forensics
VAPT objective is to identify vulnerabilities in the...
✓ (d) All of the above
Network, Server, AND System infrastructure — all three are correct
Discussion
No comments yet. Be the first to share your thoughts.