PPB Module CChapter Notes4–6 Marks Expected

Operational Aspects of Cyber Crimes & Fraud Risk Management in Cyber Tech

Principles & Practices of Banking | Module C · Chapter 49

Covers the operational security landscape of modern banking — the distinction between fraud and cybercrime, 9 types of risks from cyber attacks, threat actors, Defence-in-Depth strategy, Security Operations Centre (SOC), Cyber SOC (C-SOC) per RBI guidelines, SIEM, VAPT, Network Behaviour Anomaly Detection (NBAD), and the 6-phase Cyber Incident Response Plan.

By Bankopedia.co.inUpdated 2026JAIIB PPB · Module C

📌 Why This Chapter Matters in JAIIB

Expect 4–6 questions from this chapter. Key exam focus areas: Fraud vs Cybercrime (Fraud = intentional deception for financial gain; Cybercrime = any criminal act involving computers/networks; cybercrime can be non-financial — political, passion, vulnerability discovery); Threat actors(Cybercriminals, Business competitors, Current/former employees — answer is always "All of the above"); 8 mitigation strategies (Patching applications AND operating systems = remediate KNOWN security vulnerabilities; Application whitelisting = control execution of unauthorised software; MFA = protect against credential theft); Defense-in-Depth (succession of security controls; prevents single point of failure; no single mitigation can prevent all threats); SOC (headed by CISO; detects, analyses, responds; staffed by security analysts, engineers, managers); SIEM (combines SIM + SEM; analyses events against rules in real-time; used for detecting/analysing/responding to threats — MCQ answer); VAPT (VA = internal organisational security; PT = external real-world threat; High/Medium/Low classification; all three — network, server, system infrastructure — are objectives: MCQ answer = All of above); NBAD (detects zero-day attacks and encrypted threat traffic where signature-based systems cannot); Incident Response Plan (Proactive = Preparation + Detection Analysis; Responsive = Containment + Eradication + Recovery).

Key Facts & References — Chapter 49 at a Glance

Fraud:Intentional use of deception to acquire an unfair advantage — typically financial. Can be against individuals or corporations.

Cybercrime:Any criminal act involving the use of computers or networks. Can be motivated by: financial gain, political motivation, personal passion, or vulnerability discovery.

Threat actor:Individual or group that takes part in a malicious act intended to harm IT assets (computers, devices, systems, or networks).

3 threat actors:Cybercriminals (individuals/groups), Business competitors, Current or former employees (accidental or intentional)

9 cyber threats:Identity Theft, Data Breach/Theft, Ransomware, Phishing/Vishing/Smishing/Pharming, Cyber Squatting/Bullying/Warfare, DDoS — and others

App whitelisting:Control the execution of UNAUTHORISED SOFTWARE

Patch apps:Remediate KNOWN SECURITY VULNERABILITIES in applications

Patch OS:Remediate KNOWN SECURITY VULNERABILITIES in operating systems

MS Office macros:Configure macro settings to block UNTRUSTED MACROS

App hardening:Protect against VULNERABLE FUNCTIONALITY

Admin privileges:Restrict to LIMIT POWERFUL ACCESS to systems

MFA:Protect against RISKY ACTIVITIES and CREDENTIAL THEFT

Daily backups:Maintain AVAILABILITY OF UNINFECTED CRITICAL DATA

Defense-in-Depth:Succession of security procedures/controls placed throughout network; prevents single point of failure; increases time/complexity to compromise

SOC:Security Operations Centre — headed by CISO; detects, analyses, responds to cybersecurity issues; monitors network, server, endpoint, database, app, website activity

C-SOC:Cyber SOC — Banks must set up and operationalize as per RBI guidelines

SIEM:Security Information and Event Management — combines SIM + SEM; analyses events against rules in real-time; provides data analysis, event correlation, aggregation, reporting, log management

VAPT:Vulnerability Assessment + Penetration Testing; VA = internal organisational security; PT = external real-world threat; classified as High/Medium/Low; conducted by approved third-party vendors

NBAD:Network Behaviour Anomaly Detection; detects zero-day attacks AND encrypted threat traffic (where signature-based systems cannot); establishes baseline of normal behaviour then flags anomalies

IRP phases:Proactive: Preparation + Detection Analysis. Responsive: Containment + Eradication + Recovery

Introduction, Fraud vs Crime & Risks from Cyber Attacks

Free

49.1

Introduction

Because of the virtual presence of banks, cybercrime is growing at an alarming rate and may soon replace many conventional financial crimes. Threat actors can easily commit these offences thanks to the internet's anonymity and ease of use. Unauthorized access to devices, identity theft, and online bank information theft are among the most common types of cyberattacks. As more and more banking transactions are conducted online, financial institutions must not only combat fraud but also protect customer-facing portals from Man-in-the-Middle and Distributed Denial of Service attacks. Banks have developed Security Operations Centres (SOCs) to counter cyber attacks under regulatory guidance.

49.2

Fraud vs Crime — Key Distinction

Dimension	Fraud	Cybercrime
Definition	Intentional use of deception to acquire an unfair advantage over another individual — most typically in the form of money	Any criminal act that involves the use of computers or networks
Motivation	Always financial gain	Financial gain, political motivation, personal passion, OR even just because a vulnerability was discovered
Scope	Against individuals AND corporations	Against individuals and organisations; broader than fraud
Key differences	Narrower: financial in nature; specific skill set; specific delivery means	Broader: political/passion/discovery motivations possible; different skill set and delivery mechanisms

💡 Key exam point

Fraud is a type of crime committed for financial gain. Cybercrime is broader — it can have non-financial motivations (political, passion, vulnerability discovery). Two other significant differences: skill set required and means by which the event is delivered.

49.2.1

Risks for Banks from Cyber Attacks (9 types)

→Financial loss

→Loss of productivity due to business disruption

→Critical Data loss / breach

→Cost of investigation

→Reputational damage

→Compensation to customers

→Regulatory penalties

→Investment loss

→Costs of recovering from disruptions

Threat Actors, Cyber Threats & Risk Mitigation Strategies

Free

49.2.2

Who Are the Threat Actors? (3 Categories)

A threat actor is an individual or group that takes part in a malicious act intended to harm IT assets — computers, devices, systems, or networks.

Cybercriminals

Individuals or groups that cause a malicious cyber attack on the business. Includes:

•Criminals — after financial gain or information; disrupt business
•Clients — compromise information with malicious intent

Business Competitors

Your competitors in the same line of business who use cyber means to gain competitive advantage.

Current or Former Employees

Who accidentally or intentionally compromise your information or data — insider threats.

⚠️ MCQ answer — threat actors

In cyberspace, a threat actor can be: Cybercriminal, Business competitor, Present or former employee. Answer: (d) All of the above.

49.2.3

Various Cyber Threats to Banks

Banks and financial institutions process billions of transactions daily, making them the primary target of cybercriminals globally. Organisations must monitor user activity proactively, react to alerts in real-time, and remediate threats from both external hackers and malicious insiders.

1Identity Theft

2Data Breach / Theft

3Ransomware

4Phishing / Vishing / Smishing / Pharming

5Cyber Squatting / Bullying / Warfare

6DDoS — Distributed Denial of Service

7Malware (advanced persistent threats)

8Insider Fraud

9Web Fraud & Check Fraud

49.2.4

Cyber Risk Mitigation Strategies — 8 Essential Controls

Cyber risk mitigation divides into three categories: Prevention, Detection, and Remedy. Banks must adopt mitigation tactics that evolve to keep pace with evolving threat actor techniques.

#	Mitigation Strategy	Purpose
1	Application Whitelisting	Control the execution of unauthorised software
2	Patching Applications	Remediate known security vulnerabilities (in applications)
3	Configuring Microsoft Office Macro Settings	Block untrusted macros
4	Application Hardening	Protect against vulnerable functionality
5	Restricting Administrative Privileges	Limit powerful access to systems
6	Patching Operating Systems	Remediate known security vulnerabilities (in OS)
7	Multifactor Authentication (MFA)	Protect against risky activities and credential theft
8	Daily Backups	Maintain the availability of uninfected critical data

⚠️ MCQ trap — Patching OS vs patching apps

Both patching applications AND patching operating systems are done to "remediate known security vulnerabilities." Patching OS is option (a) — answer for "Patching operating systems is done to remediate against..." is (a) known security vulnerabilities, NOT "DDoS attacks" or "execution of unauthorized software."

Defence-in-Depth & Common Measures Adopted by Banks

49.2.5

Defense-in-Depth Strategy

Definition

Defence-in-Depth is a security strategy in which a succession of security procedures and controls are carefully placed throughout a computer network to safeguard the network and the information within it.

Key Characteristics

→No single mitigation can prevent ALL cyber dangers from occurring
→When multiple controls work together, they provide protection against a variety of threats
→Also provides redundancy if one method fails
→Prevents any SINGLE POINT OF FAILURE
→Significantly increases the time and complexity required to successfully compromise a network
→Requires more effort and resources from attackers

Defence-in-Depth Layers

1Physical security (facility access control)

2Network security (firewalls, IDS/IPS)

3Computer security (OS hardening, patching)

4Application security (app hardening, whitelisting)

5Data security (encryption, data masking)

6User security (MFA, privilege restriction, awareness training)

49.2.7

Common Measures Adopted by Banks Against Cyber Threats

Security of Bank's digital assets governed by: (1) RBI Security Framework for Baseline Guidelines — dt. 02.06.2016 and (2) Master Direction on Digital Payment Security Controls — dt. 18.02.2021.

NGF

Next-Generation Firewalls

IDS/IPS

Intrusion Detection / Prevention Systems

Anti-APT

Anti Advanced Persistent Threat

Anti-DDoS

Anti Distributed Denial of Service

Anti-Phishing

Anti-Phishing, Malware Monitoring

PIM

Privileged Identity Management

FIM

File Integrity Management

WAF

Web Application Filtering

Cyber Insurance

Insurance against cyber incident losses

SOC

Security Operations Centre to monitor threats

VAPT

Vulnerability / Penetration Testing

Staff Awareness

Involvement of Top Management + Staff/Customer Cyber Security Awareness

Best Practices

Adopting Best Practices and Frameworks (e.g. ISO 27001, NIST)

NBAD

Network Behaviour Anomaly Detection

SOC, Cyber SOC (C-SOC), SIEM, VAPT & NBAD

49.2.8

Security Operations Centre (SOC)

What is SOC?

A SOC consists of an information security team that is in charge of continuously monitoring and assessing an organisation's security posture. Typically headed by the Chief Information Security Officer (CISO).

SOC Team Purpose

→Detect, analyse, and respond to cybersecurity issues
→Uses a combination of technology solutions and a solid set of processes
→Personnel collaborate closely with incident response teams
→Ensure security vulnerabilities are addressed as soon as discovered

SOC Staffing

Security AnalystsSecurity EngineersSecurity ManagersForensics AnalystsCryptanalystsMalware Reverse Engineers

What SOC Monitors

Network activityServer activityEndpoint activityDatabase activityApplication activityWebsite activity

49.2.9

Cyber SOC (C-SOC) — As per RBI Guidelines

Banks must set up and operationalize a Cyber SOC (C-SOC) as per RBI guidelines.

C-SOC System Requirements (what must be in place)

Management Briefing

Top Management/Board Briefing on Threat Intelligence

Dashboards & Oversight

Dashboards and oversight systems for real-time security posture visibility

Policy & Enforcement

Policy, measurement and enforcement (key metrics, reporting structure)

Stakeholder Management

Informing stakeholders, stakeholder participation

Incident Investigation

Incident investigation, forensics and deep packet analysis

Root Cause Analysis

Methods to identify root cause of attacks, classify into categories, contain further attacks of similar types

Dynamic Behaviour Analysis

Preliminary static & dynamic analysis and collecting Indicators of Compromise (IOC)

Geo-location Analytics

Analytics with good dashboard showing geo-location of IPs

Counter Response

Counter response and Honeypot services

⚠️ MCQ answer — C-SOC aspects

Which is NOT part of C-SOC requirements? Answer: (a) Forensic investigation of financial frauds. The C-SOC covers: Dashboards and oversight, Policy/measurement/enforcement, Dynamic Behaviour Analysis (IOC), Counter response/Honeypots, Geo-location analytics — NOT standalone financial fraud forensics.

49.2.10

SIEM — Security Information and Event Management

SIEM = SIM + SEM

Combines Security Information Management (SIM) + Security Event Management (SEM). Analyses application and network hardware security alarms in real-time.

How SIEM Works

→Analyses events against rules and analytics engines
→Indexes events for search in milliseconds
→Uses information acquired from around the world
→Provides security teams with both insight into AND a record of events in IT environment

SIEM Capabilities

Data analysisEvent correlationEvent aggregationReportingLog managementCustom dashboardsAlert workflow managementIntegration with other productsConsolidation of multiple data points

⚠️ MCQ answer — tool for detecting/analysing/responding

Which is used for detecting, analysing, and responding to security threats? Answer: (c) SIEM. Not Firewall (blocks) or IDS (detects only).

49.2.11

VAPT — Vulnerability Assessment & Penetration Testing

VAPT aims at identifying vulnerabilities in the network, server, and system infrastructure. Both are security services with distinct but complementary goals.

Component	Focus
VA — Vulnerability Assessment	Internal organisational security — finds weaknesses inside the system
PT — Penetration Testing	External real-world threat — simulates an actual attack from outside

How Banks Conduct VAPT

→Conducted periodically through approved third-party vendors
→Observations classified into: High, Medium, and Low risks
→Mandatory to mitigate vulnerabilities and report to top management

⚠️ MCQ answer — VAPT objective

VAPT identifies vulnerabilities in: (a) network, (b) server, (c) system infrastructure. Answer: (d) All of the above.

49.2.12

NBAD — Network Behaviour Anomaly Detection

How NBAD Works

→NIDS (Network Intrusion Detection Systems): monitors packets on the network and looks for patterns matching a database of signatures of known security threats
→NBAD is particularly helpful where signature-based systems CANNOT detect:
→(i) New ZERO-DAY attacks (signatures don't exist yet)
→(ii) When threat traffic is ENCRYPTED — e.g. command and control channel for certain Botnets
→Tracks critical network characteristics in real-time
→Generates an alarm if a strange event or trend is detected

Network Characteristics NBAD Monitors

Traffic volumeBandwidth usageProtocol useIndividual network subscriber behaviour

Baseline & Anomaly Detection

For NBAD to be optimally effective: a baseline of normal network/user behaviour must be established over a period of time. Any departure from defined normal parameters is flagged as anomalous.

4 Application Domains of NBAD

→(i) Log analysis

→(ii) Packet inspection systems

→(iii) Flow monitoring systems

→(iv) Route analytics

Phases of an Effective Cyber Incident Response (CIR) Plan

49.3

6-Phase Cyber Incident Response Plan

As cyber-attacks take a toll on business operations and reputation, banks must develop a robust Cyber Incident Response (CIR) plan to stay ahead of the cybersecurity curve. Banks need both proactive and responsive capabilities that can rapidly adapt to cyber incidents.

Proactive Capabilities

Preparation

Develop the CIR plan before an incident occurs. Establish team roles, communication protocols, tools, and training. Create and maintain an asset inventory. Define escalation procedures.

Detection & Analysis

Identify and confirm that a security incident has occurred. Use SIEM, NBAD, and SOC tools to detect anomalies. Analyse indicators of compromise (IOC). Determine scope and severity of the incident.

Responsive Capabilities

Containment

Limit the spread and impact of the incident. Isolate affected systems. Implement short-term and long-term containment strategies. Preserve evidence for forensic investigation.

Eradication

Identify and eliminate the root cause of the incident. Remove malware, close exploited vulnerabilities, patch systems. Ensure all affected systems are clean before restoration.

Recovery

Restore affected systems and services to normal operations. Validate that systems are fully clean and functional. Monitor closely for any signs of residual issues. Communicate recovery status to stakeholders.

Post-Incident Activity (Lessons Learned)

Conduct a thorough review of the incident. Identify what worked and what didn't. Update the CIR plan. Report to RBI and senior management as required. Improve defences based on findings.

Phase Type	Phases Included	When
Proactive Capabilities	Preparation + Detection & Analysis	Before / as incident begins
Responsive Capabilities	Containment + Eradication + Recovery	After incident is identified

Chapter 49 — MCQ Quick Reference

Patching operating systems is done to remediate against...

✓ (a) Known security vulnerabilities

NOT DDoS attacks or execution of unauthorized software

In cyberspace, a threat actor can be...

✓ (d) All of the above

Cybercriminal, Business competitors, Present or former employee — all three

Which tool is used for detecting, analysing, and responding to security threats?

✓ (c) SIEM

SIEM combines SIM+SEM for real-time analysis. NOT Firewall or IDS alone.

Which is NOT among C-SOC requirements?

✓ (a) Forensic investigation of financial frauds

C-SOC covers: dashboards, policy/enforcement, Dynamic Behaviour Analysis, counter response — not standalone financial fraud forensics

VAPT objective is to identify vulnerabilities in the...

✓ (d) All of the above

Network, Server, AND System infrastructure — all three are correct

← Chapter 48: Security Considerations and Mitigation Measures|PPB Overview|JAIIB Exam Hub

Free — no credit card needed

Unlock the complete JAIIB PPB chapter notes

✓ All 32 PPB chapters — complete notes for every syllabus topic
✓ Mnemonics, amber exam traps, and case law summaries
✓ 25+ revision flashcards per chapter for last-minute prep
✓ Mock tests for key chapters — practice in real exam format

Create free account →Sign in

Discussion

No comments yet. Be the first to share your thoughts.