Security Considerations and Mitigation Measures in Banks
Principles & Practices of Banking | Module C · Chapter 48
Covers the full security landscape in computerised banking — risk areas, threat taxonomy, control mechanisms, audit approaches (around/through/with computer), IS audit, IS security (CIA framework), cyber fraud modus operandi (phishing, vishing, BEC, SIM swapping), disaster recovery (RTO/RPO), the IT Act 2000, digital signatures, the G. Gopalakrishna Committee's 9-chapter report, and the Integrated Ombudsman Scheme 2021.
📌 Why This Chapter Matters in JAIIB
Expect 5–7 questions from this chapter. Key exam focus areas: Risk areas (Data/Software, Infrastructure, Peopleware — three components of a computerised environment); Threat types (Accidental: environmental hazards, human errors, unreliable systems; Malicious: interruption of services, frauds); Control types (Preventive eliminates errors from reoccurring; Detective identifies errors after they occur; Corrective removes effects of errors); Audit approaches (Around the Computer: examines I/O without touching software; Through the Computer: uses computers to test logic; With the Computer: uses CAATT software); IS Audit 4 control types (Deterrent, Preventive, Detective, Corrective); IS Security CIA (Confidentiality, Availability, Integrity); Threats (Phishing, Vishing, Smishing, Ransomware, DDoS/Botnet, Malware, Spear Phishing, Whaling, BEC, SIM Swapping); Disaster Recovery (RPO = point in past to which you recover; RTO = point in future when you are back up — for banks RPO ideally = zero); Gopalakrishna Committee (9 chapters: IT Governance, Information Security, IT Operations, Outsourcing, IS Audit, Cyber Fraud, BCP, Customer Education, Legal Issues); Ombudsman Scheme 2021 (integrates 3 prior schemes; no limit on dispute amount; appeal within 30 days).
Key Facts & References — Chapter 48 at a Glance
Introduction & Risk Concern Areas
FreeIntroduction
Banking operations are prone to various risks and online frauds. The deployment of IT has changed the scale of risks, but not their nature. Securing technology and protecting customer data is one of the highest priorities for any financial institution. The unprecedented growth in digital payments and the push towards a cashless economy has intensified focus on financial cybersecurity.
| Risks in a Computerised Environment Broadly Lead To | |
|---|---|
| 1 | Incorrect decision making → setback to the business |
| 2 | Interruption in activities due to loss of data, hardware, software, peopleware |
| 3 | Violation of privacy |
| 4 | Direct financial loss due to computer frauds |
Risk Concern Areas — 3 Components of a Computerised Environment
A typical computerised environment has three interdependent but separate components: Data, Software, and Hardware. Risks are not specific to banking — they exist in all business activities.
48.2.1 Data & Software
- •Data is critical for continuing operations — incorrect data leads to wrong decisions
- •Lack of control over data enables fraud by unscrupulous elements
- •Confidential data falling into wrong hands damages customer relations and bank reputation
- •Unauthorised changes to application software directly lead to fraud
- •Utility software on operational systems can bypass validation controls
- •Errors due to software modifications are difficult to detect
48.2.2 Infrastructure
- •Hardware: CPUs, controllers, modems, switches/multiplexers, routers
- •Environment: Precision ACs, fire extinguishers, smoke detectors
- •Power supply: UPS, CVT (constant voltage stabilisers), generators
- •Equipment not regularly maintained → malfunctioning → service interruption or asset/data loss
48.2.3 Peopleware
Refers to the role played by persons directly or indirectly involved in managing computerised systems.
- •(a) Stagnation in knowledge and skill levels → affects efficiency of newer systems
- •(b) High turnover due to attrition → difficult to get suitable replacements
- •Impact felt most for technical staff handling highly specialised functions
- •Impact comes from both internal staff and software house personnel
Types of Threats & Control Mechanism
FreeDifferent Types of Threats
48.3.1 Accidental Damages
Environmental Hazards
Fire, floods, unstabilised power supply, natural calamities — systems not properly tested also lead to higher failure rates.
Human Errors and Omissions
Errors occur at time of: (a) systems design/process development, (b) data entry at terminal, (c) programme maintenance and corrections.
Primary cause: Human failure. Secondary cause: Machine failure.
Unreliable Systems
In multi-programming/multi-user environments, systems are prone to errors and intentional frauds. Customisation of standard packages often introduces new errors.
48.3.2 Malicious Damages
Interruption in Services
From disgruntled employees or individuals with mala fide intentions. Branches/delivery channels are networked — any damage can bring system down partially or completely. Banks must build redundancy (24×7 for critical infrastructure).
Frauds — Common Methods
- →Utility programmes used to make unauthorised changes bypassing validation controls
- →Unauthorised amendments to payment instructions before entry into system
- →Unauthorised manipulation of important files bypassing security controls
- →Unauthorised programme changes causing automatic fraudulent transactions
- →In networked systems: intercepting data in transit
Control Mechanism — 4 Types
48.4.1 Physical Controls
- →Control over access to assets — only authorised persons enter computer room
- →Software techniques protect against unlimited access attempts
- →Access log maintained; passwords, PIN, or biometric fingerprint verification
- →Routine checks: smoke detectors, fire extinguishers must be effective and operational
- →Control over outputs: hard copies preserved; access only to authorised persons
- →Source code of running system not available on system to avoid tampering
48.4.2 Logical Controls
- →Operating system controls access at directory and file level
- →Database controls access at record and field level
- →Two types: Authentication (only authorised users access) + Authorisation (just-minimum access to files/directories)
- →System Administration manages both authentication and authorisation in operating systems
- →Provide interface between application controls and general IS controls
48.4.3 Internal Controls
- →Check accuracy and reliability of accounting data, ensure operational efficiency, safeguard assets
- →Two types: Application controls (dual controls, validation checks, numerical sequencing) + Administrative controls (defined responsibilities, formal policies/procedures)
- →For customer accounting: validations on stop payments, post-dated/stale cheques, invalid dates
- →Verification of sensitive parameters: due dates, drawing limits, rates, stop instructions
48.4.4 Operational Controls
- →Embedded in software to ensure data integrity, consistency, and processing
- →Example: verification of checksum and database integrity as part of day-begin functions
- →Audit trail types: Accounting audit trail (data updates) + Operations audit trail (resource consumption)
- →Both successful and unsuccessful transactions logged with terminal no., user-id, transaction details, timestamp
Checksum
Number calculated on key data items of a file to ensure integrity. In branch banking, checksum from closing of previous day is tallied with day-begin of next day. Involves: account number, balances, account holder names.
Data Encryption
Systematically converts data to ciphertext (non-readable form). In EFT systems, MAC (Message Authentication Code) is a secret key applied to selected data items to verify message integrity in transit. MAC is recalculated by receiver — if different, message was altered.
Data Masking
Hides personal data (credit card numbers, SSN, names, addresses, phone numbers) to prevent breaches. Used in test/development environments created from production data. Helps meet PCI DSS and other compliance requirements.
Computer Audit & Information System (IS) Audit
Computer Audit
Computer Audit is the generic organisational function for evaluation of asset safeguarding, data integrity, system effectiveness, and system efficiency in computerised systems.
48.5.1 Scope of Computer Audit (3 areas)
1. Compliance Review
Review of operations to establish compliance with established policies, standards, and procedures.
2. Quality Review
Review of quality of formal policies, standards, procedures; efficiency of operations; adequacy of controls.
3. Integrity Review
Focused on fraud detection/prevention, application programme and OS integrity, system design, and monitoring of employee activities.
48.5.2 Three Audit Approaches
| Approach | What is examined | When to use | Limitation |
|---|---|---|---|
| Audit AROUND the Computer | Examines input & output; infers about processing; does NOT directly examine application software | Simple systems with well-tested software, proper physical controls, segregation of duties, clear audit trail | Not suitable for complex, high-volume systems; cannot anticipate future software deficiencies |
| Audit THROUGH the Computer | Uses computers to test logic and controls in the system AND records produced by the system — requires technical competence | Complex systems handling large data volumes; audit trail has gaps due to cost considerations | Requires technical expertise; more resource-intensive |
| Audit WITH the Computer (CAATT) | Uses CAATT (Computer-Aided Audit Tools and Techniques) software — efficient and effective way to audit computer-generated files/records/documents | Evaluating internal controls over processing in a computerised environment | Depends on availability and capability of audit software tools |
⚠️ MCQ answer — CAATT approach
IS audit for the software used carried out by CAATT is the Audit WITH the Computer (option c). Audit AROUND = examines I/O only. Audit THROUGH = tests logic directly using computers.
Information System (IS) Audit
Objective of IS Audit
Process of collecting and evaluating evidence to determine whether a computer system can: (1) safeguard its assets with adequate security & control measures, (2) maintain data integrity, (3) achieve organisational goals effectively, and (4) use resources efficiently.
Key: IS Audit is carried out through
CAATT — Computer Aided Audit Tools and Techniques
Readily available user-friendly software with features for IS audit. Core Banking made audit less cumbersome — most auditing can now be done centrally.
4 Types of Controls in IS Audit (48.6.4)
a. Deterrent
Designed to discourage people from undesirable activities. Examples: written policies with punitive measures, warning banners.
b. Preventive
Designed to avoid errors, omissions, or security incidents from occurring. Examples: user access controls, input validation.
c. Detective
Designed to identify and characterise security incidents after they occur. Examples: smoke detectors, honeypots, Intrusion Detection Systems (IDS). IS auditing itself is a detective control.
d. Corrective
Designed for recovery from a loss situation. Examples: Business Continuity Planning (BCP), patching a system, quarantining a virus, terminating a process, rebooting.
Benefits of IS Audit (48.6.5)
IS Security, Cyber Threats & Fraud Modus Operandi
Information System (IS) Security
IS Security Policy — 3 Objectives (CIA)
Confidentiality
Disclosure of information stored or processed on bank's information systems should be made available to authorised users only.
Integrity
Modification to information should happen by an authorised user and in an authorised manner.
Availability
Information is available to authorised persons when required.
Controls Required for IS Security (48.7.4)
Identification
Means by which a user provides a claimed identity to the system.
Authentication — 3 means
(1) Something the user KNOWS: password, PIN, cryptographic key; (2) Something the user POSSESSES: ATM card, smart card; (3) Something the user IS: biometrics (fingerprint, iris/retinal scan, palm vein, facial recognition, voice pattern).
Authorisation
Function of specifying access rights to resources.
Non-repudiation
Ability to prove an operation/event took place so it cannot be denied — sender cannot deny sending; receiver cannot deny receiving.
Access Control
Limits access to system or physical/virtual resources. Users must present credentials before access is granted.
IS Security in Banking — 8 Cyber Threats (48.7.6)
Malicious software loaded onto computers without user knowledge; attaches to host programmes; can steal credentials, destroy data. Spreads via network, disk, or infected e-mail attachments.
Large numbers of compromised systems (Botnet) attack a single target → forces target to shut down → legitimate users denied service.
Malicious crypto-virology software that threatens to publish victim's data or block access to it unless a ransom is paid.
Maliciously crafted software code. Special programmes enable intruders to fool individuals into believing traditional security is protecting them during online transactions.
Fraudulent attempt to obtain sensitive information (usernames, passwords, card details) by disguising as a trustworthy entity in electronic communication.
Phishing directed at specific individuals or companies — attackers gather and use personal information about target to increase probability of success.
Spear phishing directed specifically at senior executives and other high-profile targets (e.g. subpoena, customer complaint content).
Illegal access of data via VoIP (Voice over Internet Protocol) — voice messages to steal identities and financial resources. Combination of 'voice' + 'phishing'.
Modus Operandi of Online Frauds & Cyber Security Awareness
48.8.2 Steps in a Cyber-Attack Modus Operandi
Reconnaissance & Compromise
Research target — IP addresses, domain names, email addresses; use phishing emails; may wait months.
Obtain Credentials
Use tools to steal credentials; gain administrator-level access to penetrate deeper into the network.
Send Fraudulent Messages
Implant malware into vital systems; submit fraudulent payment instructions using fake operator or approver.
Hide / Cover Up Evidence
Destroy proof of operations — tools and strategies to remove/change records and corrupt systems to confound forensic investigators.
48.8.3 Common Modus Operandi of Cyberattacks (9 Types)
Hidden devices or cameras at ATMs capture card data and PIN to create a duplicate card and withdraw cash.
Spoofed emails, phone calls pretending to be bank/telecom, or SMS with URLs — all lure customers into sharing confidential details under pretexts like KYC update or account unblocking.
Email or call claiming victim won a large lottery prize; asks for advance taxes/processing fees; victim falls for relatively small 'processing' amount.
Fraudsters trick victims into downloading unverified apps that allow access to mobile device, laptop, or desktop; distributed via SMS, social media, instant messaging.
Criminal obtains access to legitimate account through deception; impersonates cardholder to request replacement card by falsely reporting theft or loss.
Fraudsters act as buyers/sellers; send Money Requests via UPI app; instruct victim to enter MPIN to 'receive money' — money is instead transferred to fraudster.
CNP (Card-Not-Present): uses card details without physical card (e-commerce). CP (Card-Present): card data stolen at ATMs/POS devices.
Fraudster contacts cell operator under false pretence (lost phone, robbery) → existing SIM deactivated → new SIM issued to fraudster → OTP intercepted for banking transactions.
Impersonates someone in a business network to trick targets into transferring money to attacker's account. Techniques: email spoofing, spear-phishing, malware for internal email access. Most prevalent victims: companies making cross-border payments.
Safe Online Banking Tips (for customers)
IT Resources, Disaster Recovery, IT Act 2000, Gopalakrishna Committee & Ombudsman Scheme 2021
IT Resources Evaluation Requirements
Computer Hardware
Obsolescence is a major problem. High acquisition/replacement costs. Banks need proper hardware purchase policies — balance between technology and cost. Loss of service → goodwill/reputation loss.
Computer Software
System software (OS, compilers, utilities) and application software both require evaluation. Frequent changes cause patching and make systems complex. Shift from TBA to CBS is an example of such changes.
Data
Most critical asset of a bank. Accidental loss < loss due to irregularities. Data stolen by competitor is more serious than accidental destruction. Magnetic media changes are not easily detected — proper archival policies needed.
Communication Channels
Backbone of electronic banking. Geographically spread banking depends on communication links. Requires well-defined technological competence and policies for absorption of new communication technologies.
Disaster Recovery Management
Disaster — Definition
Any event that results in direct denial or stoppage of essential business functions for a considerable period of time. Short interruptions not resulting in denial of service are classified as disruptions, not disasters.
4 Phases of Disaster Recovery Planning
1. Awareness
Identify critical activities, systems, and processes. Front-end operations = critical; back-end = second priority. Identify resources needed at short notice.
2. Financial & Legal Issues
Maintain inventory of all assets; insure against loss. Only licensed software to be used. All licensed media (CD, floppy) recorded and stored.
3. Preparation
(i) Core and support teams of skilled personnel. (ii) Daily data backup at a different location. (iii) Alternate recovery sites / disaster recovery sites. (iv) Documentation and SLAs with service providers.
4. Testing
BCP must be regularly tested to ensure it is up-to-date and effective.
📌 MCQ: Phases do NOT include
The 4 phases are: Awareness, Financial & Legal Issues, Preparation, Testing. "Recovery" is the action phase AFTER a disaster is declared — it is the outcome, not a planning phase. "Increased Manpower" is NOT a phase.
RTO vs RPO — Critical Objectives
| Term | Definition |
|---|---|
| RPO — Recovery Point Objective | Point in the PAST to which you will recover. The gap between disaster and RPO = data lost. For banks, RPO should ideally be ZERO. |
| RTO — Recovery Time Objective | Point in the FUTURE at which the bank will be up and running again. The gap between disaster and RTO = timeframe services are down. |
Business Impact Analysis (BIA)
Must be carried out by functional units before devising any disaster recovery plan. Identifies critical areas and systems. Calculates lead time between complaint and vendor response. Compares with past occurrences and determines RTO and RPO.
Legal Framework — IT Act 2000 & Digital Signature
IT Act 2000
- →Based on UNCITRAL Model Law on Electronic Commerce (1996) — India is a signatory
- →Indian Parliament enacted Information Technology Bill — received President's assent 9 June 2000
- →Provides legal recognition for transactions carried out via electronic communication
- →Validates use of EDI, Electronic Records, and Electronic Signatures
- →Chapter XI identifies IT offences (hacking, tampering source code, publishing obscene material)
- →Consequential amendments made to: Indian Evidence Act 1872, Indian Penal Code 1860, Banker's Books Evidence Act 1891, RBI Act 1934
- →RBI Act 1934 amended to empower central board to make regulations for electronic fund transfers between banks
- →Amended again in 2008
Digital Signature (48.11.1)
A digital signature is NOT a digital image of a handwritten signature. It is a key applied cryptographically. It must satisfy: Authenticity (verify source), Integrity (message received intact, not altered), Non-repudiation (cannot deny sending/receiving).
Public Key
Used by recipient/relying party to VERIFY the digital signature. Distributed openly.
Private Key
Kept confidential by signer. Used to CREATE the digital signature (transform data into unintelligible form).
Hash / Message Digest
Sender first creates a hash (message digest) using a hashing algorithm — this is what is actually signed. Unique to each message — any change to message changes the digital signature.
G. Gopalakrishna Committee Report — 9 Chapters
Set up: April 2010 under RBI ED Shri G. Gopalakrishna. Final Report released: 29 April 2011.Title: "Working Group on Information Security, Electronic Banking, Technology Risk Management and Cyber Frauds". Banks are required to adhere to the Committee's recommendations.
Ch 1: IT Governance
- →Board + Executive Management responsible for effective IT Governance
- →CIO ensures IT strategy implementation; CISO reports to Head of Risk Management (NOT CIO)
- →Annual review of IT strategy and policies
- →Enterprise architecture framework for applications/decisions
- →Data classification scheme (public, confidential, top secret)
Ch 2: Information Security
- →Board ultimately responsible for information security
- →Board-approved Information Security policy — reviewed at least annually
- →CISO: rank of GM/DGM/AGM — not under CIO
- →CISO must directly report to Head of Risk Management
- →Banks should implement ISO 27001-based ISMS
- →Penetration testing, audits, and vulnerability assessments periodically
Ch 3: IT Operations
- →IT Operations must support processing/storage so information is available in a timely, reliable, secure, resilient manner
- →Covers: IT Service Management, Infrastructure Management, Application Lifecycle Management, IT Operations Risk Framework
- →Evaluate service capabilities and risk profile before releasing new/changed service into production
Ch 4: IT Services Outsourcing
- →Activities that CANNOT be outsourced: Internal Audit, Compliance, KYC compliance, loan sanctioning, managing investment portfolio
- →Banks remain accountable for all outsourcing decisions
- →Service providers must meet minimum security baselines
- →Periodic independent audits of service providers
- →Outsourcing outside India must allow regulatory audits/inspections
- →Customer grievance time limit: 30 days
Ch 5: IS Audit
- →Board/Audit Committee must provide internal audit function capable of evaluating IT controls
- →IS Audit = integral part of Internal Audit function
- →Audit Charter/Policy governs IS Audit — approved by Board — annual review
- →Banks carry out IS Audit planning using Risk-Based Audit Approach
Ch 6: Cyber Fraud
- →All frauds above ₹1 crore reported to Audit Committee of Board
- →Special committee for frauds ≥ ₹1 crore
- →Fraud vulnerability assessments for business functions and delivery channels
- →Root cause analysis for actual frauds above ₹10 lakhs
- →Transaction monitoring group within fraud risk management group
- →Fraud reports to RBI for frauds ≥ ₹1 lakh (as per RBI circular July 1, 2010)
Ch 7: Business Continuity Planning (BCP)
- →Senior official designated as Head of BCP in each department
- →BCP must be regularly tested — including people, processes, and technology
- →Annual reviews and updates; changes follow formal change management process
- →Unplanned BCP drills; Internal Auditors (including IS Auditors) to audit effectiveness
- →Backup sites for critical payment systems interacting with RBI Data Centres
Ch 8: Customer Education
- →Board/Senior Management must commit adequate resources to consumer education
- →Systematic process: planning/design → execution/management → evaluation/course correction
- →Awareness programs customised for specific audiences (customers, employees, law enforcement, media)
- →Research group to continually update communications team on latest fraud trends
Ch 9: Legal Issues
- →Banks must consider impact of IT Act 2000 (amended 2008) to mitigate cyber legal risks
- →Legal function advises business groups on IT-related legal risks
- →Banks must keep abreast of IT Act 2000 rules/regulations/notifications
- →Two important subsequent directions: (1) RBI Cyber Security Framework in Banks — Feb 2016; (2) Master Direction on Digital Payment Security Controls — Feb 2021
Cyber Security Framework in Banks
RBI has advised all banks to put in place a Board-approved Cyber Security Policy distinct from the broader IT/IS Security policy. Key aspects:
- →1. Cyber Security Policy distinct from IT policy/IS Security Policy — specific to cyber threats
- →2. Continuous surveillance — SOC (Security Operations Centre) must be set up and kept updated on emerging threats
- →3. IT architecture conducive to security — security measures in place at all times
- →4. Network and database security — unauthorised access not allowed; well-defined processes where permitted
- →5. Protection of customer information — confidentiality of custodial information not compromised
- →8. Share information on cyber-security incidents with RBI — all unusual incidents (successful or attempted) must be reported
- →9. Supervisory Reporting framework — immediate assessment of gaps in preparedness reported to RBI
- →10. Organisational arrangements — cyber-security awareness among stakeholders/Top Management/Board
Integrated Ombudsman Scheme, 2021 — RBI
Integrates 3 Prior Schemes
- • Banking Ombudsman Scheme, 2006
- • Ombudsman Scheme for NBFCs, 2018
- • Ombudsman Scheme for Digital Transactions, 2019
Who it covers
- •All Commercial Banks, RRBs, Scheduled/Non-Scheduled Primary (Urban) Co-operative Banks with deposits ≥ ₹50 crore
- •All NBFCs (other than Housing Finance Companies) authorised to accept deposits OR with customer interface with assets ≥ ₹100 crore
- •All System Participants
Key Provisions
- →Complaints filed online on CMS portal (https://cms.rbi.org.in)
- →No limit on amount of dispute that can be filed before the Ombudsman
- →Regulated Entity must file written version within 15 days of receiving complaint
- →Ombudsman may award compensation up to ₹1 lakh for complainant's lost time, expenses, harassment, mental anguish
- →Regulated Entity: 30 days compliance after receiving complainant's letter of acceptance
- →Appeal before Appellate Authority within 30 days of Award/closure — by Chairman/MD/CEO/ED only (for RE)
- →Appellate Authority: Executive Director-in-Charge of the Department of RBI administering the scheme
Discussion
No comments yet. Be the first to share your thoughts.