Recently, the Reserve Bank of India (RBI) has imposed a hefty penalty of around 65 lakhs, roughly USD 80,000, on one of the Co-Operative banks from a southern state of India due to non-compliance with the RBI guidelines on Information Security. <\/p>\n\n\n\n
A dedicated cyber team from the RBI investigated the matter and made a thorough audit of a data breach incident that happened one and a half years ago in an organization where hackers siphoned off 12.48 crore, roughly 1.5 million USD through phishing emails. These emails were sent to bank employees and upon clicking on the malicious emails, the employees unknowingly gave full access of the sensitive bank network to the cyber criminals. <\/p>\n\n\n\n
The Vulnerable IT network in the banking sector <\/strong><\/p>\n\n\n\n A special report, released by CNBC TV18 group a quarter back this year, says that there has been a 50% increase in data leaks and data breach incidents in the banking and financial sector. Earlier in 2022, Deloitte India\u2019s banking survey also revealed 40% rise in cyber incidents in the banking industry.<\/p>\n\n\n\n The banking sector is a treasure trove of data and confidential information. Not surprisingly, the IT periphery of banks is always vulnerable to highly organized cyber-attacks. In addition, the banking sector is always exposed to compromised insiders and third-party IT users. <\/p>\n\n\n\n And such attacks are possible due to three reasons: <\/p>\n\n\n\n 1. The workforce is not adequately trained regarding dos and don\u2019ts to preserve the sanctity of data<\/p>\n\n\n\n 2. The information security framework is not up to the mark <\/p>\n\n\n\n 3. Banks fail to stringently comply with the RBI Guidelines on Information Security <\/p>\n\n\n\n Indeed, in this regard (compliance), the RBI has laid down a set of guidelines<\/a> that succinctly explains what needs to be done, especially in the areas of Identity and Access Management.\u00a0<\/p>\n\n\n\n The RBI Guidelines on Access Control<\/strong><\/p>\n\n\n\n For instance, in the RBI circular, \u201cCyber Security Framework in Banks\u201d (2016), it is mentioned in Annex I, point no. 8.1 that – \u201c(banking organizations) Provide secure access to the bank\u2019s assets\/services from within\/ outside bank\u2019s network by protecting data\/ information…<\/em>\u201d<\/p>\n\n\n\n Annex I, point no. 8.3 states that – \u201cDisallow administrative rights on end-user workstations\/ PCs\/ laptops and provide access rights on a need-to-know basis and for specific duration when it is required following an established process.<\/em>\u201d<\/p>\n\n\n\n Annex I, point no. 8.4 states that – \u201cImplement centralized authentication and authorization system or accessing and administering applications, operating systems, database<\/em>s, network and security devices\/ systems, point of connectivity (local\/remote, etc.) including enforcement of strong password policy, two-factor\/multi-factor authentication depending on risk assessment and following the principle of least privileges and<\/em> separation of duties<\/em>.\u201d <\/p>\n\n\n\n Annex I, point 8.6 says, \u201cImplement controls to minimize invalid logon counts, deactivate dormant accounts.\u201d<\/em><\/p>\n\n\n\n And, <\/em>Annex 1, point 8.7 says, \u201cMonitor any abnormal change <\/em>in pattern <\/em>of logon<\/em>.\u201d <\/p>\n\n\n\n Building a robust IAM structure to comply with the RBI Guidelines <\/strong><\/p>\n\n\n\n What these guidelines suggest is that every banking organization storing and processing all sorts of data across disparate technologies must have a unified approach to control, monitor and manage users\u2019 access to sensitive information and classified information. <\/p>\n\n\n\n In this regard, ARCON\u2019s unified Identity and Access Management platform (Converged Identity)<\/a> which includes privileged access management, is at the core of building a robust IAM structure, meeting the RBI guidelines and enforcing security. <\/p>\n\n\n\n By implementing this solution, a banking organization can ensure a centralized engine to manage the lifecycle of an identity (joiner\/mover\/leaver) right from onboarding, discovering and governing \u2013provisioning and deprovision all the digital identities across the IT set up. In addition, the security teams can apply adequate safeguards like granular controls, just-in-time privileges to establish the least privilege principle and grant access based on \u201cneed to know\u201d and \u201cneed to do\u201d basis. Furthermore, the solution offers best-in-class password vaulting technology to vault and randomize the passwords along with robust multi-factor authentication mechanism. <\/p>\n\n\n\n The Bottom-line<\/strong><\/p>\n\n\n\n The banking industry is prone to threats like data breach and unauthorized access control because any financial data is vulnerable. Implementing unified IAM approach is necessary to effectively manage identity governance, access control along with creating a unified architecture and strategy to control people as well as processes and protect banks\u2019 data, applications, and privileged systems, notwithstanding the hosted models.<\/p>\n","protected":false},"excerpt":{"rendered":" Recently, the Reserve Bank of India (RBI) has imposed a hefty penalty of around 65 lakhs, roughly USD 80,000, on one of the Co-Operative banks from a southern state of India due to non-compliance with the RBI guidelines on Information Security. A dedicated cyber team from the RBI investigated the matter and made a thorough […]<\/p>\n","protected":false},"author":40,"featured_media":47301,"parent":0,"menu_order":0,"template":"","meta":{"_acf_changed":false,"footnotes":""},"risk-categories":[],"class_list":["post-46931","risk-to-watch","type-risk-to-watch","status-publish","has-post-thumbnail","hentry"],"acf":{"blog_inner_page_contents":[{"acf_fc_layout":"hero_section","image":47301,"news_logo":"","publish_date":"","reading_time":"","heading":"","para":"","cta_text":"","cta_url":"","is_featured_post":false},{"acf_fc_layout":"page_contents","social_media_items":null,"sidebar_item_desktop":[{"id":"The Vulnerable IT network in the banking sector\u00a0","item_name":"The Vulnerable IT network in the banking sector\u00a0"},{"id":"The RBI Guidelines on Access Control","item_name":"The RBI Guidelines on Access Control"},{"id":"Building a robust IAM structure to comply with the RBI Guidelines\u00a0","item_name":"Building a robust IAM structure to comply with the RBI Guidelines\u00a0"},{"id":"The Bottom-line","item_name":"The Bottom-line"}],"contents":[{"id":"","title":"","content":"Recently, the Reserve Bank of India (RBI) has imposed a hefty penalty of around 65 lakhs, roughly USD 80,000, on one of the Co-Operative banks from a southern state of India due to non-compliance with the RBI guidelines on Information Security.\r\n\r\nA dedicated cyber team from the RBI investigated the matter and made a thorough audit of a data breach incident that happened one and a half years ago in an organization where hackers siphoned off 12.48 crore, roughly 1.5 million USD through phishing emails. These emails were sent to bank employees and upon clicking on the malicious emails, the employees unknowingly gave full access of the sensitive bank network to the cyber criminals."},{"id":"The Vulnerable IT network in the banking sector\u00a0","title":"The Vulnerable IT network in the banking sector\u00a0","content":"\r\n\r\nA special report, released by CNBC TV18 group a quarter back this year, says that there has been a 50% increase in data leaks and data breach incidents in the banking and financial sector. Earlier in 2022, Deloitte India\u2019s banking survey also revealed 40% rise in cyber incidents in the banking industry.\r\n\r\n \r\n\r\nThe banking sector is a treasure trove of data and confidential information. Not surprisingly, the IT periphery of banks is always vulnerable to highly organized cyber-attacks. In addition, the banking sector is always exposed to compromised insiders and third-party IT users.\r\n\r\n \r\n\r\nAnd such attacks are possible due to three reasons:\r\n\r\n \r\n\r\n1. The workforce is not adequately trained regarding dos and don\u2019ts to preserve the sanctity of data\r\n\r\n \r\n\r\n2. The information security framework is not up to the mark\r\n\r\n \r\n\r\n3. Banks fail to stringently comply with the RBI Guidelines on Information Security\r\n\r\n \r\n\r\nIndeed, in this regard (compliance), the RBI has laid down a set of guidelines<\/a> that succinctly explains what needs to be done, especially in the areas of Identity and Access Management.\r\n\r\n"},{"id":"The RBI Guidelines on Access Control","title":"The RBI Guidelines on Access Control","content":"\r\n\r\nFor instance, in the RBI circular, \u201cCyber Security Framework in Banks\u201d (2016), it is mentioned in Annex I, point no. 8.1 that - \u201c(banking organizations) Provide secure access to the bank\u2019s assets\/services from within\/ outside bank\u2019s network by protecting data\/ information...<\/em>\u201d\r\n\r\n \r\n\r\nAnnex I, point no. 8.3 states that - \u201cDisallow administrative rights on end-user workstations\/ PCs\/ laptops and provide access rights on a need-to-know basis and for specific duration when it is required following an established process.<\/em>\u201d\r\n\r\n \r\n\r\nAnnex I, point no. 8.4 states that - \u201cImplement centralized authentication and authorization system or accessing and administering applications, operating systems, database<\/em>s, network and security devices\/ systems, point of connectivity (local\/remote, etc.) including enforcement of strong password policy, two-factor\/multi-factor authentication depending on risk assessment and following the principle of least privileges and<\/em> separation of duties<\/em>.\u201d\r\n\r\n \r\n\r\nAnnex I, point 8.6 says, \u201cImplement controls to minimize invalid logon counts, deactivate dormant accounts.\u201d<\/em>\r\n\r\n \r\n\r\nAnd, <\/em>Annex 1, point 8.7 says, \u201cMonitor any abnormal change <\/em>in pattern <\/em>of logon<\/em>.\u201d\r\n\r\n"},{"id":"Building a robust IAM structure to comply with the RBI Guidelines\u00a0","title":"Building a robust IAM structure to comply with the RBI Guidelines\u00a0","content":"\r\n\r\nWhat these guidelines suggest is that every banking organization storing and processing all sorts of data across disparate technologies must have a unified approach to control, monitor and manage users\u2019 access to sensitive information and classified information.\r\n\r\n \r\n\r\nIn this regard, ARCON\u2019s unified Identity and Access Management platform (Converged Identity)<\/a> which includes privileged access management, is at the core of building a robust IAM structure, meeting the RBI guidelines and enforcing security.\r\n\r\n \r\n\r\nBy implementing this solution, a banking organization can ensure a centralized engine to manage the lifecycle of an identity (joiner\/mover\/leaver) right from onboarding, discovering and governing \u2013provisioning and deprovision all the digital identities across the IT set up. In addition, the security teams can apply adequate safeguards like granular controls, just-in-time privileges to establish the least privilege principle and grant access based on \u201cneed to know\u201d and \u201cneed to do\u201d basis. Furthermore, the solution offers best-in-class password vaulting technology to vault and randomize the passwords along with robust multi-factor authentication mechanism.\r\n\r\n"},{"id":"The Bottom-line","title":"The Bottom-line","content":"\r\n\r\nThe banking industry is prone to threats like data breach and unauthorized access control because any financial data is vulnerable. Implementing unified IAM approach is necessary to effectively manage identity governance, access control along with creating a unified architecture and strategy to control people as well as processes and protect banks\u2019 data, applications, and privileged systems, notwithstanding the hosted models.\r\n\r\n"}],"form_shortcode":"","choose_asset_type":"files","links":"","files":"","pardot_redirect_url":"","video_link":""}]},"yoast_head":"\n