Cyber Security Framework for Banks

Cyber Security Framework

• Issued on Jyeshtha 12, 1938 (saka), June 2, 2016
• A letter addressed to the Chairman/ Managing Director /Chief Executive Officer of All Scheduled Commercial Banks (excluding Regional Rural Banks)

Introduction

• The use of IT by banks has significantly increased and is essential to banks' operational strategies

• The Reserve Bank provided guidelines via Circular DBS.CO.ITC.BC.No.6/31.02.008/2010-11 dated April 29, 2011, including:

  • Information Security
  • Electronic Banking
  • Technology Risk Management
  • Cyber Frauds (G.Gopalakrishna Committee)

• Banks must proactively adjust policies, procedures, and technologies to address new developments and concerns, as measures suggested for implementation cannot be static.

• Technology use by banks has gained momentum

• The number, frequency, and impact of cyber incidents/attacks on the financial sector has increased

• Highlights the urgent need for a cyber-security/resilience framework and adequate cyber-security preparedness.

• Resilience of the banking system must be enhanced

• Defenses for addressing cyber risks must be improved, including an adaptive Incident Response, Management, and Recovery framework to deal with disruptions.

Need for a Board Approved Cyber-Security Policy

• Banks should create a cyber-security policy that explains the strategy for combating cyber threats, considering business complexity and risk, approved by the Board
• A confirmation may be communicated to Cyber Security and Information Technology Examination (CSITE) Cell of Department of Banking Supervision, Reserve Bank of India, Central Office, World Trade Centre-I, 4th Floor, Cuffe Parade, Mumbai 400005, no later than September 30, 2016.

Cyber Security Policy Distinction

• Cyber Security Policy should be distinct from the broader IT policy/IS Security Policy
• Should highlight the risks from cyber threats and ways to mitigate them

Inherent Risks and Controls

• Size, systems, technological complexity, digital products, stakeholders, and threat perception vary from bank to bank
• It is of utmost importance to identify the inherent risks and controls for an appropriate cyber-security framework
• Banks must consider adopted technologies, alignment with business and regulatory requirements, connections established, delivery channels, online/mobile products, technology services, organizational culture, and internal & external threats when assessing risks.
• Banks should categorize riskiness (low, moderate, high, very high) based on the level of inherent risks.
• Risk should also be factored in
• Banks should outline:
  • Board oversight
  • Policies
  • Processes
  • Cyber risk management architecture (experienced resources)
  • Training and culture
  • Threat intelligence gathering arrangements
  • Monitoring and analyzing threat intelligence
  • Information sharing arrangements
  • Cyber security controls
  • Vendor management
  • Incident management & response

Continuous Surveillance Arrangement

• Testing for vulnerabilities at reasonable intervals.
• A SOC (Security Operations Centre) must be set up to ensure continuous surveillance and stay updated on the latest cyber threats

IT Architecture and Security

• IT architecture should facilitate the implementation of security measures.
• Should be reviewed by the IT Sub Committee, upgraded as needed.
• Risk cost/potential cost trade off decisions should be documented for supervisory assessment

Cyber Security and Resilience Framework

• An indicative, but not exhaustive, minimum baseline cyber security and resilience framework to be implemented is provided in Annex 1
• Banks should proactively initiate the process of setting up and operationalizing a Security Operations Centre (SOC) to monitor and manage cyber risks in real time
• An indicative configuration of the SOC is given in Annex 2.

Network and Database Security

• There is a need to thoroughly review network security in every bank
• Connections to networks/databases allowed for business needs must be closed when no longer needed to avoid cyber-attacks
• Unauthorized access to networks and databases is not allowed
• Responsibility over networks and databases should rest with bank officials.

Customer Information Protection

• Banks depend on technology and collect personal information
• Banks, as data owners, should preserve the Confidentiality, Integrity, and Availability of data regardless of location
• Confidentiality should not be compromised, systems and processes should be implemented across the data lifecycle.

Cyber Crisis Management Plan

• A CCMP should be evolved and part of the Board strategy, traditional BCP/DR strategies may not be adequate
• As of Current date, CERT-In takes initiatives to strengthen cyber-security, such as proactive and reactive services as well as threat intelligence
• CERT-IN has released the National Cyber Crisis Management Plan and Cyber Security Assessment Framework
• CERT-In/NCIIPC/RBI/IDRBT guidance for CCMP formulation

CCMP Aspects

• Detection
• Response
• Recovery
• Containment
• Banks should prevent cyber-attacks, detect intrusions promptly, and recover/contain fallout
• Banks should be prepared for ‘zero-day' attacks, remote access threats, and targeted attacks
• Banks should take steps in addressing cyber threats including:
  • Denial of service
  • Distributed denial of services (DDoS)
  • Ransom-ware/crypto ware
  • Destructive malware
  • Business email frauds (spam, phishing, spear phishing, whaling, vishing)
  • Drive-by downloads
  • Browser gateway fraud
  • Ghost administrator exploits
  • Identity frauds
  • Memory update frauds
  • Password related frauds

Cyber Security Preparedness Indicators

• Adequacy of cyber resilience framework should be assessed using indicators for risk/preparedness
• Indicators for testing via compliance checks/audits by professionals
• Stakeholder awareness may be part of assessment

Sharing Information with RBI

• Banks are reluctant to share cyber incidents
• Globally sharing cyber-incidents and best practices, would facilitate timely measures
• Banks need to report all unusual cyber-security incidents to the Reserve Bank
• Banks should participate in CISOs' Forum per IDRBT and report incidents to Indian Banks – Center for Analysis of Risks and Threats (IB-CART) set up by IDRBT
• Collaborative efforts share threat intelligence, alerts, and proactive cyber security.

Supervisory Reporting

• Summary and detailed information on information security incidents, including cyber-incidents are collected
• Banks must promptly report incidents in Annex-3 format

Preparedness Assessment

• Material control gaps may be identified and remediated with IT Sub Committee and Board oversight
• Identified gaps, measures, milestones, timelines, and measurement criteria should be submitted to the Cyber Security and Information Technology Examination (CSITE) Cell of Department of Banking Supervision, Central Office by July 31, 2016, by the Chief Information Security Officer.

Organizational Arrangements

• Banks should ensure security concerns are appreciated, addressed, and escalated for quick action

Cyber Security Awareness

• Managing cyber risk requires commitment
• High levels of staff awareness at all levels and Board familiarity needs to occur
• Banks should promote understanding of cyber resilience among stakeholders and implementation/testing

Stakeholders and Awareness

• Stakeholders' (customers, employees, partners, and vendors) awareness of cyber-attacks helps security preparedness
• Banks should enhance awareness
• The Board of Directors and Top Management should be up to speed in cyber-security, and banks should take immediate steps.

Board of Directors

• Place a copy of this circular may be placed before the Board of Directors in its ensuing meeting

Annex 1 - Baseline Cyber Security and Resilience Requirements

• Requirements to be put in place by banks to achieve baseline cyber-security/resilience
• May be evaluated periodically to integrate risks
• Important security controls for effective cyber security as may be articulated by CERT-In also may be referred

IT Sub-Committee and Board

• Reviewed for growing technology adoption and threats
• Board involvement and guidance would set the tone

Cyber Security Operations Centre

• Having the capacity to monitor various logs/incidents in real time/near real time
• Keep vigil and to constantly remain alert

Security and Configuration

• While hardware devices and software applications may provide security, it is important to configure them appropriately
• Human resources are the key
• Ensure that they are provided with appropriate training
• Communicate the security policy of the bank periodically

Inventory Management of Business IT Assets

• Maintain an up-to-date inventory of Assets, including business data/information including customer data/information, business applications, supporting IT infrastructure and facilities hardware/software/network devices, key personnel, etc
• Indicate their business criticality
• The banks may have their own framework/criteria for identifying critical assets

Classifying Data Informatiom

• Classify data/information based on information classification/sensitivity criteria of the bank

Protection

• Appropriately manage and provide protection within and outside organisation borders/network taking into consideration how the data/information are stored, transmitted, processed, accessed and put to use within/outside the bank’s network, and level of risk they are exposed to depending on the sensitivity of the data/information

Preventing Execution of Unauthorized Software

• Maintain an up-to-date and preferably centralised inventory of authorized/unauthorized software(s)
• Consider implementing whitelisting
• Have mechanism to centrally/otherwise control installation of software applications on end-user PCs, laptops, workstations, servers, mobile devices, etc
• Block/prevent and identify installation and running of unauthorized software/applications on such devices/systems

Patch Release

• Continuously monitor the release of patches by various vendors/OEMs, advisories issued by CERT-in and other similar agencies and expeditiously apply the security patches as per the patch management policy of the bank
• Patches released by OEM/manufacturer/vendor for protection against well Known/well publicized/reported attacks exploiting the vulnerability patched expedited emergency patch

Framework

• Have a clearly defined framework including requirements justifying the exception(s), duration of exception(s), process of granting exceptions, and authority for approving, authority for review of exceptions granted on a periodic basis by officer(s) preferred

Environmental Controls

• Put in place appropriate environmental controls for securing location of critical assets providing protection from natural and man-made threats
• Put in place mechanisms for monitoring of breaches/compromises of environmental controls relating to temperature, water, smoke, access alarms, service availability alerts, access logs, etc
• Appropriate physical security measures shall be taken to protect the critical assets of the bank

Network Management and Security

• Prepare and maintain an up-to-date network architecture diagram at the organisation level including wired/wireless networks
• Maintain an up-to-date/centralized inventory of authorized devices connected to bank’s network and devices enabling the bank’s network
• The bank may consider implementing solutions to automate network discovery and management

Network Device Configuration

• Ensure that all the network devices are configured appropriately and periodically assess whether the configurations are appropriate to the desired level of network security
• Put in appropriate controls to secure wireless local area networks, wireless access points, wireless client access systems
• Have mechanisms to identify authorized hardware/mobile devices, ensure connectivity only when they meet the security requirements prescribed by the bank
• Have mechanism to automatically identify unauthorized device connections to the bank’s network and block such connections
• Put in place mechanism to detect and remedy any unusual activities in systems, servers, network devices, and endpoints
• Establish SOP for all major IT activities including for connecting devices to the network
• Security Operation Centre to monitor the logs of various network activities and should have the capability to escalate any abnormal / undesirable activities
• Boundary defenses should be multi-layered with properly configured firewalls, proxies, DMZ perimeter networks, and network-based IPS and IDS
• Mechanism to filter both inbound and outbound traffic to be put in place

Secure Configuration

• Document and apply baseline security requirements/configurations to all categories of devices, throughout the lifecycle and carry out reviews periodically
• Periodically evaluate critical device configurations and patch levels for all systems in the bank’s network

Application Security Life Cycle

• Incorporate/Ensure information security across all stages of application life cycle
• In respect of critical business applications, banks may consider conducting source code audits by professionally competent personnel/service providers or have assurance from application providers/OEMs that the application is free from embedded malicious/fraudulent code
• Secure coding practices may also be implemented for internally/collaboratively developed applications
• Besides business functionalities, security requirements relating to system access control, authentication, transaction authorization, data integrity, system activity logging, audit trail, session management, security event tracking and exception handling are required to be clearly specified at the initial and ongoing stages of system development/acquisition/implementation
• Development test and production environments need to be properly segregated
• Software/Application development approach should be based on threat modelling, incorporate secure coding principles and security testing based on global standards and secure rollout
• Software/application development practices addresses the vulnerabilities based on best practices baselines such as Open Web Application Security Project (OWASP) proactively and adopt principle of defence-in-depth to provide layered security mechanism
• Consider implementing measures such as installing a "containerized" apps on mobile/smart phones for exclusive business use that is encrypted and separated from other smartphone data/applications
• Measures to initiate a remote wipe on the containerized app, rendering the data unreadable, in case of requirement may also be considered

Adoption of New Technologies

• Ensure that adoption of new technologies shall be adequately evaluated for existing/evolving security threats and IT/security team of the bank reach reasonable level of comfort and maturity with such technologies before introducing for critical systems of the bank

Patch/Vulnerability & Change Management

• Follow a documented risk-based strategy for inventorying IT components that need to be patched, identification of patches and applying patches so as to minimize the number of vulnerable systems and the time window of vulnerability/exposure
• Systems and processes to identify, track, manage and monitor the status of patches to operating system and application software running at end user devices directly connected to the internet and in respect of Server operating Systems/Databases/Applications/ Middleware

Change Management

• Changes to business applications, supporting technology, service components and facilities should be managed using robust configuration management processes
• Configuration baseline that ensure integrity of any changes thereto
• Periodically conduct VA/PT of internet facing web/mobile applications, servers & network components throughout their lifecycle and testing of web/mobile applications throughout their lifecycle environment
• As a threat mitigation strategy, identify the root cause of incident and apply necessary patches to plug the vulnerabilities
• Periodically evaluate the access device configurations and patch levels to ensure that all access points, nodes between different VLANs in the Data Centre and partner networks are securely configured

User Access Control / Management

• Provide secure access to the bank’s assets/services from within/outside bank’s network by protecting data/information at rest and in-transit
• Carefully protect customer access credentials such as logon user-id, authentication information and tokens, access profiles, etc. against leakage/attacks
• Disallow administrative rights on end-user workstations/PCs/laptops and provide access rights on a need to know basis and for specific duration when it is required following an established process
• Implement centralized authentication and authorization system including enforcement of strong password policy
• Implement appropriate systems and controls to allow, manage, log and monitor privileged Access
• Implement controls to minimize invalid logon counts, deactivate dormant accounts
• Monitor any abnormal change in pattern of logon
• Implement measures to control installation of software on PCs/laptops etc
• Implement controls for remote management/wiping/locking of mobile devices including laptops etc
• Implement measures to control use of VBA/macros in office documents, control permissible attachment types in email systems

Authentication Framework for Customers

• Implement authentication framework/mechanism to provide positive identify verification of bank to customers
• Customer identity information should be kept secure
• Banks should act as the identity provider for identification and authentication of customers for access to partner systems using secure authentication technologies

Secure Mail and Messaging Systems

• Implement secure mail and messaging systems that include measures to prevent email spoofing
• Document and implement email server specific controls

Vendor Risk Managment

• Banks shall be accountable for ensuring appropriate management and assurance on security risks in outsourced and partner arrangements
• Banks shall carefully evaluate the need for outsourcing critical processes and selection of vendor/partner based on comprehensive risk assessment
• Conduct effective due diligence, oversight and management of third party vendors/service providers & partners
• Establish appropriate framework, review, control and monitor the risks and materiality of all its vendors
• Banks shall ensure and demonstrate that the service provider adheres to all regulatory and legal requirements of the country
• Banks may necessarily enter into agreement that provides for right of audit

Access to Information

• RBI shall have access to all information resources consumed by banks and shall physically accessible
• Banks have to adhere to legal and regulatory requirements relating to geographical location of infrastructure and movement of data
• Banks shall thoroughly satisfy about the credentials of vendor/third-party personnel accessing and managing the bank’s critical assets and should have agreements in place

Removable Media

• Define and implement policy for restriction and secure use of removable media
• Limit media types and information that could be transferred
• Removable media is scanned for malware/antivirus prior
• Consider implementing centralized policies
• As default rule, use of removable devices and media should not be permitted

Threat Defence and Management

• Build a robust defence against malicious code
• Implement Anti-malware, antivirus protection
• Consider implementing whitelisting

Web Gateways

• Consider implementing secure web gateways
• Subscribe to anti-phishing anti-rouge services
• Develop a data loss leakage prevention strategy to safeguard sensitive data
• Data secured to other digital devices and protected at facilities

Audit Logs

• Stakeholders consulted with log data
• Managed analysis performed to detect potential risks and capture logs relating to user actions

Audit Settings

• Apply and validate settings
• Vulnerability for internet
• Periodically conduct risk assessment
• Remediate immediately

Penatration Testing

• Periodically conduct vulnerability assessment and penetration testing exercises for all the critical systems, particularly those facing the internet.
• The vulnerabilities detected are to be remedied promptly in terms of the bank’s risk management/treatment framework so as to avoid exploitation of such vulnerabilities.

System Testing and Monitoring

• Penetration testing of public facing stems
• Monitored during the information security process
• Implemented by red teams to assess vulnerabilities
• System performance evaluated by cyber drills

Incident Response

• Developed proper response program
• Proper communication
• Established response program

Recovery

• Established BCP-DR capabilities
• Establish appropriate recovery
• Established protection
• Establish training and contact procedures

Building Blocks for Cyber SoC

• Building blocks for operations include
• Incident detection methods
• Methods for implementation
• Information about operations including the implementation and data extraction strategies

Risk Based Transactions

• Risk based transitions occur during
• Fraud monitoring during transactions
• Customer identification
• Monitor performance metrics

Forensic Support

• Built through analysis to help determine incident
• Cyber drills to assist in evaluation
• Train employees and management
• User education and awareness for identifying risks and reporting to IT

Annex 2 - Setting up and Operationalising Cyber Security Operation Centre (C-SOC)

• Banking security and operational guidelines has been determined by the RBI to keep up with evolving technology to customers
• Its important to look at current and developing IT applications in banking and current guidelines
• IT security, technology, operations and legal must be considered

Government

• Top level managers that address threats
• Policy enforcement and participation

Cyber SoC

• Traditional prevention is not effective due to change
• Active monitoring and management required

Security

• Systems must be current
• Monitor and deploy and correlate tools to find anomalies

Implementation and Analysis

• Identify attacks and classify them to come up with containment
• Conduct accident investigation that uses deep packet analysis to understand how to respond
• Analyse with dynamic behaviors to look for indicators
• Analytics with good geography information
• Set up counter and honeypots

Responsibilities

• Set up systems and data that are effective and quick
• Provide access for security and laws
• Prevent risk
• Be aware of threats

Annex 3 - Template for reporting Cyber Incidents

• Security Incident Reporting (SIR) to RBI must occur within two to 6 hours
• Subsequent updates must be submitted if the earlier reporting was incomplete
• Required: banking status and time of the incident, contact data and information about the attacks
• Chronological list of what happened with what was seen in the system
• Steps must be given to help address or see the possible attack. Include data and information on security measures
• Complete list available in banking
• All fields required or as stated

Information and Contact Data

• Must be given for each field listed that could potentially involve a cyber attack
• The information allows the cyber team to evaluate the potential vulnerabilities of what could potentially be compromised.
• The data is relevant to help detect the risk patterns, identify threats or respond.

Type of Vulnerabilities

• A rating based on data loss
• Security breach
• Potential downtime
• A series of forms used to determine the type and quality of incident/issue in the system

System Evaluation and Monitoring

• Include testing and evaluating of systems
• Use current methods
• Must identify an IP and port from the attack
• Use log analysis to isolate cause
• Provide potential next steps