Information System Security and Cyber Security Management
What this domain tests
Cybersecurity management in banking: governance, controls, monitoring, incident response and regulatory reporting. Questions often test the RBI Cyber Security Framework, the role of the CISO, SOC/SIEM, VA/PT, identity and access management, and breach reporting timelines.
Core rules
- Security rests on confidentiality, integrity and availability; banks apply defence-in-depth: network segmentation, firewalls, WAF, endpoint protection, privileged access management, encryption at rest and in transit, and multi-factor authentication.
- The RBI Cyber Security Framework (2016) sets out control objectives across governance, asset management, identity, network, application, data, incident response and resilience; it expects board-approved policy, a CISO and independent assessment.
- Logs from CBS, switches, databases, firewalls and endpoints should feed a SIEM; SOC analysts triage alerts, and use cases cover impossible travel, repeated failed logins, large-value transfers and privileged commands.
- Report cyber incidents to RBI within 2–6 hours and to CERT-In within 6 hours of noticing, with root cause analysis and remediation tracked to closure.
Worked example
A net-banking credential-stuffing attack shows thousands of failed logins followed by successful logins from one IP range. Correct response: block or step-up the IP range, force password resets and MFA re-enrolment for affected users, preserve logs, notify RBI/CERT-In within the required window, check for fraudulent beneficiary additions, and run a post-incident review. Merely resetting passwords without checking transactions misses the fraud.
Traps that cost marks
- Treating SIEM as an audit log archive rather than an alerting tool.
- Reporting only after customer complaints.
- Assuming MFA removes the need for transaction monitoring.