IIBF IT Security case studies
IIBF IT Security · Put your knowledge to work in context.
The IIBF IT Security credential is a certificate examination offered by the Indian Institute of Banking & Finance, a Mumbai-based institute established in 1928 that describes its mission as developing professionally qualified and competent bankers and finance professionals through education, training, examination and continuing professional development. This page is an independent study resource for candidates preparing for that examination; it is not affiliated with, endorsed by, or operated by IIBF, and it does not reproduce any official question bank. The IIBF IT Security case studies are 5 cases and about 4,527 words.
1Beaconing ATMs and an Encrypted Patch Server on Salary Week
An urban co-operative bank with 214 branches runs its SOC through an outsourced MSSP on a 24x7 retainer. At 02:10 on a Tuesday the MSSP escalates a medium-severity alert: 37 ATMs in the western zone are querying a domain registered 11 days earlier, with a fixed 60-second beacon interval.
906 words, about 5 min2Production Data in UAT, a Shared VPN Account and Three Blocked Emails
During a UAT refresh a bank's testing team restores a production extract of 1.9 million customer records into the QA environment so a new loan-origination module can be tested against realistic data. The extract includes name, PAN, masked Aadhaar, mobile number, address and loan balances, but no card numbers or PINs.
860 words, about 4 min3Unsupported ATM Estate Against a Board Risk Appetite
A small finance bank's risk register carries an entry for 640 ATMs and the ATM switch appliance, all running Windows Server 2012 R2, which stopped receiving security updates from the OEM in January 2023. The extended security update programme costs Rs 1.8 crore a year for the estate; a full migration to a supported platform is quoted at Rs 9.4 crore over 14 months, against a capex provision of Rs 3 crore this financial year.
877 words, about 4 min4SIM Swaps, UPI Device Registration and Twenty-Seven Complaints
Between 3 and 9 March a bank receives 27 complaints of unauthorised UPI debits ranging from Rs 4,800 to Rs 49,000, totalling Rs 6.31 lakh. In every case the customer's SIM had been replaced or ported out in the preceding 72 hours; the fraudster then installed the bank's UPI app on a new handset, entered the registered mobile number, received the SMS OTP on the swapped SIM, set a new UPI PIN and transferred funds to nine beneficiary VPAs.
947 words, about 5 min5Sixty-Two New Accounts, Night-Time Cash-Out and a Fourteen-Month STR Gap
On 14 June the analytics team of a mid-sized private bank runs an ad hoc query after a customer complaint and finds 62 accounts opened in the previous 90 days across three branches sharing an unusual pattern: credits of Rs 15,000 to Rs 22,000 arrive from five payment aggregator settlement accounts, and 85-95% of each credit is withdrawn in cash at ATMs or business correspondent points within 40 minutes, mostly between 22:00 and 01:00. Aggregate inflow is Rs 1.11 crore.
937 words, about 5 min