IIBF IT Security cheat sheet

CIA triad: Confidentiality (authorized disclosure only), Integrity (accuracy and completeness), Availability (timely, reliable access); every control maps to at least one leg.

Authentication factors: knowledge (password/PIN), possession (token, smart card, mobile device), inherence (biometrics); MFA requires two or more distinct factor types, not two instances of one type.

Symmetric encryption (AES, 3DES) uses one shared key and is fast for bulk data; asymmetric encryption (RSA, ECC) uses a public/private pair for key exchange and signatures but is far slower.

Hashing (SHA-256, SHA-3) is one-way and detects tampering; a MAC or digital signature adds key-based authenticity that a bare hash cannot provide.

TLS secures data in transit; full-disk or database encryption secures data at rest; neither protects data in use, which needs access controls and memory protection.

Phishing variants: spear phishing targets a named individual, whaling targets senior executives, vishing uses voice calls, smishing uses SMS; each is a social-engineering vector, not a malware class.

Defence in depth layers perimeter firewalls, network segmentation, endpoint protection, patching, least-privilege access, and monitoring so no single control failure is fatal.

Vulnerability vs exploit vs threat: a vulnerability is a weakness, an exploit is the code or technique that abuses it, and a threat is the actor or event that may cause harm.

Patch management cycle: inventory assets, classify by criticality, test, deploy, verify, and document exceptions with compensating controls where patching is impossible.

ISO/IEC 27001 defines requirements for an information security management system (ISMS); ISO/IEC 27002 supplies implementation guidance for controls, and neither certifies a product.

Risk treatment options under ISO 27001: mitigate (apply controls), transfer (insurance, outsourcing), avoid (stop the activity), accept (documented management sign-off).

Data classification tiers typically run Public, Internal, Confidential, Restricted; the label determines handling, storage, transmission, and retention rules.

Access control principles: least privilege (minimum rights to do the job), need-to-know, segregation of duties, and periodic access recertification.

The PDCA cycle (Plan-Do-Check-Act) drives continual improvement of an ISMS; the Statement of Applicability records which Annex A controls are applied and why.

Security awareness is a control, not an outcome: measure phishing simulation click rates, training completion, and repeat-offender rates rather than attendance alone.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and lessons learned; evidence must be preserved with a documented chain of custody.

Business continuity differs from disaster recovery: BC keeps critical business functions running, while DR restores IT infrastructure and data after a disruption.

RTO is the maximum tolerable downtime; RPO is the maximum tolerable data loss measured in time; both derive from a business impact analysis.

Risk = likelihood x impact; a risk register records each risk, its owner, inherent rating, controls, residual rating, and treatment decision.

Inherent risk is exposure before controls; residual risk is exposure after controls; risk acceptance must be documented at the level authorized to accept it.

Qualitative scales (for example a 5x5 likelihood-impact matrix) rank risks for prioritisation; quantitative methods (ALE = SLE x ARO) express expected annual loss in money.

SLE (single loss expectancy) = asset value x exposure factor; ARO is annualised rate of occurrence; ALE = SLE x ARO.

Control types: preventive (stops an event), detective (identifies it), corrective (limits damage), deterrent (discourages), and compensating (substitutes when the primary control is infeasible).

Key risk indicators are forward-looking metrics with thresholds; key control indicators measure whether a control is operating as designed.

Third-party risk requires due diligence before onboarding, contractual security and audit clauses, periodic reassessment, and concentration risk monitoring for critical vendors.

Risk appetite is the amount of risk the institution is willing to accept; risk tolerance is the acceptable variation around that appetite for a specific category.

A business impact analysis identifies critical processes, dependencies, and maximum tolerable downtime, feeding RTO and RPO targets into continuity plans.

Digital onboarding relies on KYC and, for high-risk cases, enhanced due diligence; video-KYC and e-KYC must include liveness detection and document authenticity checks.

Transaction risk scoring combines device fingerprint, IP geolocation, behavioural biometrics, beneficiary history, amount, and velocity to decide allow, challenge, or block.

Strong customer authentication for remote payments generally requires two independent elements from knowledge, possession, and inherence, with dynamic linking of the amount and payee.

Open banking APIs use consent-based access: the customer authorises a third party for defined data, scope, and duration, and consent must be revocable.

Tokenisation replaces a card or account number with a surrogate token so the real credential is not stored or transmitted in the merchant or app environment.

Mobile banking hardening: certificate pinning, root/jailbreak detection, code obfuscation, secure key storage in the device keystore, and session timeout on backgrounding.

UPI and instant-payment rails settle near real time, so reversibility is limited; controls shift to pre-transaction checks and beneficiary cooling periods for new payees.

Digital channel availability targets are expressed as uptime percentage; a 99.9% monthly target permits roughly 43 minutes of downtime per month.

Audit trails for digital banking must be tamper-evident, time-synchronised, and retained per regulatory record-keeping periods, capturing actor, action, time, and channel.

Fraud triangle: pressure (incentive), opportunity, and rationalisation; controls that remove opportunity are the most direct lever for fraud prevention.

Card-not-present fraud indicators: mismatched billing and shipping data, multiple cards on one device or IP, unusually large first orders, and rapid order velocity.

Account takeover signals: password reset followed by immediate payee addition, new-device login from an atypical location, and contact-detail change before a transfer.

Mule accounts receive and layer illicit funds; detection uses rapid in-and-out movement, many unrelated counterparties, and accounts opened recently with high throughput.

APP (authorised push payment) fraud is customer-authorised, so the bank cannot rely on authentication alone; confirmation-of-payee checks and scam warnings are the key controls.

AML and fraud monitoring differ: AML targets money laundering and terrorist financing across the institution, fraud monitoring targets loss to the customer or bank; typologies overlap.

STR/SAR filing is triggered by suspicion, not by a fixed amount; the transaction threshold determines record-keeping and reporting duties, not the suspicion test.

First-party fraud involves the genuine customer denying a legitimate transaction; distinguishing it from third-party fraud relies on device, behavioural, and delivery evidence.

A fraud risk assessment scores each product and channel on inherent fraud exposure and control effectiveness, then assigns residual rating and monitoring intensity.