IIBF IT Security key terms

A fraudulent message that tricks a person into revealing credentials, card data, or personal details by imitating a trusted bank, colleague, or service. It usually arrives by email, SMS, or voice call and relies on urgency or fear.

Voice-based phishing where a caller impersonates bank staff, police, or a regulator to extract OTPs, PINs, or account details. Caller ID spoofing and pressure tactics are common, so the victim believes the call is genuine.

Phishing delivered through SMS or messaging apps, often containing a shortened link to a fake bank page or a request to call a number. Mobile users are targeted because small screens hide URL details.

Manipulating people into breaking normal security procedures by exploiting trust, authority, curiosity, or fear. It targets the human element rather than technical controls and often precedes fraud or unauthorised access.

Creating a fabricated scenario or identity to persuade a target to share information or perform an action. The attacker builds credibility with background details before making the request.

Any software written to harm, disrupt, or gain unauthorised access to a system, including viruses, worms, trojans, ransomware, and spyware. Delivery is often through malicious attachments, links, or infected downloads.

Malware that encrypts files or locks systems and demands payment for restoration. In banking, attackers increasingly steal data first and threaten to publish it, a tactic called double extortion.

Malicious software disguised as a legitimate program so a user installs it voluntarily. Once running, it may open a backdoor, capture keystrokes, or download further payloads without the user noticing.

Software or hardware that records every keystroke on a device, capturing passwords, PINs, and card numbers. It is often bundled with trojans or installed through compromised websites.

An attack that floods a service with traffic from many compromised machines so genuine customers cannot use it. For banks it can disrupt internet banking or payment channels and mask concurrent fraud.

A network of infected devices controlled remotely by an attacker, often used to send spam, spread malware, or launch DDoS attacks. Owners of the infected devices are usually unaware of the activity.

An attacker secretly relays or alters communication between two parties who believe they are talking directly. In banking it can intercept sessions or modify payment details in transit.

Taking over an authenticated user session by stealing or guessing the session token, allowing the attacker to act as the customer without knowing the password. It often follows malware or an insecure public network.

Inserting malicious database commands into input fields so an application executes unintended queries. It can expose customer records or bypass login checks when input is not properly validated.

Injecting script into a web page viewed by other users so their browsers run attacker-controlled code. It can steal session cookies or redirect customers to fraudulent pages.

A software flaw unknown to the vendor, so no patch exists when attackers begin exploiting it. Defence relies on layered controls, monitoring, and rapid threat intelligence rather than patching alone.

The disciplined process of identifying, testing, and applying software updates that close known security gaps. Delays leave systems exposed, so banks set risk-based timelines for critical patches.

A systematic scan and review of systems to find weaknesses before attackers exploit them. Results are prioritised by severity and fed into remediation and patch planning.

Authorised simulated attacks on systems to prove whether vulnerabilities can actually be exploited. Unlike a scan, it validates real-world impact and tests people, process, and technology together.

A goal-based adversary simulation that tests an organisation's detection and response, not just technical flaws. It often combines social engineering, physical access, and cyber techniques over an extended period.

A control that permits or blocks network traffic according to defined rules, separating trusted from untrusted zones. Modern firewalls also inspect application content and log denied attempts for monitoring.

A monitoring tool that inspects traffic or host activity and raises alerts on suspicious patterns. A detection-only system alerts staff; an intrusion prevention system can also block the traffic.

A platform that collects logs from many sources, correlates events, and alerts analysts to incidents. It supports investigation and regulatory record-keeping by centralising evidence.

A team and facility that monitors security alerts around the clock, triages them, and coordinates response. It is the operational hub linking detection tools to incident handling.

A documented process to prepare for, detect, contain, eradicate, and recover from security incidents, then learn from them. Clear roles and escalation paths reduce damage and support reporting duties.

Documented arrangements that keep essential services running or restore them within agreed times after disruption. For banks it covers people, premises, systems, and third parties, and is tested regularly.

The technical and procedural steps to restore IT systems and data after a major failure, guided by recovery time and recovery point objectives. It is a subset of wider business continuity planning.

The maximum acceptable amount of data loss measured in time, such as four hours of transactions. It drives backup frequency and replication design for critical banking systems.

The target time within which a system or process must be restored after disruption. It sets the urgency of recovery and helps rank systems by business criticality.

A study identifying critical business functions and the harm caused by their outage over time. Its findings justify recovery targets and spending on resilience controls.

The process of identifying threats and vulnerabilities, estimating likelihood and impact, and comparing the result with risk appetite. It produces a prioritised basis for treatment decisions.

Choosing how to deal with an assessed risk: mitigate with controls, transfer through insurance or contracts, avoid the activity, or accept it with approval. The choice is recorded with an owner and deadline.

The risk that remains after controls have been applied. It must be compared with the bank's risk appetite and accepted formally by an accountable person.

The amount and type of risk an organisation is willing to accept in pursuit of its objectives. It guides limits, approval thresholds, and escalation when exposures grow.

Logging in with two different evidence types, such as a password plus a code from a separate device. It reduces the value of stolen passwords but fails if the second factor is relayed by a tricked customer.

Authentication using two or more independent factors from knowledge, possession, and inherence. Push notifications and hardware keys resist phishing better than SMS codes.

A code valid for a single login or transaction, usually delivered by SMS, app, or hardware token. Customers must never share it, because anyone holding it can authorise the payment.

Replacing sensitive data such as a card number with a surrogate value that has no exploitable meaning outside its intended context. It limits the impact of a data breach.

Converting readable data into ciphertext so only holders of the correct key can read it. It protects data at rest and in transit, but does not stop an authorised user misusing data.

A protocol that encrypts and authenticates data moving between a browser or app and a server. Current versions prevent eavesdropping on logins and payments over untrusted networks.

Unauthorised card transactions made without the physical card, typically online, by phone, or in-app. It relies on stolen card details and is countered by authentication, velocity checks, and tokenisation.

Automated review of payment and account activity against rules or models to spot unusual patterns in real time or near real time. Alerts are investigated and may lead to blocks or reports.

Making illegally obtained funds appear legitimate through placement, layering, and integration. Banks must run customer due diligence and report suspicious activity to the authorities.

Identifying customers and verifying identity, beneficial ownership, and risk profile before and during the relationship. It underpins fraud prevention, anti-money-laundering controls, and periodic review.