Cyber Security
Cyber Security in the IIBF IT Security exam tests how a bank prevents, detects and responds to attacks on its perimeter, endpoints and payment channels. Expect questions on threat actors, the RBI Cyber Security Framework (2016), CERT-In incident reporting, SOC operations and the computer-offence sections of the IT Act.
Core rules
- CERT-In reporting: specified incidents such as ransomware, data breach, DDoS and unauthorised access must be reported within six hours of noticing; logs must be retained for 180 days within India under the 2022 directions.
- RBI framework: banks need a board-approved cyber security policy, a designated CISO, a Security Operations Centre, and periodic vulnerability assessment and penetration testing.
- Defence in depth: firewall and DMZ segmentation, IDS/IPS, endpoint detection, privileged access management, patch management and email filtering.
- IT Act 2000 (amended 2008): identity theft and phishing attract s.66C and s.66D; unauthorised access to protected systems is covered by s.66; cyber terrorism by s.66F.
- Incident response: prepare, identify, contain, eradicate, recover and learn, preserving evidence before rebuilding.
Worked example
A branch PC displays a ransomware note. The reasoned response is to isolate the PC from the network without powering it off, because memory holds evidence; notify the CISO, photograph the screen, check backups and lateral movement, report to CERT-In within six hours, inform RBI as directed, and not pay the ransom. Disconnecting limits spread; keeping power preserves forensic artefacts.
Traps
Do not delay CERT-In reporting while "investigating"; do not delete infected logs; do not confuse NCIIPC, which protects critical infrastructure, with CERT-In, which handles incident response; do not treat cyber risk as an IT project, because the Board owns it.