IIBF IT Security study plan

Map the Cyber Security and Information Security syllabi into a single topic list and tag each topic with a confidence rating of high, medium, or low.

Define the CIA triad, non-repudiation, and authentication versus authorization in your own words and give one banking example for each.

Classify common malware families (virus, worm, trojan, ransomware, rootkit, logic bomb) by propagation method and payload behaviour.

Sketch how a phishing-led account takeover unfolds step by step, naming the control that would break the chain at each stage.

Compare symmetric and asymmetric cryptography and explain where each is used in a banking channel (PIN blocks, TLS, digital signatures).

Describe hashing, message authentication codes, and digital certificates, and state what each does and does not guarantee.

Outline the purpose and core requirements of ISO/IEC 27001-style ISMS governance, including risk assessment, statement of applicability, and continual improvement.

Distinguish security policy, standards, procedures, and guidelines, and place each in a bank's document hierarchy.

Explain identity and access management concepts: least privilege, segregation of duties, role-based access, and privileged access management.

Explain network perimeter and segmentation concepts: firewalls, DMZ, IDS versus IPS, VPN, and wireless security.

Summarize secure software and change management practices, including SDLC security gates, code review, and segregation of development, test, and production environments.

Describe business continuity and disaster recovery fundamentals: RTO, RPO, backup types, and alternate site options.

Identify the main Indian regulatory and supervisory expectations for bank IT security (RBI cyber security framework, IS audit, incident reporting) at a conceptual level.

Define IT risk and distinguish inherent, residual, and target risk, giving a banking example of each.

Apply a qualitative risk assessment method: identify assets and threats, estimate likelihood and impact, and assign a rating on a 5x5 matrix.

List the four standard risk treatment options and justify a treatment choice for three different banking scenarios.

Explain how IT risk registers, key risk indicators, and risk appetite statements are used in practice.

Describe the three lines of defence model and where IT risk, compliance, and internal audit sit within it.

Explain the IT risk implications of outsourcing and third-party arrangements, including due diligence, contract clauses, and concentration risk.

Interpret common IT audit findings (unpatched systems, excess privileges, weak logging) and state the corrective control for each.

Describe digital banking delivery channels (internet banking, mobile banking, UPI, wallets, ATM and card networks) and the security control expected at each layer.

Explain customer authentication expectations for digital channels, including multi-factor authentication, transaction signing, and device binding.

Outline the security considerations of APIs and open banking interfaces: authentication, rate limiting, data minimisation, and consent.

Describe the digital payment lifecycle for cards, UPI, and net banking, and identify the point at which each is most exposed to fraud.

Explain fraud risk management building blocks: fraud taxonomy, red flags, detective analytics, and case management.

Distinguish fraud types including phishing, vishing, smishing, SIM swap, account takeover, card skimming and cloning, chargeback abuse, and insider fraud.

Explain the roles of transaction monitoring rules, velocity checks, device fingerprinting, and behavioural analytics in fraud detection.

Outline customer protection and redress expectations: awareness programmes, reporting channels, liability rules for unauthorised electronic transactions, and complaint handling.

Explain how fraud loss data feeds back into risk assessment and control design, closing the loop between Domains 5 and 3.

Describe incident response and cyber fraud escalation: detection, containment, evidence preservation, reporting, and root cause analysis.

Summarize anti-money laundering and know-your-customer links to fraud risk, including mule accounts and suspicious transaction reporting.

Explain how social engineering awareness training and customer education reduce fraud losses, and how effectiveness can be measured.

Reconcile conflicting priorities between customer convenience and fraud controls, and argue a defensible position.

Revisit every low-confidence topic from the week 1 inventory and resolve each one.

Complete two full-length timed mock tests and score them by domain to expose weak areas.

Rewrite your weakest 20 flashcards from memory without referring to notes.

Summarize each domain on a single index card that you could reconstruct from memory.