11.4 Cybersecurity & Banking IT Security
Key Takeaways
- The CIA Triad—Confidentiality, Integrity, and Availability—forms the bedrock of banking IT security, augmented by Authentication, Authorization, and Non-repudiation.
- Malware vectors include Viruses (host file dependency), Worms (standalone network self-propagation), Trojans (disguised malicious programs), Ransomware (crypto-locking data), and Banking Trojans like Zeus/Emotet.
- Social engineering attacks like Phishing, Vishing, Smishing, Pharming (DNS poisoning), and SIM Swapping target human vulnerability to bypass technical perimeter defenses.
- Public Key Infrastructure (PKI) utilizes asymmetric cryptography (RSA, ECC) for digital signatures and secure key exchange, combined with symmetric encryption (AES-256) for bulk transaction payload encryption.
- India's Information Technology Act 2000 (with 2008 amendments) and RBI Cyber Security Framework mandate strict incident reporting, data protection, and multi-factor authentication (MFA/2FA) for core banking operations.
Last updated: July 2026
Cybersecurity & Banking IT Security
As banking services transition to online banking apps, UPI, and cloud-hosted microservices, cybersecurity has become paramount. Financial institutions are prime targets for cyber criminals seeking monetary theft, account takeover, or operational disruption. SBI PO candidates must master cybersecurity fundamentals, cryptographic standards, attack vectors, and regulatory compliance.
1. Information Security Principles & The CIA Triad
The foundation of computer security rests on three core objectives known as the CIA Triad:
+-----------------------------------------------------------------+
| THE CIA TRIAD |
| |
| /-------------------\ |
| | CONFIDENTIALITY | |
| \-------------------/ |
| / \ |
| / \ |
| / \ |
| / \ |
| / \ |
| /-------------------\ /-------------------\ |
| | INTEGRITY |=========| AVAILABILITY | |
| \-------------------/ \-------------------/ |
+-----------------------------------------------------------------+
- Confidentiality: Ensures sensitive data (e.g., customer account numbers, PINs, account balances) is accessible only to authorized personnel and systems. Enforced using encryption, strict access control lists (ACLs), and multi-factor authentication.
- Integrity: Guarantees data remains accurate, complete, and unalterable by unauthorized parties during storage or transmission. Enforced using cryptographic hashes (SHA-256) and digital signatures.
- Availability: Ensures banking services, core database servers, and network infrastructure remain continuously accessible to authorized users when needed. Enforced using redundant hardware, load balancing, DDoS mitigation, and disaster recovery sites.
The AAA Security Framework & Non-Repudiation
- Authentication: Verifying the claimed identity of a user or system (e.g., password, OTP, fingerprint scan).
- Authorization: Granting specific operational privileges and access rights after identity verification.
- Accounting: Tracking and auditing user activity in system logs for compliance.
- Non-repudiation: Ensuring a sender cannot deny having sent a transaction instruction or document. Achieved via Digital Certificates and PKI.
2. Malware Taxonomy & Attack Vectors
Malware (Malicious Software) refers to any code designed to damage, exploit, or compromise computing systems.
| Malware Type | Self-Replicating? | Requires Host File? | Key Mechanism & Banking Impact |
|---|---|---|---|
| Virus | Yes (attaches to host) | Yes | Inserts malicious payload into executable host files (.exe, .docm). Triggers execution when the host program is opened. |
| Worm | Yes (standalone) | No | Self-propagating program that traverses network vulnerabilities without human interaction, consuming bandwidth and dropping backdoors. |
| Trojan Horse | No | No | Disguised as legitimate utility software (e.g., fake PDF viewer). Once installed, it executes stealthy malicious actions. |
| Banking Trojan | No | No | Specialized Trojan (e.g., Zeus, Emotet, TrickBot) that injects keyloggers, intercepts SMS OTPs, and executes web injections into online banking forms. |
| Ransomware | Yes / No | No | Encrypts victim data files using strong asymmetric/symmetric keys and demands ransom payment for the decryption key (e.g., WannaCry, LockBit). |
| Spyware | No | No | Stealthily monitors user activity, logs keystrokes (Keylogger), captures screen images, and exfiltrates credentials to C2 servers. |
| Rootkit | No | No | Low-level kernel driver that hides its presence and active processes from the OS task manager and security tools. |
| Botnet / DDoS | Network scale | No | Compromised network of infected devices ("zombies") controlled by a Command & Control (C2) server to flood target bank servers with junk traffic. |
3. Social Engineering & Financial Cyber Attacks
Social engineering tricks human beings into surrendering confidential credentials or making unauthorized money transfers.
Common Cyber Fraud Methods
- Phishing: Mass deceptive emails mimicking legitimate banks directing victims to malicious clone sites designed to steal login credentials.
- Spear Phishing: Highly targeted phishing attack aimed at specific executives or bank staff using customized contextual details.
- Whaling: Spear phishing targeted specifically at high-profile corporate executives (CEOs/CFOs).
- Vishing (Voice Phishing): Phone fraud where scammers impersonate bank managers or credit card officers to extract OTPs or CVVs verbally.
- Smishing (SMS Phishing): Deceptive SMS messages claiming an account is suspended unless a link is clicked immediately.
- Pharming: Poisoning DNS cache entries or local host files so typing a legitimate URL (
www.sbi.co.in) silently redirects the browser to a fake malicious IP server address. - Man-in-the-Middle (MitM) Attack: An attacker secretly intercepts and alters communications between two trusting parties (e.g., public Wi-Fi eavesdropping).
- SIM Swapping: Fraudsters trick telecom providers into issuing a replacement SIM card for a victim's phone number, hijacking SMS-based 2FA OTPs.
4. Cryptography & Banking Public Key Infrastructure (PKI)
Cryptography scrambles plaintext readable data into unreadable ciphertext.
+-----------------------------------------------------------------+
| SYMMETRIC VS. ASYMMETRIC ENCRYPTION |
| |
| SYMMETRIC: Plaintext --[ Shared Key K ]--> Ciphertext |
| Ciphertext --[ Shared Key K ]--> Plaintext |
| |
| ASYMMETRIC: Plaintext --[ Public Key K_pub ]--> Ciphertext |
| Ciphertext --[ Private Key K_priv ]--> Plaintext |
+-----------------------------------------------------------------+
Symmetric vs. Asymmetric Cryptography
| Attribute | Symmetric Encryption | Asymmetric Encryption (Public Key) |
|---|---|---|
| Key Usage | Single shared secret key for both encryption and decryption. | Pair of mathematically linked keys: Public Key (shared openly) and Private Key (kept secret). |
| Processing Speed | Extremely fast; suited for bulk payload data encryption. | Slower (high mathematical compute overhead). |
| Key Distribution | Difficult (how to share the secret key safely across networks). | Easy (public keys are published freely). |
| Primary Algorithms | AES (Advanced Encryption Standard - 128/256 bit), 3DES. | RSA, ECC (Elliptic Curve Cryptography), Diffie-Hellman. |
| Primary Purpose | Encrypting database files and net banking sessions. | Digital Signatures, SSL/TLS handshake key exchange. |
Worked Example: Public Key Transaction Protocol
Scenario: A customer (Alice) signs and sends an online banking payment instruction to SBI's server using PKI.
- Digital Signature Creation (Integrity & Non-Repudiation):
- Alice's banking app computes a SHA-256 hash of her payment message.
- The app encrypts the hash using Alice's Private Key. This encrypted hash is her Digital Signature.
- Verification by SBI Server:
- SBI receives the message and signature.
- SBI decrypts the signature using Alice's Public Key to recover the hash.
- SBI independently computes the SHA-256 hash of the received message.
- If both hash values match exactly, SBI confirms the transaction was genuinely sent by Alice and was not modified in transit.
5. Indian Cyber Laws & RBI Regulatory Guidelines
Information Technology (IT) Act, 2000 (Amended 2008)
- Section 43: Penalty for unauthorized access, data theft, or damaging computer systems.
- Section 66: Hacking and sending offensive communications.
- Section 66C: Punishment for identity theft (stolen passwords, stolen digital signatures).
- Section 66D: Punishment for cheating by personation using computer resources (Phishing).
- Section 71: Misrepresentation to obtain a Digital Signature Certificate from a Certifying Authority (CA).
RBI Cyber Security Framework for Banks
- Mandatory 24/7 Security Operations Centre (SOC).
- Implementation of Multi-Factor Authentication (MFA / 2FA) for all electronic payments.
- Mandatory reporting of any cyber security incident to RBI within 2 to 6 hours.
- Periodic Vulnerability Assessment and Penetration Testing (VAPT) audits.
Exam Strategies & Common Traps
- Phishing vs. Pharming Trap: Phishing relies on social engineering links in emails/SMS. Pharming manipulates DNS IP resolution to redirect valid web browser traffic automatically.
- Encryption Key Usage: Remember: To encrypt a message for Bob, Alice uses Bob's Public Key. To digitally sign a message, Alice uses Alice's Private Key.
- Virus vs. Worm Dependency: Viruses require a host file and human action to trigger execution. Worms are standalone and self-propagate across networks automatically.
Test Your Knowledge
Which specific cyber attack vector manipulates DNS server resolution records or local host files to silently redirect a user browsing to a legitimate banking URL towards a malicious spoofed website?
A
B
C
D
Test Your Knowledge
In a Public Key Infrastructure (PKI) system, which key does a bank customer use to create a valid Digital Signature on an electronic fund transfer request?
A
B
C
D
Test Your Knowledge
Which legal section of India's Information Technology Act 2000 (Amended 2008) explicitly prescribes punishment for cheating by personation using computer resources (such as phishing scams)?
A
B
C
D
Test Your Knowledge
Which category of malicious software is standalone (does not require a host file) and self-propagates automatically across computer networks by exploiting system vulnerabilities?
A
B
C
D