Question

Assume that you have been hired by a bank to harden their defenses. The step are:

Determine the types of information a bank has that needs to be protected.

Rank the types of information that you have identified from most to least critical and briefly state why they received that ranking.

What would you suggest to the bank as ways to protect the online information or mitigate the damage if the information is compromised?

What would you suggest to the bank as ways to protect against physical intrusion by robbers or people trying to compromise computer systems?

Answer 1

Answer:-

Step 1 :-

- Bank needs five types of information to protect or secure their data as follows:-

1. Authentication :-

- Authentication requires the process of identifying an individual that every transaction in the bank takes place after confirming the identity of the person initiating the transaction.

-In this, banks are also using the biometric authentication techniques to verify customers identity and their behavioral biometrics when they interact with banking systems like IVR.

- Customers also applies the online or mobile banking systems to logging into it, and it also applies to bank employees who have access to customers and bank data.

2. To Protect Infrastructure :-

- Infrastructure helps to secure that established boudaries and the database system,servers where data is stored.

- Vendors who deal with infrastructures are generally different from those who deal with applications.

- Production data is usually encrypted in any core banking system.

3. To Protect Establishing processes :-

- Bank have established many processes like KYC(Know Your Customer) for updates for customers, NDA(Non-disclosure agreement) for employees and vendors, Securing special zones within the premises and remote data centres, to ensure that security is implemented and tested.

- Global and Local regulations are also implemented and risk assessment carried out to ensure that these processes are same with the requirements.

4. Audit Trails :

- Banking systems maintain the audit trail for every event that takes place during a customers interaction with the systems.

- The history of banking transactions was always available as a statement or passbook, whether it is customer using phone or online banking, the time of the interaction is recorded along with the details of the interaction.

5. Continuous Communication :-

- Banks communicate regularly with the customers to solve their problems and also with the consumers on upgrades to systems, for new authentication procedures etc.

- Customers can also set limits and alerts based of different conditions to ensure that they are informed if any unexpected activity takes places with respect to their accounts.

Step 2 :-

- Now, we turns to the selection process for ranking of the most to least critical type of information as below

Rank 1. Authentication :-

- It is a first ranking of the most to least critical type of information, because The process of identifying an individual, usually based on a username and password.

- Banks are also using the biometric authentication techniques to verify customers identity and their behavioral biometrics when they interact with banking systems like IVR.

- So it is very secured information than others.

Rank 2. Audit Trails :-

- It is the second ranking of the most to least critical type of information, because it is the only storage of history of banking transaction which was always available as a statement or passbook.

Rank 3. To Protect Infrastructure :-

- It is the third ranking of the most to least critical type of information, because it is all about the infrastructure which including the database system, servers, where data is stored and the boundaries established to secure these.

Rank 4. To Protect Processes :-

- It is the Fourth ranking of the most to least critical type of information, because it is all about the banking process, they have established many processes like KYC(Know Your Customer) for updates for customers, NDA(Non-disclosure agreement) for employees and vendors, Securing special zones within the premises and remote data centres, to ensure that security is implemented and tested.

Rank 5. Continuous Communication :-

- It is the Fifth ranking of the most to least critical type of information, because Banks communicate regularly with the customers to solve their problems and also with the consumers on upgrades to systems, for new authentication procedures etc.

- Customers can also set limits and alerts based of different conditions to ensure that they are informed if any unexpected activity takes places with respect to their accounts.

Step 3 :-

- I suggest to the bank for online information should be Use only secure internet connection, Enable two factor authentication, Avoid using automatic login, Dont open any suspicious emails, Create a strong password, Use only official banking applications or software, Use antimalware software, Most important use bank in sites with https in the address, Update your computer and mobile device, Keep an eye on your monthly bank statements etc.

Step 4 :-

- I suggest to the bank for protection against physical intrusion by robbers would be locks and cameras and alarm buzzers are working, network scans and patch checks, rogue software that employees may have downloaded, mostly the level of automation and technology available etc.

- if all things are working then be fearless, be calm and dont fight against them whether it is not right time for action, dont use any weapons, dont chase the robbers, just need to observe the person involved for the purpose of describing clothing and physical features and observe the person means of escape, direction of travel and description of vehicle.

- Then call the police and tell them you observation of all those things and protect the crime scene until the investigation complete.