Fostering a security-first mindset across SBM Bank is crucial to ensuring all employees understand their role in protecting sensitive data. This commitment to cybersecurity begins at the top, with leadership setting the tone and prioritizing it shared Niju Mohan, Chief Information Security Officer, SBM Bank India in an exclusive interaction with Srajan Agarwal of Elets News Network (ENN).
Financial institutions face increasing challenges from ransomware, phishing, and other sophisticated attacks. How is SBM Bank adapting its cybersecurity strategy to stay ahead of these evolving threats?
To address the growing challenges posed by ransomware, phishing, and other sophisticated attacks, we have integrated several key preventive and detective technologies into our cybersecurity strategy, which is based on the NIST framework.
Our approach includes Enhanced Threat Intelligence to identify emerging threats and monitor dark web activities. We have deployed Advanced Security Technologies such as Network Behavior Anomaly Detection (NBAD), Network Access Control (NAC), Endpoint Detection and Response (EDRs), alongside traditional firewalls and antivirus solutions. These technologies leverage artificial intelligence and machine learning to detect and respond to threats in real-time and recognize unusual patterns of behavior that may signal a security breach.
We are also in the process of implementing Multi-Factor Authentication (MFA) across the board and have established a robust Incident Response Plan that undergoes regular testing. Additionally, we conduct regular security audits and employ a proactive red team to identify and address potential weaknesses.
Apart from these strategies, employee training and awareness are crucial for educating staff about the latest phishing tactics and social engineering techniques, fostering a security-conscious culture within the organization. Additionally, investing in Cybersecurity Insurance helps mitigate potential financial losses from cyber incidents in the event of a breach.
By focusing on these approaches, SBM Bank aims to stay ahead of evolving cybersecurity threats and safeguard our assets, customers, and reputation.
How does SBM Bank cultivate a security-first mindset across the organization, ensuring employees at all levels understand their role in safeguarding sensitive data?
Fostering a security-first mindset across SBM Bank is crucial to ensuring all employees understand their role in protecting sensitive data. This commitment to cybersecurity begins at the top, with leadership setting the tone and prioritizing it in strategic discussions, thereby resonating throughout the organization.
Mandatory monthly training programs for all employees and vendor staff cover essential topics such as data protection, phishing awareness, and secure handling of sensitive information. Clear communication, including a balanced approach of penalties for missed incidents and recognition of good practices, underscores the importance of cybersecurity.
Encouraging employees to report suspicious activities or potential security breaches without fear of reprisal has proven effective in preventing attacks. Integrating security into daily operational processes, ensuring strict adherence to access controls, and conducting regular security assessments, along with providing continuous and transparent access to security staff, have all contributed to building a robust security mindset at the bank.
What initiatives has SBM Bank undertaken, such as phishing simulations or awareness workshops, to minimize human errors and strengthen the overall cybersecurity posture?
To minimize human errors and bolster overall cybersecurity, the Bank conducts quarterly Phishing, Vishing, and Quishing simulations. Repeat offenders face penalties, while those who report incidents promptly are recognized and rewarded. Monthly awareness trainings and online assessments are mandatory, with penalties for non-completion affecting appraisals, whereas consistent performers are acknowledged.
Security Awareness Campaigns and newsletter for employees as well as customers which highlight current threats, security tips, and reminders about safe online behavior are circulated at regular intervals.
Periodic Incident Response Drills identify vulnerabilities and areas for improvement. Additionally, we partner with cybersecurity firms and consultants to provide specialized training sessions for senior management and workshops for board members.
By implementing these initiatives and incorporating automation where possible, the Bank has significantly reduced the likelihood of human errors and strengthened its overall cybersecurity posture.
With the growing reliance on cloud-based services, how does SBM Bank ensure robust data protection and privacy across its cloud environments and digital channels?
To ensure robust data protection and privacy across cloud environments and digital channels, SBM Bank has implemented several key measures:
-
- Data Encryption: All sensitive data is encrypted both in transit and at rest. Data masking prevents data theft from the front end.
- Access Control: Access is granted based on the need-to-know and need-to-have principles, including role-based access controls (RBAC) and the principle of least privilege. This limits access to what is necessary for job functions. Regular access reviews and assessments, both pre and post go-live, identify any gaps.
- Multi-Factor Authentication (MFA): Implemented to prevent password sharing and guessing risks.
- Regulatory Compliance: Ensuring adherence to relevant regulations and standards, such as GDPR, PCI DSS, and DPDPA, elevates the security level for PII data.
- Data Classification and Loss Prevention: Data classification and Data Loss Prevention (DLP) solutions are in place to protect sensitive data from unauthorized access, sharing, loss, or leaks.
- Vendor Risk Management: Due diligence is conducted before onboarding and continuously to ensure security standards are maintained across the ecosystem.
- Employee Training and Awareness: Regular training sessions are conducted to educate employees on securing personal information.
Monitoring and Logging: Continuous monitoring and logging enable the Bank to detect suspicious activities and respond promptly to potential threats.
By incorporating these measures, SBM Bank effectively safeguards sensitive data and ensures privacy across its cloud environment and digital channels, maintaining trust with customers and regulatory bodies alike.
Advanced fraud detection systems play a crucial role in modern banking. Can you share insights into how SBM Bank’s real-time monitoring systems efficiently identify and prevent fraudulent transactions?
The Bank has implemented an enterprise fraud monitoring system to prevent and detect potential frauds in a timely manner. All transactions are monitored in real-time, allowing the Bank to instantly assess the risk associated with each transaction. This includes analyzing factors such as transaction amount, location, frequency, and the behavior of the account holder. By establishing baseline behaviors for different categories of customers, the Bank can detect deviations from typical patterns and prevent fraud. For instance, if a customer suddenly makes a large purchase in a foreign country, the system can flag this as unusual and trigger further investigation or, in some cases, prevent the transaction altogether.
Incorporating geolocation data helps assess the legitimacy of transactions originating from high-risk countries or areas. We also liaise with external parties to cross-reference transactions against known fraud patterns, blacklists, and watchlists, helping to quickly identify suspicious activities. When a potentially fraudulent transaction is detected, the system generates alerts for fraud analysts to review, ensuring that suspicious activities are promptly investigated and necessary actions are taken. Very high-risk transactions are prevented by the system, ensuring that there is no loss to the customer.
The effectiveness of the fraud detection system is enhanced through continuous learning. Feedback from the fraud investigation team is used to refine algorithms and improve the accuracy of fraud detection over time. The Bank collaborates with law enforcement agencies and other financial institutions, participating in the country’s 1930 ecosystem to share information about emerging fraud trends and tactics, thus enhancing the overall effectiveness of fraud prevention efforts.
Looking ahead, what emerging cybersecurity trends or innovations do you believe will be critical for SBM Bank to adopt to maintain its strong security posture?
Looking ahead, several emerging cybersecurity trends and innovations will be critical for SBM Bank. Key areas to focus on include:
- Zero Trust Architecture
- Artificial Intelligence
- Extended Detection and Response (XDR)
- Secure Access Service Edge (SASE)
- Cloud Security Posture Management
- Data Security Posture Management
- Cloud Native Application Protection Platform (CNAPP)
- Runtime Application Self-Protection (RASP) across platforms
- New-age Encryption Standards
- Privacy-Enhancing Tokenization Technologies
- Passwordless Identity Solutions
- Gamification of Cyber Awarenes
Elets The Banking and Finance Post Magazine has carved out a niche for itself in the crowded market with exclusive & unique content. Get in-depth insights on trend-setting innovations & transformation in the BFSI sector. Best offers for Print + Digital issues! Subscribe here➔ www.eletsonline.com/subscription/
