Cyber Security Challenges In The Banking Sector
Author: LawSphereX
Category: Technology, Cyber & Privacy
Published:
Updated:
CYBER SECURITY
CHALLENGES
IN THE BANKING SECTOR Dr Gyanendra M Fulzalke, Associate Professor, Research Supervisor, Shri Shivaji Law College, Parbhani Aarti Banthia, Research Scholar, Shri Shivaji Law College, Parbhani
ABSTRACT
India is globalizing its economy, and information services and technology have a profound effect on the country's economy, trade, and commerce. With the advancement in technology, banking is increasing its scope of work and use of technology for developing its business with various online facilities. Banks are an industry that uses information technology (IT) in daily tasks to meet the needs of organizations and customers. This is a task where commercial transactions, remittances, automatic counter, credit cards, and loan are executed every day. Personal information of customers held by the bank is also considered confidential and should not be disclosed to anyone without authorization. This article focuses on how the bank's legal staff and legal clients can perform all tasks.
So, the bank has its system that ensures that transactions are carried out as they are and prevents any activity that may cause losses to the organization and its customers. Whether you like it or not, there are always irresponsible people who question the integrity of the banking system. Even an amateur who claimed themselves as a hacker could transfer a sum of money from another account to his or her account without notice. Bank account hacking has caused millions of losses around the world. In this article, I will address the issue of intrusion into banking systems. It is important to understand how the security aspects of the banking system affect such illegal activities and how they can cause huge losses for financial institutions. Keywords: Banking Industry, cyber crimes, cyber security
INTRODUCTION
Cyber security's future is staying one step ahead of the threat. The digital landscape in India has undergone an unbelievable transformation in a short span of time, but cyber security is also a great threat, it changes so many things drastically and one of the most important is the banking sector. The banking industry a cornerstone of Global financial stability has always been a prime target for cybercriminals with the rapid adoption of digital technologies, financial institutions face an ever-growing array of cybersecurity challenges. Cyber security in banks has become the frontline defence against an overgrowing home of digital threats. CONCEPT OF CYBER SECURITY Cyber security in banks is about digital security to the entire digital infrastructure of a bank from the online banking system to the internal database against any unethical or unauthorized access.
Security refers to protection against unauthorized disclosure modification or distraction of data in a system and also to the safeguarding of the system themselves. Security, safety, and reliability together are elements of system trustworthiness- which inspires the confidence that a system will do it is expected to do. 1 Security is for the protection of important data of system. Its important role is to maintain Confidentiality, Integrity and Availability which is very important for authorized users. These three measures are very necessary for data protection between banks and customers. It develops the trust of customer on their Banks and feel secure about their accounts in the Banks.
Information Technology Act 2008: Cyber Security 2(1) (nb): A legal framework defining "cyber security" means protecting information, equipment, devices, computers, computer resources, communication devices, and the information stored therein from unauthorized access, use, disclosure, disruption, modification, or destruction.
1 Paul Augustine Cyber Security. Pg. no. 12.
The definition reflects a delicate balance, aiming to ensure comprehensive security for information, systems (including equipment, devices, computers, and communication devices), and networks (in the form of computer resources) and provide safeguards to important information. It aligns with the principles of the CIA tried from computer science, incorporating confidentiality to guard against unauthorized information access, integrity to protect against unauthorized data modification, and availability to ensure uninterrupted access without disruption or destruction. The National Cyber Security Policy (NCSP) of 2013 envisages a multipronged strategy to "Ensure the safeguarding of both information and information infrastructure, mitigate vulnerabilities, develop capabilities for the prevention and response to cyber threats, and minimize the impact of cyber incidents".
NEED OF CYBER SECURITY IN BANKS Banks are some of the most vulnerable institutions, it comes to cyber threats. Banks store vast amounts of sensitive information or data of customers including personal information, financial records, and transaction history. This makes them a lucrative target for hackers seeking to steal data for financial gain or identity theft. Attackers misuse the data of the customers of the banks and do cyber attacks on them. Nowadays high-profile breaches in highlighted vulnerabilities in data storage and transmission, raising concern about the sector's ability to protect customer's information. Cyber Security in banks involves measures to protect computer assets, information, and networks from unauthorized users and preparedness to business continuity and Disaster Recovery.
It encompasses Information Security, Application Security Network Security, and Disaster Recovery. 2 There is a need to use improved security measures for the protection of data and control the cybercrime. As banks have opened up their digital platforms to consumers in the name of digitization, cyber security has become increasingly important and necessary for the protection of customers in the banks for peer competition, customer satisfaction, and transaction cost reduction large volumes of private information are stored in the bank's data centres and move through its servers, networks, and other devices.
2 Burra Butchi Babu, Cyber Security in Banks, bank quest- jan-mar2018
As Cyber-attacks are carried out continuously on various organizations, banks have become one of the favourite destinations, for such attacks it is very easy for attackers. The volume and sophistication of cyber-attacks is ever increasing and evolving. Innovation, sophistication, organization of Cyber Criminals are producing ominous results for banks. This has led to cyber security rising to the top agenda for banks' top management. Emerging trends of cyber crime in financial sectors are increasing drastically, At that time it is necessary need to improve and take support of security measures from cyber crimes. Every bank must have a cyber security policy and a cyber security framework in order to safeguard its IT systems, customers and bank's confidential data, whether it is in transit or at rest, and to guarantee business continuity.
It's important for banks to give security for different purposes which are explained as follows: Data protection of customers: The first most important purpose is the protection of customers from any malicious attacks on their data, privacy, and information. Customer trust: Cyber security in banks is very important for the customer's trust in banks, they provide so many facilities to the customers so it is the responsibility of banks is to maintain and protect from cyber-attacks which are increasing tremendously. Compliance with regulation: It is the responsibility of banks complete the compliance of rules of RBI for banks and different regulation of various laws, for the protection of customer, and helping in combating cyber crimes which drastically increasing day to day. It's important to regulate the provisions time to time and apply it.
Preventing financial loss: Financial losses are increasing so much that it's necessary to give cyber security to the customers from these losses, they are not known of the consequences of their simple mistakes at that time cyber security is alerted and prevents them from financial loss. Ensuring business continuity: Security protects banks and their customers and provides continuity in their business, because cyber frauds are increasing every day that time with the use of different measures we can protect and ensure continuity for their daily work and their business. CYBER THREAT IN BANKS Phishing Attacks: Phishing is a very serious type of offence which used by criminal, it attempts aim to obtain user passwords, credit card numbers, and PINs through phishing attack in order to gain access to the victim's bank account or take over social media network data.
Malware & Ransomware: It is among the most well-known online dangers. This kind of malicious software is intended to prevent access to a computer or collection of computers unless a certain amount of money is paid. They threaten to reveal private information until the attackers receive payment. One typical kind of ransomware attack is a maze. Insider Threats: It is a malevolent danger that arises from individuals, or workers within an organization, leaving the system vulnerable to hackers. ATM/Debit/Credit Card Frauds: In these types of frauds, the perpetrator usually utilizes a skimming device that is hidden from view and attached to the keypad of an ATM or POS system. When a customer inputs his card number and PIN, information is sent to an embedded skimmer that might be used to steal money.
Denial of Service Attacks: Attacks known as denial of service (DOS) cause the network or services to go offline, preventing affected users from accessing the services. This is achieved by delivering an excessive volume of data, which spams users' network traffic and prevents authorized users from accessing the information. Large profit organizations are the target of DDOS attacks. Even though this kind of assault doesn't result in the loss or theft of important data, mitigating the damage takes a lot of money and time Advanced Persistent Threats: The term 'Advanced Persistent Threat' was originally intended to describe malicious, organized, and highly sophisticated cyber campaigns where the strategic objectives came from an external backing entity.
However, our review of the literature shows that information security researchers and industry professionals tend to use the term APT more broadly to address malicious, organized, and highly sophisticated cyber campaigns in general. 3 Identity Theft: In identity theft skimmers take all the information of the victim and theft their identity. Phishing attempts seek to steal credit card information, PINs, and user passwords to take over social network data or access the victim's bank account. Virus and Trojans: Viruses are nothing more than the cost of malevolent algorithms that can proliferate without human assistance, much like human viruses. A Trojan virus is a malicious program that, in contrast to other viruses, spreads quickly instead of replicating itself. By opening the attachments in spam emails, you can activate these.
Hacking: Hacking is the accessing of a computer system without the express or implied permission of the owner of that computer system. It is merely a human trait that is triggered and inherent to our being. It is a pre-planned process, where first a target is identified; its security features are studied tools are developed to gain unauthorized access. 3 Atif Ahmad, (2019) Strategically-Motivated Advanced Persistent Threat: Definition, Process, Tactics and a Disinformation Model of Counterattack
CYBER SECURITY
CHALLENGES
One of the biggest challenges in the world of technology and artificial intelligence is keeping data secure because AI provides multiple ways to commit crimes and security measures are sometimes insufficient to maintain it.
1 Absence of an architectural framework
A specific architectural framework for protection against cybercrime in advanced technology is lacking, as the methods employed by cybercriminals evolve rapidly, often outpacing the implementation of new security measures.
2 Lack of Awareness
One of the most significant challenges is the general lack of awareness among individuals. Although various security measures exist for protection, many people remain uninformed about the advancements in technology and inadvertently engage in different forms of cybercrime.
3 Insufficient Training
Individuals across various sectors, as well as general internet users, often lack adequate training and a comprehensive understanding of the advantages and disadvantages associated with cyber activities. While they utilize devices, their training is frequently insufficient.
4 Rapid Technological Advancements
Technology is continuously evolving, presenting new vulnerabilities that complicate security efforts at multiple levels. Despite ongoing attempts to keep pace with these changes, effectively managing security remains a formidable challenge.
5 Emergence of New Cybercrime Trends
New trends in cybercrime are emerging on a daily basis. While security measures are implemented to combat existing threats, cybercriminals are quick to develop innovative methods of perpetrating crimes within the industry.
6 Implementation of Legal Frameworks
Various laws have been established to serve as security measures against cybercrime; however, enforcing these laws poses significant challenges. Questions often arise regarding the appropriate application of these provisions, as well as their legal and ethical implications.
CYBER SECURITY
CHALLENGES
IN THE BANKS Banks face a wide range of cyber security threats, including different crimes phishing attacks, ransomware, insider threats, and financial frauds. To mitigate these risks, they need a multilayered cyber security approach. Following are key cyber security solutions for banks
1 Multi-Factor Authentication
Banks add an extra layer of security for customer logins and employee access for protection from different cyber crimes. Provide role- based access to employees for access information of customers. Use Fingerprints, facial recognition, passwords, and two-step verification for protection and to verify identity.
2 End-to-end Encryption
Data encryption ensures that even if cybercriminals intercept sensitive data, they cannot read or use it. Banks must use strong encryption methods for data at rest and in transit.
3. AI-Powered Threat Detection
It's very challenging in the age of Artificial intelligence (AI). It can help to detect and respond to threats in real time by analysing vast amounts of data for abnormal patterns. AI is particularly effective at mitigating phishing and fraud attacks. Both defenders and attackers are leveraging artificial intelligence (AI) and machine learning (ML) technologies. AI is used for threat detection, while attackers may use AI to automate and enhance their attacks.
4. Zero Trust Architecture
The Zero Trust model assumes that all users, devices, and networks are inherently untrustworthy. Banks can prevent unauthorized access and data breaches by requiring verification at every stage. To implement such a model effectively, having a strong network security architecture is crucial, ensuring that every access point and connection within the system is secure.
5. Security Incident and Event Management (SIEM) Systems
SIEM systems gather and analyse security data from multiple sources to provide real-time alerts on potential threats. This enables quicker response times and minimizes damage from cyber attacks.
CURRENT SECURITY MODELS
The models currently adopted in online banking systems are based on several security layers, consisting of diverse parallel solutions and mechanisms that aim at protecting the banking application and the user's data, providing identification, authentication, and authorization to the customers. Digital Certificates: The banking system itself and its users are authenticated using digital certificates. A Public Key Infrastructure (PKI) and a Certificate Authority (CA), which stands for a reliable third party and signs the certificates attesting to their validity, are necessary for this type of authentication. One-Time Password Tokens: Often employed as a second authentication factor, one-time password devices can be requested in certain or arbitrary circumstances.
These devices use dynamically changing passwords that are only valid once, making the collected authentication data useless for subsequent attempts. One-Time Password Cards: This relatively inexpensive technique for creating dynamic passwords also provides a second authentication factor. However, in some banking systems, passwords generated by OTP cards are reused a number of times before being discarded, rendering this system vulnerable to shortterm replay attacks. Browser protection: The system is protected at the level of the Internet browser, which is used to access the banking system, according to this concept. By keeping an eye on the memory space allotted by the browser to identify known malware, prevent credential theft, and prevent sensitive data from being captured, the user and his browser are protected against known malware.
Virtual Keyboards: These were created to prevent the effective use of key loggers, which record data entered into the device. Typically, these gadgets are built on Java and software-based cryptography, which enables device mobility. They are currently being supplanted by more effective techniques that use slower transmission rates and less processing power. CAPTCHA: The goal of the recently implemented CAPTCHA (Completely Automated Public Turing test to Tell Computers and Humans Apart) technique in certain banking systems is to make automated attacks against authenticated sessions ineffective. This approach necessitates that the authorized user provide data in the form of jumbled graphics, which are challenging for automated robots to comprehend and identify.
SMS: Some financial systems have implemented the Short Message Service (SMS) to alert consumers about transactions that need their consent. By providing the user with a set of characters that they must submit to authorize and complete the transaction through the online banking system, it offers a second authentication channel for transactions that meet specific criteria. Device Identification: In online banking systems designed to make user access easier, device identification is utilized as a stand-alone solution as well as in conjunction with device registration. The physical attributes of the user's device, which allow for the identification of its origin and historical data, constitute the basis of this identification model. Positive Identification: In this model, the user must enter some confidential information that only he knows in order to be recognized.
It is used as a backup authentication technique. Pass-Phrase: This security mechanism is based on user-held data. It is typically employed as a backup authentication technique in financial transactions.
Transaction Monitoring: All online banking systems currently use this technology, albeit with varying approaches, even though it is not fully examined in this article. Among the many strategies for transaction monitoring are artificial intelligence, transaction history analysis, and other techniques that spot fraud trends in previously completed transactions. Above all are the different security measures that are currently used for the purpose of security and protection of customers in banks. Relevant cases: Following are the different cases explained HDFC Bank Ltd. v. Nikhil Kothari (2020)4 In this case, HDFC Bank faced significant legal action due to inadequate security measures that led to a customer’s financial loss resulting from unauthorised access to their account.
The court held HDFC Bank liable under Section 43A of the IT Act for failing to implement reasonable security practices. The bank was directed to compensate the affected customer for the incurred losses, exemplifying the judiciary’s role in enforcing cybersecurity obligations and ensuring organisations maintain robust security practices. Amit Jani v. State of Maharashtra (2018)5 This case involved the unauthorised disclosure of sensitive personal information, constituting a breach of confidentiality under Section 72A of the IT Act. The court emphasised the criminal penalties for such violations, including imprisonment for up to three years, fines of up to Rs 5 lakh, or both. This ruling reinforced the legal consequences of failing to protect personal data and highlighted the importance of adhering to confidentiality obligations. ICICI Bank Ltd. v.
Reserve Bank of India (2019)6 ICICI Bank was subject to regulatory scrutiny for non-compliance with the RBI’s cybersecurity 4 Cybersecurity Laws and Regulations India 2025, ICLG - Cybersecurity Laws and Regulations - 06/11/2024 5ibid
6 Ibid
guidelines. The court upheld the RBI’s authority to impose penalties for such breaches, reinforcing the importance of following the RBI Cyber Security Framework. This case highlighted the enforcement of sector-specific regulations and the critical need for financial institutions to adhere to prescribed cybersecurity standards. Conclusion: The Indian cyber security landscape must evolve and demonstrate resilience against sophisticated, future-oriented cyber threats and attacks. This necessitates a comprehensive approach encompassing the establishment of robust security standards, effective implementation of modern technologies, the formulation of sound security policies, the enactment of stringent legal rules, and fostering collaboration among all stakeholders while avoiding rigid distinctions between the public and private sectors.
Recognizing that governments and industries alone cannot address all cyber security risks, individual citizens must proactively take measures to protect themselves. There is a need to set new regulations for online transactions to satisfy the customer and ensure security. The banking industry must focus on managing the existing risks of recovery by following international regulations to compete in the global market. In today's world of WiFi hotspots provided at all kinds of shops, then hackers can gain access to our accounts very easily. Browsing the web is fine, but don't enter personal details like our bank account login or even email password while on a publicly-accessed connection. Use stringent security measures for protection from cyber crimes.
References:
1 Cybersecurity
Threats and Challenges (Dr. C. Yogalakshmi & Ms. K. Suganya eds., Apr. 2022).
2. Liaqat Ali, Faisal Ali, Priyanka Surendran & Bindhya, The Effects of Cyber Threats on
Customer’s Behaviour in e-Banking Services, [International Journal of e-Education e- Business e-Management and e-Learning] (2017)pg no 71-78
3. Divya Rogatgi, Cyber Law & Cyber Crimes (Whytes & Co. 2022).
4 Adarsh Mundhra, Impact of Cyber-Attacks on Banking Institutions in India
A Study of Safety Mechanisms and Preventive Measures, [Journal Name] E-ISSN: 2581-9402, at 142-148 ([Year]).
5 Subudh K. Keshrwani, Madhulika P. Sarkar & Shelly Oberoi, Cyber Security in India
Threats and Challenges (2019).
6. Yougal Joshi & Anand Singh, A Study on Cyber Crime and Security Scenario in India
(2013).
7. N. Saravade & Bhalla, Emerging Trends and Challenges in Cyber Security, Reserve
Bank Information Technology Private Limited (ReBIT) (2018), https://rebit.org.in/whitepaper/emerging-trends-and-challenges-cyber-security
8. Atif Ahmad, Jeb Webb, Kevin C. Desouza & James Boorman, Strategically-Motivated
Advanced Persistent Threat: Definition, Process, Tactics and a Disinformation Model of Counterattack, [Computers & Security] [ (July 2019)]
9. Talat Fatima, Cyber Crimes (Eastern Book Company 2016).
10. Balaraj D. B. and Pradeepa Shetty Cyber Literacy of Bank Customers - A Study in
Udupi and D.K District (2019).
11. V Vimala. An evaluative study on internet banking security among selected Indian bank
customers, Amity Journal of Management Research, 1(1), (2016).