Cyber-security systems of banks seen not failsafe

A record number of public and private banks in Bangladesh are currently under unprecedented cyberattacks largely because of their indifference and fragile cybersecurity systems, prompting experts to propose immediate action, sources said.

Advocacy groups and experts say that a large percentage of banks are not taking sufficient precautions to ward off the potential large-scale, dangerous attacks and avert major financial losses they believe are imminent.

The malicious actors behind such a cross-border invasion include not only increasingly daring criminals—like the Carbanak group, which targeted financial institutions to steal more than $1.0 billion in 2013-18—but also states and state-sponsored criminal gangs a 2021 report published by the International Monetary Fund (IMF).

The country has yet to quantify its financial losses from cybercrime – the most outrageous being the theft of its reserves from the US Federal Reserve by an international cybercrime gang.

In early June 2022, the Bangladesh Institute of Bank Management (BIBM) conducted a study based on the situation of the banking sector in 2020, which found that almost 52 percent of banks are at serious risk of cyber attacks.

In April 2020, the Financial Stability Board (FSB) warned that “if not properly contained, a major cyber incident could seriously disrupt financial systems, including critical financial infrastructure, which could lead to wider financial stability implications”.

On March 3, 2016, Bangladesh Bank (BB) released a policy urging banks to upgrade their cybersecurity capabilities following the bank’s unprecedented orchestrated reserve robbery.

The regulator had also instructed them to form a Security Operation Center (SOC) to oversee security measures around the clock.

But most banks have yet to install SOCs, sources added, leaving such vigilance a long way off.

Faced with this phenomenon, experts also called for increased measures by regulators to strengthen the weak cybersecurity scenario in Bangladesh’s banking sector, emphasizing the need for banks to build the capacity of their staff and improve security shield logistical support.

Bangladesh state-run e-government Computer Incident Response Team (BGD e-Gov CIRT) terminated these financial institutions (FIs), especially banks, which are the most desirable target of cybercriminals Banks have only recently been hit by major cyber-attacks.

The report, titled “Sectoral Cyber ​​Threat Intelligence for Banking Industries,” also found that most users of banking applications and portals (both internal and external) were not properly aware of cyber hygiene.

The investigation also found that insecure use and/or access to internal applications/portals by employees’ mobile devices may increase the risk of disclosure of critical corporate assets.

In 75 percent of cases, credential theft is possible due to insecure use of mobile or computing devices, they say.

Another report titled Common Vulnerabilities in Cyber ​​Space of Bangladesh states that the vulnerability of cyberspace in the country is increasing day by day.

“To mitigate the impact, new technologies and services need to be introduced to cope with the situation and competition,” it adds.

Almost 70 percent of attacks on FI firms were aimed at banks, according to research by IBM X-Force, adding that in 2021 about 16 percent targeted insurance companies and 14 percent other financial institutions.

The intelligence unit of the BGD e-GOV CIRT has also found that managed applications/devices from vendors have a major impact on organizations’ assets.

It was also noted that strong password policy enforcement was lacking in many banking applications and portals.

Speaking to the FE, Tarique M. Barkatullah, BCC director (data center), said almost all banks were running one or more vulnerable services and weak authentication systems that could lead to potential cyberattacks.

“The worst thing is that these risky services can be identified with simple reconnaissance techniques by online threat actors,” he lamented.

In addition, it also identifies different types of applications, devices and other assets on the internet running risky services, he says, citing the report.

Routers top the list for lagging behind in the security hardening required, he warns.

In February 2020, Christine Lagarde, President of the European Central Bank and former head of the IMF, warned that a cyber attack could trigger a severe financial crisis, the IMF report said.

Cybersecurity expert Tanvir Hassan Zoha suggests installing ISO 27001 and Payment Card Industry Data Security Standard (PCI DSS) to thwart rampant cyber threats.

Both ISO 27001 and PCI DSS help organizations manage and protect their information assets to keep them safe and secure.

“A large percentage of banks are not currently using these tools to ensure their information security,” Zoha, who is also a managing director of Backdoor Private Limited, told The Financial Express.

Tanvir says the central bank’s role is key to building a strong ecosystem of banks, saying “if the BB’s instructions are not followed, the banks should cease operations.”

dr Md Mahbubul Alam Joarder, Professor at the Institute of Information Technology, Dhaka University, believes that every bank should set up a fully professional response team like the BGD e-Gov CIRT to forestall all kinds of threats.

“If it happens regularly, the banking system could face a dangerous and serious situation in the coming days,” he warns.

The BB must take steps and measures to properly implement its policies to minimize the likely risk, explained Dr. mahbub

“All stakeholders concerned, including regulators, must understand and identify the existing problem and seek a sustainable solution in the greater interest of the important banking sector,” he added.

On September 13, 2020, Bangladesh Bank issued an alert about a likely hacking attempt on the country’s ATM network.

The report also urged banks to establish and maintain an organization-based, dedicated Cyber ​​Security Operation Center (Cyber ​​SOC) to improve overall security operations.

Tarique also emphasized the need for ongoing collaboration, collaboration, and threat intelligence sharing between the community, law enforcement organizations, and government agencies to combat cyber threats collectively and in an organized manner.

Omar Faruk Khondaker, former chief technology officer at Sonali Bank, suggests developing a well-developed surveillance system, as most banks have yet to build it properly.

“Based on that, every bank should create a well-prepared action plan,” he says.

The BGD e-GOV CIRT report recommends banks to be cautious when it comes to unwanted disclosure of all ad hoc and core applications and services.

Jamuna Bank ICT Chief Syeed Zahid Hossain says the BB should create new and timely policies based on the incessant and widespread cyber threat to FIs including banks.

“Nevertheless, he has not noticed any action by the central bank against banks with weak security systems,” adds Mr. Hossain.

However, the BB occasionally arranged some training programs to curb the attacks, he noted.

[email protected]