IS Policy ppt

Information Security Policy

Introduction

ØCyber security vs Information Security

ØWhich model of information security are we moving towards?

ØBasic tenets

ØWho is it applicable to?

ØWho is the owner of the document and who can give exceptions?

Multiple Choice

What is the difference between Cyber security and Information security?

• Cyber security focuses on protecting computer systems and networks from unauthorized access and attacks, while information security encompasses the protection of all types of information, whether it is stored electronically or on paper.

• Cyber security and information security are two terms that are used interchangeably and refer to the same concept of safeguarding digital assets.

• Cyber security is concerned with securing information from external threats, such as hackers and malware, whereas information security focuses on protecting data from internal threats, such as unauthorized access by employees.

• Cyber security deals with the protection of data in transit over the internet, while information security involves safeguarding data at rest, regardless of the medium in which it is stored.

Multiple Choice

Which of the following is a security framework requiring all users, whether in or outside the organization’s network, to be authenticated, authorized, and continuously validated for security configuration and posture before being granted or keeping access to applications and data

• Castle-and-moat Architecture

• Zero Trust Architecture

• Null Point Architecture

• Least Privilege Architecture

Multiple Choice

The basic tenets of Cyber Security/Information security of any Organization comprises of

• Confidentiality, Information Security & Authenticity

• Confidentiality, Integrity & Availability

• Confidentiality & Information Security

• Confidentiality, Integrity & Authenticity of Information

Multiple Choice

What does 'integrity of data' mean in CIA Triad?

• Accuracy and completeness of the data

• Data should be viewable at all times

• Data should be access by only the right people

• All of the above

Multiple Choice

_____ means that data or information in Organization's systems is maintained so that it is not modified or deleted by unauthorized parties.

• Integrity

• Confidentiality

• Authenticity

• Information Security

Multiple Choice

Information Security policy of the Bank is applicable to

• Serving Employees

• Third Party Employees

• Retired Employees

• All of the above

Multiple Choice

Which of the following is the owner of IS Policy Document of the Bank?

• CGM-IC DIT, CO

• Chief Information Security Officer

• ED In charge of DIT

• IT Sub Committee of the Bank

Objectives of IS Policy

ØMeet the Confidentiality, Integrity and Availability(CIA)  of the Bank’s information assets as per the levels of requirements.

ØSecure information systems and services against cyber risks through appropriate security controls and vulnerability management programs

ØComply with legal and contractual requirements.

Øcreate adequate information security awareness among all employees

Information assets

ØApplications and IT Infrastructure, viz., data centres, wide area networks, local area networks, internet leased lines, security infrastructure, and end points that are hosted/managed/governed and are used/owned/provided by the Bank

ØAll data/information received, accessed, processed, stored, retrieved or communicated electronically in all formats including but not limited to documents, textual, numeric, audio, images and videos

Multiple Choice

Who is the Third line of Defence as per Security strategy of IS policy?

• DIT Operations Team

• RMD /CISO

• DIT, CO/Department Risk Officers

• Inspection Department

Multiple Choice

As per IS Policy of the Bank which of the following is not the essence of second line of defence associated with IT risks

• Monitor

• Assess

• Facilitate

• Examine

Information security strategy

Line of Defence	Principle Strategy	Who
First	Management Control	DIT operations teams Business Department Operations Team
Second	Monitor, Assess, Facilitate, Mitigate	RMD/ RBI CISO DIT CO/ Department Risk officers
Third	Review, Examine, Audit, Assure	Inspection department

Organisational and reporting structure

ØIT Sub Committee of the Board - primary driver for the advancements of IT systems in the Bank

ØAudit and Risk Management Sub-committee of the Board (ARMS) - deliberates on the various risks being faced by Bank, mainly pointed out by audit conducted by Inspection Department and provides necessary guidance in risk mitigation

ØRisk Monitoring Committee (RMC) - Deputy Governor in charge of Risk Monitoring Department

Organisational and reporting structure

ØInformation Security Steering Committee (ISSC): For Protected Systems - chairmanship of Executive Director of Risk Monitoring Department.

ØRegional Office Security Group (RSG)/ Central Office Department Security Group (CODSG)  -  smooth implementation of the IS policy across ROs and CODs respectively

Access control

nAccess to information and information systems shall be granted on a need-to have basis only

nMaintain logs and review to detect unauthorized access

nUser access provisioning - formal user registration and deregistration procedure

Access control

nReview of user access rights – at least quarterly

nManagement of generic user accounts - Appropriate procedure shall be implemented for using generic user accounts to implement the operational or functional requirements in a safe and accountable manner

Access control

nManagement of secret authentication information of users - passwords, user ids, pins, OTPs shall be generated, stored, transmitted and used in safe and appropriate manner, use best practices

nContent management and security - content-checking mechanism needed – eg ekp

nSecure log-on procedures - VPN shall be established for remote access, prudent practices by employees for passwords, user ids, secret keys and other access tokens

Multiple Choice

Unauthorized disclosure of such information could adversely impact the reputation of the organisation and country? Which classified information asset is in question?

• Secret

• Confidential

• Internal

• Public

Multiple Choice

Sensitive information of the Bank’s employees, systems and activities which the Bank is obliged to protect under laws and regulations. Unauthorized disclosure of such information could lead to misuse by malicious actors consequently impacting the business operations or IT systems and the reputation of the organisation. Which classified information asset is in question?

• Secret

• Confidential

• Internal

• Public

Information security assets

ØAssets: Information assets; Physical Assets and Technology Infrastructure

ØInformation assets include Business documents, applications, infrastructure components, services and systems

ØClassification: Based on criticality and sensitivity

ØInformation Classification: Secret, Confidential, Internal and Public

Multiple Choice

The minimum level of encryption mandated for wireless communication between bank’s network and wireless client is

• Wi-Fi Protected Access 3

• Wi-Fi Protected Access 2

• Wi-Fi Protected Access

• Wired Equivalent Privacy

Multiple Choice

As per IS policy of the Bank, storage of sensitive official information is permitted in the following:

• Google Drive

• icloud

• Onedrive

• None of the above

Multiple Choice

Which of the following procedures not useful for preventing brute force attack of hacking passwords?

• Set a Lengthy Password

• Set a High Complexity Password

• Set a Limit for Login Failures

• None of these

Multiple Choice

Usage of same passwords by many users of an organization like Feb@2023, Jan@2023 etc., may give scope to a hacker by using single common password against multiple accounts for gaining access. This cyber-attack is known as

• Brute Force Attack

• Password Sprinkling

• Password Spraying

• Credential spraying

Multiple Choice

Who shall be responsible for ensuring that only the software authorized by DIT, CO are installed on bank’s systems?

• Bank’s employee and non-employee users

• DIT cell of an RO

• System administrators

• DIT, CO

Multiple Choice

Consider the four statements

i) Bank reserves the right to monitor and analyse the browsing behavior of the employees.

ii)Users shall be responsible for aspects impacting availability and integrity like mailbox housekeeping, personal usage, and official usage etiquette as per guidelines.

iii)Email communication may be used only for non-official purposes with necessary approvals.

iv)Private communication services shall not be used for transmitting any official message, information, or data.

Which of the following statements are correct?

• I, ii, iii

• I, ii, iv

• I, ii, iii, iv

• i, IV only

Multiple Choice

What should be done in case of Loss of Laptop and other moveable information assets and systems including but not limited to mobile devices (owned by the Bank)?

• No need to report since asset not a PC and not connected to LAN network

• Report to the bank

• File FIR

• Report to bank and File FIR

Multiple Choice

Who has the duty to report suspected, actual or near miss information security incidents to appropriate authorities?

• Bank’s Security Operations Centres

• All employees of the Bank, third party suppliers/vendors

• DIT Cell of RO

• System Administrators

Multiple Choice

As per IS policy, any violation of information security policies and procedures by employees will be dealt in accordance with?

• Reserve Bank of India (Staff) Regulations, 1948 and any other extant rules and procedures as made effective by the Bank

• Information Technology Act, 2000

• Indian Penal Code (IPC)

• None of the above

Operations Security

nUse of open-source software - may be considered without compromising on the information security aspects in consultation with DIT, CO

nSoftware installation by end-user  - 10.13 - Bank’s employee and non-employee users shall be responsible for ensuring that only the software authorized by DIT, CO are installed on their systems

Operations security

nVulnerability management - periodic threat analysis and reports by CISO office

nAnti-virus – put to use only after installation, keep it updated

nBusiness Continuity – RTO and RPO

Operations security

nRTO: Recovery Time Objective - duration of time in which a business process must be restored after a disaster in order to avoid unacceptable consequences associated with a break in business continuity.

nRPO is Recovery Point Objective - often defined as the maximum targeted period in which data might be lost from a disaster. How frequently you take backups

Operations security

nSystem Administrator - application and network administration roles, wherever required, with the specific documented approval of HOD/RD, after considering the risks and role-conflict involved

Cryptography

nCryptographic controls – using digital signatures, SSL certificates, authentication tokens, dual factor authentication, document and system encryption

nSecure key management - key generation, distribution, revocation and storage

nPhysical security of the endpoint computing equipment - 12.11 - Loss of Laptop and other moveable information assets and systems including but not limited to mobile devices (owned by the Bank) should be reported immediately to the Bank, File FIR

Network and communication security

n13.12- Utilise the network and system facilities for official purpose only.

n13.13- Connectivity of desktops, laptops etc. to unauthorised/private networks is not permitted.

n13.18- Only the officially provided internet services shall be used on the internal devices

Network and communication policy

n13.19- Storage of sensitive official information in private/free cloud facilities is not permitted.

n13.22- Posting of content on social media platforms on behalf of the Bank is permitted only after proper approvals.

n13.28- All official electronic communication with internal and external parties will be done through official channels.

Network and communication policy

n13.29- Email communication should be used only for official purposes.

n13.30- Encrypt the sensitive emails and its attachments before sending it.

n13.31- Email system shall not to be used for the creation or distribution of any offensive messages.

n13.38- Access Bank’s information systems from internet only using the laptops/devices issued officially to them by the Bank.

Information security incident management

n16.04- Report suspected, actual or near miss information security incidents to appropriate authorities.

Compliance

n17.04-All staff and external vendors/contractors should comply with the Bank’s IS Policy.

n17.16- Any violation of IS policies will be dealt as per RBI (Staff) Regulations, 1948 and any other extant procedures of the Bank.

Santhosh V

"Use your password like your toothbrush. Dont give it to anyone. Keep changing it regularly" 

Poll

Did you like the session?

• Yes

• No