Cybersecurity in financial systems

Every financial system that digitises creates a digital attack surface. As India's financial sector has moved online, UPI transactions, digital lending, mobile banking, insurance apps, market trading platforms, it has simultaneously become more efficient and more vulnerable to cyber threats. A successful attack on a bank's core banking system, a payment network, or a stock exchange can cause immediate financial losses, erode customer trust, and create systemic risk.

Cybersecurity in financial systems is not just an IT problem, it's a business risk, a regulatory compliance requirement, and increasingly a factor in investment due diligence. RBI, SEBI, and IRDAI all have cybersecurity circulars and frameworks that regulated entities must comply with.

For analysts, understanding cybersecurity risk helps in assessing a financial institution's operational risk, management quality, and regulatory compliance, all material factors in valuation.

Key cyber threats to financial systems:

• Phishing: Fraudulent communications trick employees or customers into revealing credentials
• Ransomware: Malware encrypts systems; attackers demand ransom for decryption key. Several Indian banks and NBFCs have faced ransomware incidents.
• API attacks: Financial services increasingly use APIs for third-party integration. Poorly secured APIs are a major attack vector.
• Insider threats: Employees or contractors with access misuse or leak data
• Business Email Compromise (BEC): Attackers impersonate executives to authorise fraudulent payments
• DDoS (Distributed Denial of Service): Overwhelm servers to disrupt availability, payment systems and exchanges are targets

Regulatory frameworks in India:

• RBI Cybersecurity Framework (2016, updated 2023): Mandatory for scheduled commercial banks. Requires SOC (Security Operations Centre), cyber incident reporting, IS audit, and cyber risk assessment.
• SEBI Cybersecurity Framework (2023): Applies to stock exchanges, depositories, clearing corporations, and market intermediaries. Mandates vulnerability assessment, penetration testing, and red team exercises.
• CERT-In (Indian Computer Emergency Response Team): National cybersecurity agency. MeitY-controlled. Requires mandatory reporting of cyber incidents within 6 hours.
• DPDP Act 2023 (Digital Personal Data Protection Act): Governs personal data handling by fintech companies. Non-compliance triggers significant penalties.