Banks should focus on building 'digital trust' amid rising cyber threats, says IBM executive

With more and more people moving to internet and mobile banking, risks of data thefts, cyberattacks and frauds are also increasing.

Banks in India, along with regulators and the government, are encouraging customers to move towards digital banking, with lesser dependance on cash, cheques and branches. However, when these channels are hacked or disrupted for any other reason, such incidents affect the transition.

"The way the economy is getting digitised, dIgital trust is of paramount importance and that is going to spearhead us into growth. Our initiatives in digital trust assurance is going to be a big thing for this market. That's going to be our focus," said Vaidyanathan Iyer, Security Software Leader, IBM India and South Asia.

Recently, a private bank reported issues in online and mobile platforms. This was the second time in a month’s gap. While the lender ruled out the possibility of a cyber attack, the incident has left a sour taste in the mouth of its customers.

'Digital Trust' is when customers are confident that their bank has the ability to secure their data. Iyer said that it can be achieved by upgrading from standard threat management to threat intelligence and threat hunting.

"Banks have a Security Operation Centre (SOC), which is the nerve centre of their operations for managing their enterprise level security. Now, they are moving into Next-Gen SOC which involves security intelligence, analytics as well as threat intelligence and hunting," Iyer said.

Apart from being able to defend their systems from cyber attacks, banks should also be able to get back on their feet quickly in case an incident occurs. "If an incident strikes, the bank's resilience comes into picture," Iyer added.

Last year, the above mentioned private lender took a week to get its mobile platform up and running. It is learnt that the bank is currently under the scanner of the Reserve Bank of India (RBI) to examine the cause of these recurring disruptions and the measures it has taken to address the issue.

While banks are doing what they can, customers also need to be careful about how online transactions are carried out. Most people, unknowingly give out sensitive data to fraudsters. It is imperative that bank invest in continuous customer education.

Iyer said that user training and experience are as important as the regulatory framework and technology in building digital trust.

"There is one school of thought which says that because of digitisation, the personal touch is gone. But I think that continuous education can actually enhance the experience between the customer and the bank. Customers will be able to use more digital services and release the bank from mundane activities to focus on productivity," Iyer said.

In case of identity theft, banks rely on behavioural analysis to differentiate between a fraud transfer from the customer’s typical spending pattern.

For instance, if an amount transfer took place in a country you’ve never visited before or if the amount was larger than your usual transactions, it will raise an alert so that the bank can immediately stop the transfer after intimidating you.

According to IBM’s Cost of Data Breach 2019 report, the average total cost of a data breach in India is Rs 12.8 crore and the per capita cost per lost or stolen record is Rs 5,019. Sectors like pharmaceuticals, technology, services and financial were most affected due to data breaches. The report showed that the major cause for a data breach was malicious or criminal attacks.

"Cyber risks are increasing rampantly with advancement in technology, and increasing adoption of digital services, whether financial or otherwise, is bringing these issues to the forefront," the RBI said in Vision 2019-21 for payments and settlement systems.

"This issue becomes grave given the fact that the nature of threat is dynamic and keeps changing rapidly. The interconnected systems are as safe as their weakest link. There is, therefore, a need for both security against possible cyberattacks and resilience in the eventuality of such attacks," the banking regulator said.