cyber related threats is changing very fast and what is current on any day becomes obsolete the very next day. if continued cyber vigil is to be ensured then a continuous process of awareness building, education, re - enforcement, tests, trials and upgradation is a must. it is this area which we generally tend to be rather lax and which is exploited by cyber - baiters. 19. let me dwell a bit on what the central bank of this country is doing in this regard. in terms of providing a comprehensive framework for it implementation, we at reserve bank have been proactive and follow an approach of consultation and congruence in the security framework. right from the early days when rbi provided guidance on computerisation, we have been conscious of the role that it plays in meeting the emerging customer needs and the opportunities and challenges of using technology, including cyber related aspects. i will draw your attention to a few recent initiatives in this regard by the rbi. 20. the reserve bank has recently issued on june 2, 2016 a comprehensive set of guidelines for cyber security framework in banks. these guidelines built over the earlier work emphasise the importance of having a focussed attention to cyber threats and framework for mitigating the threats and to protect the information assets. i would like to redraw your attention to the recent cyber incident at one of our banks. apparently there has been no monetary loss in the recent incident. but it is too early to conclude what and how of the incident at this juncture ; however, the need for vigil over the sensitive systems like remittances is once again brought to the fore, with particular focus on configuration of the systems and the human aspects in managing the systems. banks need to put in place preventive measures such as appropriate bis central bankers ’ speeches controls framework around the systems, reconciliation of transactions in on real / near real time basis, controls over the message creation and transmission, applying timely security patches to the interfaces, if any, close monitoring of transactions and disabling usb, and internet access on the connected nodes. equally important is the timely detective measures. it is pertinent to prepare ourselves to face such incidents, by having a robust crisis management plan. i am sure the banks are taking earnest steps to comply with the provisions of the circular as soon as possible. time has come to scale up the cyber security preparedness to meet the emerging threats 21. information dissemination is a key facilitator in combating the menace of cyber

most customer may be ill - equipped to effectively handle the security features provided with the service. we have also heard of instances, elsewhere in the world, of even as small a value of one penny being robbed off every transaction, misusing the ict capabilities, which have also resulted in loss of enormous amount of money. while it is recognised that the customer has to protect himself against disclosure of sensitive passwords, pins etc., they may only have limited ability to distinguish between the genuine customer service calls and fraudulent operators. nature of cyber crime 4. cyber criminals and the attacks they launch on financial sector and its users come with different faces. there are organised criminals who are looking to attack the financial institutions, with a view to siphon away funds, illegally. then there are those who steal confidential data from financial institutions which may also include customer related information. the latter are more interested in ex - filtration of data, though no loss happens immediately. these stolen data then land in the hands of petty criminals, who defraud the banks directly or by enticing the customers to share more information such as passwords and pins where after actual loss takes place. bis central bankers ’ speeches 5. a variation of these attacks is to masquerade as bank officials and extract information from customers, based on random calls to phone numbers obtained from various sources, or even by blind trials which result in at least a few attempts resulting in success. 6. there are other cyber criminals who steal money by putting through fraudulent transactions, or changing the particulars, so that they are able to take large sums away and vanish. in such cases, customer may not be directly contacted, but his particulars are taken through malware or other means. recent incidents of this type have set the alarm bells ringing. i would like to draw your attention to the recent cyber incident reported by one of our banks, which i am sure all of you would have seen, particularly when similar incident at a central bank in the neighbourhood is still fresh in our memory. 7. yet another vicious cyber - attack, which we really tread is what is categorised as cyber warfare ; this is expected to be of organised attacks, sometimes by backing of large terrorist organisations and often with covert state sponsorship, made against enemy country information assets. 8. the different nature of cyber - crimes naturally require responses which are designed to fight each type of threat, with specifically designed tools and practices. i am sure that during the deliberations of