g padmanabhan : emerging issues in cyber security in the financial sector address by mr g padmanabhan, executive director of the bank of india, at the sri chithira thirunal memorial lecture series, organised by the state bank of travancore, thiruvananthapuram, 28 february 2015. * * * assistance in the preparation of this address rendered by s / shri s ganeshkumar, a madhavan, vaibhav chaturvedi, kashiap balakrishnan, smt radha somakumar and helpful comments from a number of colleagues is gratefully acknowledged. errors, if any, are speaker ’ s own. 1. it is not often that one gets an opportunity to deliver the very first lecture of a series organised in memory of a person whom you have known and respected from the childhood. one may have many things to say and eulogise about the late highness sri chithira thirunal, but i can claim to represent a family which knew him personally and many of his family members. therefore, i am thankful to mr jeevandas narayan, managing director of state bank of travancore for starting this lecture series and giving me the unique opportunity of delivering the first lecture. it is also appropriate that the bank has started this lecture series considering the association of the royal family with the setting up of this bank which has been well documented by prof a sreedhara menon in his book, “ triumph and tragedy in travancore ”. the predecessor of today ’ s state bank of travancore, travancore bank ltd, started operations with a public issue of shares worth rs 1 crore on october 8, 1945 which was oversubscribed by two and a half times the same day. the entire process was orchestrated by the government under sri chithira thirunal and the inimitable c p ramaswamy iyer. dr. ludwik aronson, a polish jew, whose expertise was reportedly utilised by the reserve bank of india for their foreign exchange transactions during 1943 – 45, was appointed as the first general manager of the bank. the rest as they say is history and even today the bank continues to be the biggest influence in kerala with the largest market share among banks and the mind - space among keralites. 2. i chose the topic of cyber security, esoteric to many, as to my mind this area

. there are two kinds of awareness. one is the awareness among customers about the dos and donts in digital transactions. it may be required for banks to take upon continuous awareness campaign among all customers on the importance of information security and the abundant caution to be exercised by them. internal awareness is the awareness among employees of the bank about security. while it is necessary to increase the overall awareness among all employees, it is imperative that a small section of employees are groomed to handle higher end security concerns, including digital forensics. unless banks are able to have strong internal security teams, their position would be weak. unlike other technology related activities, no organisation can afford to outsource its entire security. banks have to take up measures to recruit and retain the right talent. more importantly, they should keep the security skills sets always alert and up to date in a world of constant threats by a more motivated group of skilled attackers. the challenge is that there is no readymade skill set in the market too. banks have to build an entire banking security eco system themselves. conclusion 28. let me summarise what i have been trying to communicate : i ) cyber threat is real and is constantly evolving. no organisation is immune or can claim to be fully secure against a cyber attack. ii ) preventive measures are a must in this scenario. iii ) where prevention fails, make up with quick detection and decisive response. bis central bankers ’ speeches iv ) every organisation should have an it governance policy as a subset of cyber security policy. the policy should identify key assets, the risks they are exposed to, prescribe mitigation measures, roles and responsibilities in case of a cyber incident and state the response required. v ) identify worst case scenarios and plan and practice the response in each case. this is challenging as one is facing a fast moving target. vi ) the aim should be to recover from a worst case scenario as set forth in the cyber security policy. vii ) be an active participant in sharing information on cyber threats faced. viii ) adopt iso 27001 which is internationally recognised best - practice standard for information security management. 29. in conclusion, as governor raghuram rajan warned in an internal communication, in today ’ s interconnected world, eternal vigilance is the price we have to pay not merely for the benefits of democracy as the old saying goes, but also to enjoy the benefits of a safe and secure financial system. 30. once again thank you for inviting me over and