we observe across institutions is that the configurations of such devices are seldom given sufficient importance and left to the vendors. vulnerabilities exist in hardware, middleware, software, os, applications, network devices, communication devices etc. it is, therefore, important to pay sufficient attention while procuring / implementing any new devices / solutions. cyber criminals are also increasingly exploiting the vulnerabilities in the smart phone software by infecting the operating systems with malware. the banks which are big on mobile banking as a service delivery tool must also look to guard against this emerging risk. 22. another area of concern is the patch management. oems release patches after known vulnerabilities are escalated to them and if the patches are not rolled out in time, we are practically leaving the door open for exploitation. user management leaves much to be desired - practice of shared passwords, no passwords, free administrator level access, dated authorized users list are quite common place. often, there is no robust process for creating new users, reviewing the list and deleting inactive users. then, there is the issue of implementing physical security. i have seen physical access control systems being in place but usage not insisted upon. further, the dependence on the vendors is increasing and many a times only the vendors know how the system is to be operated. customer information is stored at vendors ’ facility without adequate safeguards. another curious thing i note is that while the banks claim that they do not get skilled resources, the same vendor provides some critical services to multiple banks. this raises a question as to whether the banks know what they get from their outsourced vendors, including the quality of delivery. timely decision to scale up capacity is very important to ensure continued availability of services and business growth. people and processes need to be given adequate importance, for without capable hands even best of the systems is bound to fail. monitoring is paramount – whether the port that was opened for a specific purpose was closed in time, who analyses the important logs that are created religiously, how incidents are responded to, whether the security operations centre ( soc ) is integrated with inputs from various systems, whether the exceptions thrown out are escalated to appropriate levels etc. 23. the security culture at banks needs to change for the better. in a brick and mortar environment, if the safe is not having good locking system, or the walls are showing some cracks, roof is leaking, banks do notice. in a digital world,

does not mean similarity in the basic nature of the academic discipline. the fundamental difference between physics and economics is that physics deals with the physical universe which is governed by immutable laws, beyond the pale of human behaviour. economics, in contrast, is a social science whose laws are influenced by human behaviour. simply put, i cannot change the mass of an electron no matter how i behave but i can change the price of a derivative by my behaviour. 13. the laws of physics are universal in space and time. the laws of economics are very much a function of the context. going back to the earlier example, the mass of an electron does not change whether we are in the world of newton or of einstein. but in the world of economics, how firms, households and governments behave is altered by the reigning economic ideology of the time. to give another example, there is nothing absolute, for example, about savings being equal to investment or supply equaling demand as maintained by classical economics but there is something absolute about energy lost being equal to energy gained as enunciated by classical physics. 14. in natural sciences, progress is a two way street. it can run from empirical findings to theory or the other way round. the famous michelson - morley experiment that found that the velocity of light is constant led to the theory of relativity – an example of progression from practice to theory. in the reverse direction, the ferocious search now under way for the higgs boson – the god particle – which has been predicted by quantum theory is an example of traversing from theory to practice. in economics, on the other hand, where the human dimension is paramount, the progression has necessarily to be one way, from empirical finding to theory. there is a joke that if something works in practice, economists run to see if it works in theory. actually, i don ’ t see the joke ; that is indeed the way it should be. 15. karl popper, by far the most influential philosopher of science of the twentieth century, propounded that a good theory is one that gives rise to falsifiable hypotheses. by this measure, einstein ’ s general theory was a good theory as it led to the hypothesis about the curvature of space under the force of gravity which indeed was verified by scientists from observations made during a solar eclipse from the west african islands of sao tome and principe. economics on the other hand cannot stand the scrutiny of the falsifiable hypothesis test