Bank cyber incidents have pushed the Indian Banks Association to weigh a structured mechanism for sharing information about attacks among its member banks. SBI chairman Challa Sreenivasulu Setty said the association was seriously working on the idea, speaking at the bank’s second quarter results press meet. Setty, who also chairs the association, said a structured channel would let banks act as soon as bank cyber incidents happen.
“While it (cyber security incident) is definitely shared with the regulators and the security agencies, among the banks, the moment an incident happens, if it can be informed through a structured mechanism, I think that would be quite useful so that people can immediately take (remedial) measures,” Setty said. He added: “This is something we are seriously working on under the aegis of IBA.” The proposal comes after a rise in bank cyber incidents around the world, and after a data breach at SBI itself last month.
Setty said digital adoption in banking has widened the area exposed to attack. “I think we have progressed very much in terms of digital adoption,” he said, adding that the system, the government and public and private sector bodies were working together to protect trust in digital banking. He pointed to agencies such as CERT-In, the Indian Computer Emergency Response Team, and NCIIPC, the National Critical Information Infrastructure Protection Centre, as part of that work.
Bank cyber incidents and the SBI case
Late last month, SBI said it experienced an incident involving suspected exposure of customer data on the dark web. During the preliminary analysis of about 3,75,000 records available on the dark web, 3,897 customer records containing personally identifiable information were identified, according to an exchange filing by the bank. The filing gave the scale of the confirmed exposure, which was far smaller than the total set of records examined.
Setty said the bank gave information about the incident in the press and reached out to customers. “The root cause analysis is being done. It will take some time. But our focus was in terms of containment measures and also identify the vulnerabilities which led to this breach and remediate them,” he said. The root cause work is still under way, and the bank has not yet said what caused the exposure.
The SBI case shows why bank cyber incidents are hard to handle one bank at a time. A set of records can circulate before a single bank has finished its own checks, and other banks may hold similar data through shared vendors or systems. A faster warning between banks would not replace the regulator’s role, but it could shorten the gap between discovery and action.
How bank cyber incidents are shared today
At present, bank cyber incidents are shared with regulators and security agencies, Setty said. That reporting line is established, and it covers the authorities that need to know. What does not exist, in his account, is a routine channel through which one bank tells other banks directly when an incident happens. The association’s proposal would fill that gap with a structured mechanism rather than informal contact.
Setty said SBI had undertaken a complete cyber security drill in terms of an API sweep, and that vulnerability assessment was an ongoing process. “Obviously, the security, both of our systems as well as customer information is of paramount importance for us,” he said. He added that the incident had strengthened the bank’s resolve to keep its cyber security measures strong enough to prevent further breaches.
Funding is not the constraint, in Setty’s account. He said there had never been a shortage of funds for technology and digital solutions, and that SBI had invested heavily in technology over the years. The problem the association is trying to solve for bank cyber incidents is coordination, not spending: banks need to hear about an incident early enough to check their own systems.
What a bank cyber incidents system would do
A structured system for bank cyber incidents would let a bank that spots an attack warn others before the same method reaches them. Banks could then check whether they were exposed, apply fixes and watch for similar activity. The value lies in speed, since remedial measures work best when they start before an attack spreads.
The association has not yet described the form the mechanism would take, who would run it, or what details banks would share. Those choices will decide whether the system for bank cyber incidents is useful in practice, since banks will need rules on confidentiality and on what counts as a reportable incident. For now, the proposal remains work in progress under the association, prompted by the SBI breach and by the wider rise in incidents.