RBI executive director G Gopalakrishna on Friday pulled up Indian banks for their failure to improve compliance norms stipulated by the RBI Working Group on cyber security. ? As of September 2013, banks were required to improve their compliance in respect of regulatory requirements pertaining to some areas like cyber frauds mitigation, customer education, legal aspects and information security. . However, new private sector banks and foreign banks have better compliance levels,? he said. ?The effectiveness of implementation of the policies and procedures is not satisfactory, particularly in public sector banks and old private sector banks,? he said.
Gopalakrishna, who was delivering an inaugural address via video conferencing at the Information Systems Audit and Control Association annual conference in Pune from Delhi, pointed out that fraud vulnerability assessment and system based monitoring for detection of frauds were yet to be effectively implemented.? Legal risks arising from non-implementation of guidelines and violation of IT Act/IT Amendment Act and rules framed therein have not been adequately factored in by banks. Effective maintenance of audit trails need focused attention,? he said. He also felt that capturing of information on security incidents and metrics and loss data has not been achieved to the desired level of maturity. ?Incident management has remained ad-hoc, rather than systematic and process-driven in some of the banks,? he added. ?We need to demonstrate that we can?t let our doors open to cyber criminals, fraudsters and terrorists to break the faith of our customers in our banking system,? he said.
