Independent body to be cyber warrior of the financial sector

NEW DELHI: An expert group has proposed the setting up of an independent Computer Emergency Response Team for Finance (CERT-Fin) to be the cyber warrior of the financial sector. CERT-Fin will be the key to ensuring a comprehensive cyber security framework for the financial sector, especially at a time when there has been a burst of activity in the fintech space as India makes efforts to embrace a less-cash economy.

Till this body—to be set up as a not-for-profit company with a governing board—is functional, the panel has recommended that Reserve Bank of India (RBI) act as the lead regulator.

CERT-Fin will report to the Indian Computer Emergency Response Team (CERT-In)—the agency that is tasked with coordinating efforts on cyber security issues—to ensure complementarity. The report of the working group, headed by CERT-In director general Sanjay Bahl, has been placed in the public domain for discussions by the department of economic affairs. The deadline for submitting responses is July 31.

In the Union budget for 2017-18, finance minister Arun Jaitley had announced the setting up of CERT-Fin. Subsequently, the government set up the expert group to give shape to this entity.

The vulnerability of the sector has increased as India pushes towards a less-cash economy. Last year, after a malware injection in the systems of Hitachi Payment Services Pvt. Ltd, about 3.2 million debit cards were compromised; similarly, hackers had infected the servers of the Union Bank of India with malware.

“India is one of the largest targets of cyber attacks not only on businesses but also on individuals. The threat of cyber attack is real. Most of the times, companies are either not aware that an attack has taken place, or are hesitant to report it,” said Jayant Saran, partner, forensic-financial advisory, Deloitte India, while welcoming the move to create CERT-Fin.

Further, the panel observed that the dispersal of technical resources is skewed towards cities even as online financial transactions continue to spread across the country.

“The preparedness of the financial sector to meet the cyber challenges from different threat vectors cannot be considered robust,” the expert group said. The group has recommended that CERT-Fin include representatives from regulators and experts with sophisticated IT skills hired at market-linked rates.