INFORMATION TECHNOLOGY & DIGITAL BANKING MODULE D QUIZ 1

Physical security controls protect facilities, equipment and media from unauthorised access or damage. Examples include access badges, biometric entry, visitor logs, CCTV, secure racks and environmental controls. Logical controls, by contrast, govern access to systems and data.

Logical access controls regulate what authenticated users can do within systems. Role-based access control assigns permissions according to job responsibilities, supporting least privilege and segregation of duties.

A firewall enforces traffic rules between network zones by permitting or blocking connections according to defined policies. It is one layer of defence and should be combined with secure configuration, monitoring, endpoint protection and other controls.

Biometrics can improve convenience and strengthen identity verification, but they have false acceptance/rejection rates, privacy implications and risks if biometric templates are compromised. A biometric cannot be changed as easily as a password, so secure template protection and fallback controls matter.

ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS). It is risk-based and focuses on managing information-security risks, not simply purchasing a particular security product.

E-banking introduces operational, legal, reputational, security and outsourcing risks. Effective governance, clear accountability, risk assessment, security controls, incident response and customer protection help banks manage these risks as services and threats evolve.

A virus is malicious code that attaches to a host file or program and can replicate when the infected host is executed. Worms can spread independently across systems, while trojans disguise malicious functionality as legitimate software.

Phishing uses deceptive messages or sites to trick people into disclosing credentials or performing unsafe actions. Controls include awareness training, email filtering, phishing-resistant authentication, reporting channels and rapid credential revocation.

Symmetric cryptography uses the same secret key, or closely related shared secret material, for encryption and decryption. It is efficient for bulk data, but securely distributing and protecting the key is a central challenge.

Public-key (asymmetric) cryptography uses a mathematically related key pair: a public key and a private key. Depending on the operation, the pair can support encryption/key establishment or digital signatures, with the private key kept secret.

A digital signature can provide evidence of message integrity and origin/authenticity when the public key is reliably associated with the signer. It can also support non-repudiation in a legal and operational context, but does not by itself encrypt the message or guarantee the signer’s intent.

PKI includes policies, processes, technologies and trusted entities for managing digital certificates and public keys. It supports binding identities to public keys and enables trust decisions for digital signatures and related cryptographic services.

A digital certificate binds an identity or subject to a public key and is digitally signed by the issuing CA. Relying parties must also check validity, expiry, revocation status and whether the certificate is appropriate for the intended use.

BCP focuses on continuing critical business functions during and after disruption, including people, processes, facilities and communications. DRP focuses more specifically on restoring IT systems, applications, data and infrastructure after a disruptive event; the plans should be coordinated.

RTO is the targeted maximum time to restore a service or process after disruption. It helps determine recovery strategies and service priorities; it is distinct from Recovery Point Objective (RPO), which concerns the tolerable amount of data loss measured in time.

RPO expresses the maximum tolerable data loss in time terms. An RPO of 15 minutes means recovery arrangements should aim to limit data loss to no more than the transactions or updates from the last 15 minutes, subject to the defined recovery scenario.

A recovery-site or failover test validates whether critical systems, data and dependencies can be brought up at the alternate site within the required objectives. A tabletop exercise tests plans and decisions but does not by itself prove technical restoration.

Audit evidence should be reliable, relevant and traceable. Dated access-review records showing the accounts reviewed, reviewer, exceptions identified and remediation provide stronger evidence than an informal assurance that reviews happen.

An audit trail records relevant system and user activity, supporting accountability, investigation, monitoring and audit. Logs should be protected against unauthorised alteration, retained according to requirements and monitored for suspicious activity.

An IS audit should be risk-based, independent and aligned to the bank’s systems, criticality, regulatory obligations and control environment. Scope should consider access management, change management, operations, resilience, data protection, third parties and remediation tracking.