Technology in Banking-Insight and Foresight for BTA_2011 ... - IDRBT

More documents

Recommendations

Info

Technology in Banking – Insight & Foresight 44 Exhibit 20: IT risk management framework Exhibit 21: Managing IT risk An analysis of the scores indicates that smaller banks are lagging behind the curve. While larger banks have extensive IT risks management policies in place, smaller banks need to step up their efforts toward internal awareness measures, data centers and software risk management policies. 3.7.2. Policies and Procedures Most banks have risk management policies and procedures approved by the board. The IT risk management policy ensures that IT risks are identified, assessed and managed for infrastructure and applications within the production environment. The scope of IT risk management policy covers all Institute for Development & Research in Banking Technology
Technology in Banking – Insight & Foresight 45 the IT assets. The policy coverage extends to all personnel and/or processes related to IT applications, IT infrastructure, IT services and documents. 3.7.3. Managing IT Hardware Risks Banks have policies such as asset life cycle management policy (ALCM), physical security policy, minimum baseline security standard (MBSS), SLA and AMC with hardware suppliers, capacity management policy, DR/BCP policy and risk management policy, which collectively take care of the mitigation of all hardware risks. The asset life cycle management (ALCM) procedure is to manage the security and risks of all assets with users at banks such as software and hardware, as well as covers processes to be followed from the procurement to the disposal of hardware assets. Banks have implemented a centralized backup solution and have a robust backup infrastructure to support critical data and applications. There is a provision to take daily backups and a copy of the same may be sent to the offsite location, in case of primary site disasters. The backup tape is shipped to the DR/Standby site where data can be restored. A disaster recovery (DR)/business continuity planning center needs to be built to take care of one or more application failure at the primary data center and: Provide a comprehensive user-agnostic DR solution for each mission critical application of the bank Successful partial disaster simulation of three or more applications with their multiple interfaces continue to be operational from the production site Full disaster simulation at a network level Most banks have certifications such as BS 25999 and ISO 27001 to validate their compliance to BCP and DR. The data centers need to be secured by the physical security perimeter, which may be supported by CCTV cameras, security guards, bullet proof doors, separate physical access cards and biometric devices, fire alarms and fire extinguishers. Authorized vendors can carry out preventive maintenance on a periodic basis to ensure availability on a consistent basis. 3.7.4. Managing IT Software Risks: The bank’s IT policies and related processes and procedures such as change management, application security standard, release management, service level agreements and asset management charges with vendors, suppliers relationship management, IT risk management and license management process guard the bank from all software-related risks focusing on software assets, including licenses, versions and installed endpoints. Any software before installation goes through System Development Life Cycle (SDLC) phases, to check the relationship between threat agent, probability and the impact on business. The high and continuous availability of operating systems, databases and applications is ensured through the installation of updated anti-virus software, firmware versions, patching of servers and security devices. All the foregoing activities help banks to contain IT software risks. For any new application or system enhancements, the security should be incorporated since inception. Applications should be monitored and patched for technical Institute for Development & Research in Banking Technology
Page 1 and 2: Technology in Banking Insight and F
Page 3 and 4: Technology in Banking - Insight & F
Page 45: Technology in Banking - Insight & F
Page 61: Technology in Banking - Insight & F

Technology in Banking-Insight and Foresight for BTA_2011 ... - IDRBT

Create successful ePaper yourself

Delete template?

Save as template?