Mumbai: The Reserve Bank of India (RBI) has asked banks, payment-system operators and other regulated entities to treat affected technology environments as compromised after a data breach or confirmed unauthorised access, and to restore them only after a forensic investigation clears them, The Economic Times reported on October 23.
According to the report, the direction also asks financial entities to remove management and administrative interfaces from public internet access, enforce multi-factor authentication for administrative access, and restrict access to cloud and backend systems on a least-privilege basis.
Entities have also been asked to audit source code, repositories, configuration files, client applications and cloud storage for exposed credentials, and to immediately rotate and purge compromised credentials, the report said.
The approach marks a shift from treating an incident as closed once passwords are reset or a vulnerability is patched: forensic clearance is meant to establish whether attackers retained other access routes, stole authentication tokens or moved laterally across connected systems, VARINDIA reported in its coverage of the directive.
Source: VARINDIA — RBI's Cyber Warning: Assume Breach Until Proven Secure
The reported measures also put third-party technology providers in focus, since banks rely heavily on cloud platforms, fintech partners, payment gateways and managed-service vendors whose compromise can affect multiple institutions. Awaaz Punjab has attributed the details above to the published reports; the RBI's formal circular text was not reproduced in them.
Source: VARINDIA — RBI's Cyber Warning: Assume Breach Until Proven Secure