8.3 “S”

“…the effective implementation of a sound and robust technology risk management framework (TRMF) and cyber resilience framework (CRF), as required to be developed under paragraphs 9.1 and 11.2…  safeguard the financial institution’s information infrastructure, systems and data… ensuring the financial institution’s cyber resilience… also periodically review and affirm the TRMF and CRF, at least once every three years…”

All RidgeBot capabilities

8.4 “S”

“…the committee shall… ensure that risk assessments undertaken in relation to material technology applications… are robust and comprehensive.”

R1, R2

8.7 “S”

“…audit committee… is responsible for ensuring the effectiveness of the internal technology audit function…”

A2, A3, D2, S1, S4, W1

9.2 “S”

“…The TRMF must include… (e) risk measurement and assessment approaches and methodologies; (f) risk controls and mitigations; and (g) continuous monitoring to timely detect and address any material risks.”

A2, A3, D2, R1, R2, S3, V1, V2, W1

10.1 “S”

“…This shall include project oversight… and risk assessments throughout the project life cycle.”

S3, V1, V2, V4

10.2 “S”

“…The risk assessments shall identify and address the key risks arising from the implementation of technology projects… (e) the robustness of system and user testing strategies to reduce risks of undiscovered system faults and functionality errors…”

D1, R1, V1, V2, V4

10.5 “S”

“…must establish clear risk management policies and practices for the key phases of the system development life cycle (SDLC) encompassing system design, development, testing, deployment, change management, maintenance and decommissioning…”

A2, D1, R1, V1-5, W1

10.6 “G”

“…encouraged to deploy automated tools for software development, testing, software deployment, change management…”

A1, A3, S3, S4

10.8 “S”

“…establish a sound methodology for rigorous system testing prior to deployment…”

A3, S3, V1, V2, V4

10.9 “G”

“…[In addition to 10.8] should include… application security testing, stress and regression testing…”

S3

10.10 “S”

“…ensure… changes to the source code… [are] secure… prior to introducing any system changes.”

V1, V2, V4

10.24 “S”

“…shall host critical systems in a dedicated space… [that] must be physically secured from unauthorised access…”

S2, V3, W1-2

“…required to appoint [an] external service provider to carry out a production data centre resilience and risk assessment (DCRA)… [T]he assessment [must be] conducted at least once every three years or whenever there is a material change in the data centre infrastructure…”

A3, D2, R1, R2, S1, S3, S4, V5, W1-2

10.33 “S”

“…must design a reliable, scalable and secure enterprise network…”

A1-2, D2, R1, S1, S3, V1, V5, W1

10.36 “S”

“…ensure network services supporting critical systems are designed and implemented to ensure the confidentiality, integrity and availability…”

W1-2

10.37 “S”

“…establish and maintain a network design blueprint identifying all of its internal and external network interfaces and connectivity…”

A1-3

10.38 “S”

“…ensure sufficient and relevant network device logs are retained for investigations and forensic purposes…”

S2, V3, W2

10.40 “S”

“…required to appoint [an] external service provider to carry out regular network resilience and risk assessments (NRA)…”

S4

10.42 “S”

“…conduct proper due diligence on the third-party service provider’s competency, system infrastructure… prior to engaging its services… an assessment shall be made of the third-party service provider’s capabilities in managing… specific risks… (e) cyber threats…”

S1

10.47 “S”

“…ensure the storage of its data… There shall be proper controls over and periodic review of the access provided to authorised users.”

W1-2

10.49 “S”

“…must fully understand the inherent risk of adopting cloud services… to conduct a comprehensive risk assessment prior to cloud adoption… (g) exposure to cyber-attacks via cloud service providers…”

S1

10.61 “S”

“…must ensure… (a) access controls to enterprise-wide systems are effectively managed and monitored; and (b) user activities in critical systems are logged for audit and investigations…”

S2, V3, W2

10.62 “S”

“…institutions are required to… (b) deploy automated audit tools to flag any anomalies.”

A1, A3, S3, S4, V4

10.63 “S”

“…must ensure that critical systems are not running on outdated systems with known security vulnerabilities…”

V2, V4, V5

10.65 “S”

“…must establish a… management framework which addresses… (a) identification and risk assessment of all technology assets for potential vulnerabilities arising from undeployed patches… (b) conduct of compatibility testing for critical patches…”

V2, V4, V5

10.76 “S”

“…must ensure… [that] digital service logs are retained for investigations and forensic purposes for at least three years.”

S2, V3, W2

10.81 “S”

“…must perform continuous surveillance to assess the vulnerability of the operating system and… technology platform used for its digital delivery channels to security breaches… In view of the evolving threat landscape, these safeguards must be continuously reviewed and updated…”

A3, D2, R1, V5

11.1 “S”

“…must ensure that there is an enterprise-wide focus on effective cyber risk management…”

A1-2, D2, R1, S1, S3, V1, V5, W1

11.2 “S”

“…must be able to support the effective identification, protection, detection, response, and recovery (IPDRR) of systems and data…”

D2, D3, D4, R1-2, S3

11.3 “S”

“…must consist of… (b) identification, classification… of critical systems, information, assets and interconnectivity… to obtain a complete and accurate view of the… information assets, critical systems, interdependencies and cyber risk profile… (c) identification of cybersecurity threats and countermeasures…”

A1-3, D2, R1

11.4 “S”

“…is required to (a) implement a centralised automated tracking system to manage its technology asset inventory… (b)(i) perform detailed analysis on cyber threats, provide risk assessments on potential cyber-attacks… (b)(ii) proactively identify potential vulnerabilities including those arising from [third-party] infrastructure…”

A1-3, D2, R1, S3, V1, V5

11.5 “S”

“…must establish clear responsibilities for cybersecurity operations… include implementing appropriate mitigating measures… that correspond to the… phases of the cyber-attack lifecycle: (a) reconnaissance…”

D2, R1, S1, S3, V5

11.7 “S”

“…must deploy effective tools to support the continuous and proactive monitoring and timely detection of anomalous activities in its technology infrastructure…”

A2, A3, D2, R1, R2, S3, V1, V2, W1

11.8 “S”

“…must ensure that its cybersecurity operations continuously prevent and detect any potential compromise of its security controls or weakening of its security posture…”

A3, S2, V3, W2

11.9 “S”

“…must conduct annual intelligence-led penetration tests on its internal and external network infrastructure as well as critical systems including web, mobile and all external-facing applications… must engage suitably accredited penetration testers and service providers to perform this function.”

S4, V1-5, W1

11.10 “S”

“…must undertake independent compromise assessments on the technology infrastructure of its critical systems…”

S4

11.11 “S”

“…must establish standard operating procedures (SOP) for vulnerability assessment and penetration testing (VAPT) activities…”

R1-2, S1, S3, V5

11.12 “S”

“…must ensure the outcome of the penetration testing exercise is properly documented…”

D1-2

11.13 “S”

“…must ensure its technology systems and infrastructure, including critical systems outsourced to or hosted by third party service providers, are adequately protected against all types of DDoS attacks…”

A1-3, D1, D3, R1, S1, V5

11.18 “S”

“…must be able to perform… (c) vulnerability management; (d) threat hunting…”

D2, D3, A1-2, R1

11.19 “S”

“…must ensure that the SOC [Security Operations Centre] provides a regular threat assessment report… (b) intelligence on emerging and potential threats including tactics, techniques and procedures (TTP)…”

V5

11.20 “S”

“…must subscribe to reputable threat intelligence services to identify emerging cyber threats…”

V5

12.2 “S”

“The internal audit function must be adequately resourced with relevant technology audit competencies…”

S3

12.4 “S”

“In addition to… 12.2… must establish a dedicated internal technology audit function that has specialised technology audit competencies to undertake technology audits.”

All RidgeBot capabilities

12.5 “S”

“…must establish a technology audit plan that provides appropriate coverage of critical technology services…”

A1, D1, R1

Appendix 1: Storage and Transportation of Sensitive Data in Removable Media

Control 2

“Implementing authorised access control to sensitive data (e.g. password protection, user access matrix).”

W1-2

Appendix 2: Control Measures on Self-service Terminals (SSTs)

Cash SST Control 3

“Ensuring Cash SST operating system is running on a secure version operating system with continued developer or vendor support for security patches to fix any operating system security and vulnerabilities.”

S3, V1, V5

Cash SST Control 9

“Enforcing firewall and Intrusion Prevention System (IPS) at the financial institution’s network to filter communication between the host server and the Cash SST.”

A1, S1

Cash SST Control 13

“Enforcing secure system parameter setting… (a) changing defaults password…”

W1-2

Cash SST Control 17

“Installing closed-circuit cameras and transaction triggered cameras…”

A3, S2, V3, W2

Non-cash SST

Control 2

“Deploying closed-circuit television to monitor…”

A3, S2, V3, W2

Non-cash SST

Control 3

“Ensuring adequate control over network security of the self-service terminals to ensure that the kiosks are secured and segregated from the internal network…”

A2, S1

Appendix 3: Control Measures on Internet Banking

Control 1(a)

“…should ensure the adequacy of security controls implemented for Internet banking… (a) Ensure Internet banking only runs on secured versions of web browsers that have continued developer support for security patches to fix any vulnerabilities…”

A1, D1, R1, S1, S3, V1-5, W1

Appendix 4: Control Measures on Mobile Application and Devices

Control 1(c)

“…undertake proper due diligence processes to ensure the application distribution platforms used to distribute the mobile application are reputable.”

A2, S1, W1

Appendix 5: Control Measures on Cybersecurity

Control 1

“Conduct periodic review on the configuration and rules settings for all security devices. Use automated tools to review and monitor changes to configuration and rules settings.”

A1-3, D2, S3, S4, V4, W2

Control 4

“Ensure technology networks are segregated into multiple zones… each zone shall be adequately protected by… firewall and Intrusion Prevention System (IPS)… must include mobile and wireless networks…”

A1-3

Control 6(d)

“Ensure security controls for remote access to server… close relevant ports immediately upon expiry of remote access.”

D2, R1

Control 8

“…protect the Network Time Protocol (NTP) server against tampering.”

A1, R1, S1

Automated Asset Discovery and Inventory

A1

Automated asset discovery can help you compile and maintain an inventory of all data processing assets and attack surfaces.

A2

An asset discovery scan iteratively discovers and documents changes in the presence of assets that should be included in a risk assessment or asset inventory.

A3

An automated asset discovery scan verifies on an ongoing basis that no new, unplanned devices are connected to the infrastructure that can introduce vulnerabilities. For example, an attacker might set up a rogue wireless access point, or install an IoT device that allows remote access to the internal network.

Documentation, Reporting and Forensics

D1

Regular automated asset discovery scans on an ongoing basis can help ensure all assets and attack surfaces are identified and documented.

D2

Scan-and-exploitation reports can assist you in compiling consistent and comparable documentation of vulnerabilities found, vulnerability ranking, successful exploits, and the mitigation and remedial steps taken. This information can be used to take mitigation actions and/or to prepare management reports.

D3

Scan-and-exploitation reports—which include recommended solutions for each vulnerability—provide critical information for your security incident response/escalation or forensics team to ensure timely and effective handling of all situations.

D4

A forensic scan—after a security incident has occurred—can help determine where and how the breach was perpetrated. From there it can be extrapolated as to which systems and what data might have been exposed.

Risk Assessment and Mitigation

R1

A pen-test-and-exploit scan identifies, analyzes and evaluates all risks found. The scan reports provide a ranked list of vulnerabilities found based on each vulnerability’s likelihood to be exploited, including those that were successfully exploited during the test. The reports also provide an evaluation with granular steps to remediate each vulnerability.

R2

The recommended remedial steps in RidgeBot reports provide evidence that risks are being adequately found, measured, reviewed and treated.

Scanning and Penetration Testing

S1

A pen-test-and-exploit scan helps verify the security posture of all internal systems, as well as any provider- or cloud-hosted assets and services.

S2

A pen-test-and-exploit scan can reveal weak points in physical security processes and systems (cameras, surveillance systems, logging systems, digitally-controlled door locks) that could grant an attacker physical or electronic access to secure systems or areas, or allow tampering with surveillance cameras or stored logs or footage.

S3

Automated pen-test-and-exploit capabilities can be run cost-effectively as frequently as necessary, rather than doing occasional one-time tests. This ensures peace of mind that your assets are continually locked-down and that new vulnerabilities are detected immediately after—or often before—they’re introduced into your production environment.

S4

Automated pen-test-and-exploit capabilities can be run iteratively and cost-effectively to prepare for an audit or a third-party verification of your security posture.

Vulnerability Exploitation and Intelligence

V1

A full scan, with exploitation turned on, discovers, exploits and documents all vulnerabilities found. Run this scan as a regular part of your policy/process for hardening software patches, software upgrades, new devices, and any configuration changes before pushing them live into the production environment.

V2

A full scan, with exploitation turned on, discovers, exploits and documents all vulnerabilities found. Run this scan as a regular part of your software development and software validation processes.

V3

A pen-test-and-exploit scan can ensure that all systems or devices used to document events and activities are secure from software/malware vulnerabilities where a hacker can get access to erase or alter logs, video surveillance footage, or forensic audit trail information.

V4

A pen-test-and-exploit scan can be run as a regular part of your policy/process to harden software patches, software upgrades, new devices, and any configuration changes before pushing them live into the production environment.

V5

RidgeBot’s built-in AI/ML exploitation engine uses RidgeSecurity’s industry leading knowledge base of attack techniques and intelligence, and ensures that your assets are always hardened with the most up to date vulnerability information. It is the best way to stay abreast of emerging technical vulnerabilities in a structured and systematic way.

Weak Password and Credentials

W1

A weak password scan run against all assets documents and resolves login credential vulnerabilities.

W2

A pen-test-and-exploit scan can ensure that all systems or devices used to document events and activities are secure from weak credential vulnerabilities where a hacker can get access to erase or alter logs, video surveillance footage, or forensic audit trail information.