Business Continuity Management, Information & Cyber Security Practices
Ensuring uninterrupted operations amid rapid change
The world is rapidly evolving. The pandemic demonstrated the need for complex operations involving multiple stakeholders to be managed remotely and digitally. At HDFC Bank, we have a welldefined Business Continuity Plan (BCP) in place, to ensure the reliability and continuity of operations.
Our BCP is based on regulatory guidelines, ISO22301:2019 certified, and is subject to regular reviews. We have a Business Continuity Policy and Procedure with clearly defined roles and responsibility.
Business Continuity – Scope & Governance Framework
Approach towards emergency, disaster & crisis management
Business continuity
Manage continuity of critical business operations and accelerated resumption of services after a disaster
Emergency response
Deal with site-level emergency at an office or a branch involving life safety issues like fire, bomb threats, and so on
IT disaster recovery
Recover critical business applications during hardware/network/power failure
Pandemic response
Facilitate an organised and speedy response to any pandemic situation that threatens the safety of the Bank’s employees and/or disrupts the Bank’s critical business functions
Crisis management
Tackle bank-wide disasters such as pandemic, terrorist attacks, ransomware attacks, fire, cyclone, earthquake, citylevel floods, cyber-attacks and data centre outages, among others
BCP: Governance and management
Our central Business Continuity Office works towards strengthening the business continuity preparedness
BCP is managed by the Information Security Group and governed by the Business Continuity Steering Committee
This committee is chaired by the Chief Risk Officer (CRO)
The committee’s other representatives are selected from the senior management team
Scope of BCP
Retail Branch Banking
PhoneBanking
Payments Business & DBC Risk Control
Retail Portfolio Management - Credit Cards
Wholesale Banking Operations
Retail Banking Operations
Treasury Operations
Robust information and cyber security practices for an uninterrupted march towards rapid digitisation
Governance over Data
As a responsible banker cyber security, and data privacy are of paramount importance to us. To manage these risks, we have constituted an IT Strategy Committee, Information Security Committee in addition to the Information Security Group with specific roles and responsibilities. We also have in place a cybersecurity framework and an information security programme. We undertake stringent processes and measures such as vulnerability management processes that actively scan for security threats, logging and monitoring procedures to deal with network intrusions and incidents. There were no incidents of data breaches In FY22.
We adhere to the ‘Code of Bank’s Commitment to Customers’ as prescribed by the Banking Codes and Standards Board of India (BCSBI) and Employee and Customer Awareness Procedures, to ensure customer privacy and are guided by our Information Security Policy and Cyber Security Policy, which is at par with global standards in information security.
Further we have an independent assurance team within Internal Audit which provides assurance on the management of information technology-related risks.
IT Strategy Committee
This committee looks into various technology related aspects. The functions of the Committee are to formulate IT strategy and related policy documents, ensure that IT strategy is aligned with business strategy.
The committee comprises majorly of independent directors and includes an external information technology expert.
Information Security Committee
This Committee is chaired by the CRO (Chief Risk Officer) and is responsible to assess, accept and sponsor company-wide security investments. It provides a forum to discuss information security risks and acts as a custodian for the enterprise security programme. The committee meets on a quarterly basis with participation from IT, Business Operations, Audit, and the Information Security Group.
Information Security Programme
This programme is based on regulatory requirements (RBI Gopalakrishnan committee report) and industry standards (ISO 27001:2013 and NIST 800-53). Our cybersecurity framework consists of components such as Identify, Protect, Detect, Respond, and Recover which remind us of how important it is to balance proactive safeguards while preparing for worstcase scenarios.
Key objectives of the programme include:
- Documenting, disseminating, operating, and reviewing information security policies, and procedures
- Monitoring cyber security threats and reviewing the risk profile across all critical assets, infrastructure components and business units/departments
- Providing transparency into the information security programme and associated controls to senior management including board
- Responding promptly to information security incidents and policy violations/exceptions in accordance with organisational policy
- Determining whether the actions taken to resolve an incident were effective and whether corrective actions are required, and documenting lessons learnt
Key measures undertaken by us, to mitigate information security related risks are:
Antivirus/Malware Programme
We have implemented a programme to prevent, detect and react to the introduction of malicious code through sources such as computer viruses, worms, and Trojans. We use a combination of commercially available and proprietary tools and monitoring systems to mitigate the risks associated with malware. The antivirus signatures are updated more than once per day to stay current and cover workstations, servers, email gateways, web gateways.
Network Security
The Bank uses a combination of firewalls and proxy servers to separate and control traffic between networks with different security requirements and levels of trust. The Bank has intrusion detection/prevention capabilities in place to detect and react to known attacks in real time. IDS/IPS signatures are updated periodically to update detections for specific threats, intruder profiles, and attack patterns. These tools are configured to generate alerts when predefined thresholds are exceeded.
Vulnerability management
The Bank administrates a vulnerability management process that actively scans for security threats. The vulnerability management team is responsible for tracking and following up on vulnerabilities. Once a vulnerability requiring remediation has been identified, it is logged, prioritised according to severity, and assigned an owner. The vulnerability management team tracks such issues and follows up frequently until they can verify that the issues have been remediated.
Patch management
The Bank has patch management processes and tools to assess and deploy operating system and application specific patches and updates. This process includes steps to evaluate vendor supplied patches to determine servers that require patches and updates, to document procedures for patching and updating servers, and to deploy patches and updates in a timely manner to protect the Bank’s infrastructure.
Penetration testing
To test for potential vulnerabilities, penetration tests are conducted for all critical networks and systems within the Bank’s internal environment and for external applications. Penetration tests are triggered based on several events, including new releases, updates, or enhancements. The types of penetration tests that are conducted include Network/Host Penetration Testing and Application Penetration Testing.
Logging and monitoring
The Bank has a logging and monitoring procedure in place to deal with network intrusions and incidents. User actions, system activity and changes to the infrastructure are logged. Logs are stored securely and are protected against modification, deletion, and inappropriate access. The relative risk level of the asset and alerts are generated in the event of audit log failures. Monitoring tools aggregate the log files and suspicious activity events are automatically reported to the SOC (Security Operations Centre) team. The SOC team performs the following steps:
- Analysis and Incident Detection – The SOC team collects information from the system generated event as well as other information sources to identify a potential incident
- Event Tracking and Escalation – Events are assessed based on the level of risk and escalated based on guidance from the Incident Management policy; escalations include referral to the CIRT for indepth analysis and forensics and management for situation awareness
- Reporting – The CSOC team periodically reports on events and incidents to management
