Spear Phishing Is A Potential Threat To Financial Institutions

Cyber security of banking and financial institutions has become very important these days. Recently the Citicorp confirmed the occurrence of cyber attack upon its bank’s network. In India as well ATM frauds, credit card frauds, online banking frauds, etc have increased a lot.

However, of all these cyber crimes, phishing is the most dangerous one for banking customers. If it is a case of spear phishing, it becomes deadly as the targeted person is specifically targeted for this purpose. The attack tactics are also specifically designed for the attack purposes.

The spear phishing cases appear so genuine that even tech savvy people are fooled into divulging sensitive information. Recently Reserve Bank of India (RBI) constituted a working group on information security that gave many good cyber security recommendations. However, the implementation of these recommendations has still not been achieved.

This gives lots of space for cyber crimes like spear phishing. Recent break-ins at high-profile targets like the International Monetary Fund (IMF) demonstrate just how proficient hackers have become at spear phishing.

Today's spear phishing is not only more prevalent but also much more technically proficient. They're not going for a password, anymore, they're getting people to install malware on their computers.

According to the reports the IMF suspected that a phishing attack against one of its workers planted malware on a machine, which was then presumably used to scout the network for data to steal. But the IMF incident was only the most recent in a series of specialized attacks this year aimed at targets from the Oak Ridge National Laboratory and the French foreign ministry to Google's Gmail.

Recent cyber attacks on multinational firms and institutions, from Google and Citigroup to the International Monetary Fund, have raised fears that governments and the private sector are ill-prepared to beat off hackers. The latest high-profile target was the U.S. Senate's website, which was hacked over the weekend.

However, as far as India is concerned, it has neither a good cyber security strategy nor a strong cyber law. Even cyber crisis management plan of India is practically missing. Indian banks must urgently revamp their cyber security so that interests of bank customers can be safeguarded.

Cyber Security Must Be An International Issue

I personally believe that Cyber Security is an “International Issue” and not a “National One”. Those who believe it to be a National Issue are going to suffer a lot. Similarly, “Self Regulation” is not going to help us in the long run especially when countries all over the world are establishing Cyber Commands and Cyber Warfare Capabilities.

I also believe that despite all odds, we must try to formulate International Cyber Law Treaty and International Cyber Security Treaty. Without clearly demarcating the “Roles and Responsibilities” of Nations in the Cyberspace, International Mutual Cooperation in this regard is next to impossible.

United Nations has a bigger role to play in this regard. On the one hand it must formulate International Cyber Law and Cyber Security Treaty whereas on the other hand it must make these Treaties in conformity with the Human Rights in Cyberspace.

Developed Countries like US are not interested in Treaties on Cyber Law and Cyber Security except to the extent permitted by present International Legal Framework .This Framework was formulated at a different time and in a different context. It is high time to abandon the same in the larger interest of “International Community”.

The growing Cyber Attacks on Gmail, Citicorp, etc are happening because of this “Void” at the International level. This “Void” is also forcing the Countries to adopt their own Cyber Security safeguards. Australia has planned a Cyber Defence Strategy whereas European Union has set up a team of Cyber Crime Fighters. Countries are adopting this “National Approach” because there is no “International Framework” to deal with these issues.

The sooner we have International Frameworks for Cyber Law and Cyber Security related issue the better it would be for the interest of International Cyberspace Community at large.