Cyber Crisis Management and Resilience: A Cybersecurity Report

This report delves into the critical aspects of cyber crisis management and resilience, with a specific focus on the context of mobile banking. It begins with an analysis of the assets at risk, including customer data and financial information, and then identifies various threats, such as malware, application vulnerabilities, and phishing attacks. The report explores the role of incident response and the Computer Security Incident Response Team (CSIRT) in detecting and mitigating cyber threats. It outlines the incident response process, detailing the responsibilities of different participants like security analysts and network administrators. The report further elaborates on the CSIRT's functions, including incident analysis, vulnerability assessment, and providing recommendations for security improvements. It also discusses the CSIRT's coordination with IT teams, the development of incident management plans, and the importance of continuous monitoring and customer updates. Overall, the report provides a comprehensive overview of the challenges and strategies involved in managing cyber crises and building resilience in the financial sector.

Running head: CYBER CRISIS MANAGEMENT AND RESILIENCE
Cyber Crisis Management and Resilience
Name of the Student:
Name of the University:
Author Note

3CYBER CRISIS MANAGEMENT AND RESILIENCE
Table of Contents
Analysis of the assets and risks involved
The risks involved in mobile banking
Incident response and CSIRT
Incident process and response
Reference

3CYBER CRISIS MANAGEMENT AND RESILIENCE
Analysis of the assets and risks involved
There are a number of assets that are present in the mobile banking application and
also on the banking websites that are used by the customers of the bank for their day to day
transactions and also to manage their bank accounts. The assets that are present in the mobile
banking apps and the internet banking website are mainly the data of the customers of the
bank (Tanczer, Brass & Carr, 2018). This data not only includes the personal data of the
customers but also the information regarding the money in their account. The monetary assets
include the debit card, credit card, and bank account number of the users. The details of each
transaction that the user make are also present on mobile applications and banking websites
(Lekota & Coetzee, 2019). The banking applications also contain the information of the
beneficiaries or the information of other customers or companies to the customer of the bank
send and receive money.
The risks involved in mobile banking
The risk involved in mobile banking applications are discussed as follows:
1. Mobile banking applications face the risk of malware. Malware is a small program
that affects the performance of the mobile device that the customer is using to access
their respective bank account (Pfleeger, 2017). The mobile devices are also affected
by the different viruses and spying applications that get downloaded automatically
when the customer of the bank is trying to access the bank account.
2. Mobile banking applications also face the risk that the application design and the
security within the application are not good (Valladares et al., 2017). If the safety and
integrity of the mobile banking application are not high then the fraudsters who are
looking for faults in the application to hack in to get an opportunity. The login details
of the users of the bank account are at risk if the application’s configuration and
security are not properly designed.

3CYBER CRISIS MANAGEMENT AND RESILIENCE
3. Free wifi is another threat to the security of mobile banking applications. The mobile
banking applications, when accessed by the customers of the banks with the use of the
free wifi that is available to the public there, can be a threat to the security of the
application. The data of the user of the application might get visible to the fraudsters
who are trying to hack the system (Miranda & Ramirez, 2016). Again, sometimes the
fraudster opens wifi networks with the same name and password as that of the wifi
network that is publicly available. The user of the application might get confused and
use the wifi of the fraudster who is trying to hack their mobile banking application.
The Fraudsters can then access the data packets that are sent and received by the
customers of the banking applications.
4. The fingerprint of the customers of the banking applications is often used to
authenticate the login of the customers. But fraudsters are often able to fool the
applications into providing authentication to the login by the fraudster in the account
of the customer of the bank (Jalal, Shukur & Mokhtar, 2017).
5. Remote Deposit Capture is a process by which the customers of the bank account can
click a photo of the checks on their mobile phone and then use it as authentication for
depositing the check. But fraudsters and hackers have been able to find ways to hack
this type of authentication system also (de Jesus Martins et al., 2019). They mainly
hack this system by first hacking into the database containing numerous images of
checks that were uploaded by the customers of the bank before and then use them to
create duplicate checks that are so much like the original checks that the system
authenticates them.
6. The fraudsters often tend to create applications that are replications of the original
banking application that are used by the fraudster (Fuertes et al., 2017). The

3CYBER CRISIS MANAGEMENT AND RESILIENCE
customers of the bank get confused and unknowingly give their bank information into
the fraudster’s fake application.
7. Denial of service is another type of attack that is used by fraudsters to stop the access
of a customer of the bank to the mobile banking application and the banking website.
The fraudster generates a huge amount of traffic in the banking server and this results
in the customer of the bank not be able to access the bank’s mobile application and
the bank’s website (Mejía et al., 2016).
8. Phishing is another technique that is used by the fraudsters. In this technique, the main
motive of the fraudster is to gain information that is personal to the customers of the
bank. In this technique, the fraudster can also get access to the banking related
information and the log in detail of the user on the mobile application and the bank
website (Luna & Miranda, 2016). The fraudster sends random messages to the
customers of the bank and makes them feel that those messages are important and
authentic and also require the customer to send or input their own login details. In this
way, the fraudster can get access to the bank account of the customer of the bank.
9. Spoofing is also used by the fraudsters to disturb the flow of the services between the
bank and the customers of the bank. In this technique, the bank’s website is disturbed
by the generation of huge amounts of traffic in it. The bank’s server is overloaded
with a huge amount of traffic that is created by the fraudster. So the original
customers of the bank are not able to access the bank’s website and banking
application.
Incident response and CSIRT
Incident response is the process by which the bank detects the frauds in its
mobile banking application and its banking website and then provides an appropriate
response to safeguard its assets that are present over the internet (Mena et al., 2018). The

3CYBER CRISIS MANAGEMENT AND RESILIENCE
response to an attempt of fraudsters to hack the bank’s application and the website is not done
by a single participant. Numerous participants are given different tasks and then their tasks
are integrated to detect and protect the bank’s assets. There are various roles that are involved
in the process of responding to the incidents (Fučík, 2019). Security Analysts are required to
analyze the threat and the impact of the incident caused by the fraudster. There is an
individual or a team of individuals who are responsible for the handling of the incident. The
network administrators are required to perform a diagnosis of how the fraudster has been able
to pose a threat to the bank’s server (Mohd et al., 2016). The Human Resource team and other
officers who are responsible to protect the information of the bank and the customers of the
bank are involved in this process. The CSIRT is a part of the bank or a team in the bank that
has the main objective to provide an appropriate response to the incidents.
There are certain activities carried out by the CSIRT to handle the incident. These are as
follows:
1. The determination of the impact and the type of incident is done by the CSIRT.
2. The CSIRT has the duty to identify the technical fault that has made the event to
occur (Reyes et al., 2018).
3. The CSIRT has the duty to identify the potential loss and harm to the bank that might
be caused due to the incident.
4. The CSIRT has to research and find ways to protect the bank against the threat of the
incident.
5. The CSIRT needs to improve the security of the system so that future incidents do not
occur.
The CSIRT must have in-depth knowledge about the different types of attacks that the
fraudsters do to hack the bank’s mobile application and website (Mejía, Muñoz & Ramírez,

3CYBER CRISIS MANAGEMENT AND RESILIENCE
2016). The CSIRT is also responsible to provide appropriate measures to resolve the threats.
The CSIRT also updates the customers on each step of mitigation of the incident. Some other
responsibilities of the CSIRT are as follows:
1. Recommendation of the perfect technique to secure the configuration of the
application and also providing strategies to defend against the incidents to
protect the assets of the bank (Paolo Gasperi & First, 2018).
2. The analysis of the vulnerability of the security system and also the collection
and supervision of the network of the bank is done by the CSIRT (Reyes-
Mena et al., 2018).
3. The CSIRT is responsible to perform an audit of the security system of the
bank.
4. The CSIRT is responsible for providing information to the law and supports
them to collect data regarding the incident and regulate them.
The structure of the CSIRT is dependent on the organization it is working in. In
banking organizations, the CSIRT is comprised of staff who have the responsibility to handle
the incidents. The staffs who are in the CSIRT have specific skills and knowledge to handle
the different types of incidents that can occur. Since the CSIRT has specific knowledge so it
is advantageous as the staff can concentrate properly on the incident and use their individual
skills to provide a solution to the tasks that have been allotted to them. The CSIRT performs
in correlation with computer security and development experts. The four duties performed by
the CSIRT in coordination with the IT team are as follows:
1. The analysis of the effect of the threat to the bank’s mobile application and website.
2. The recommendation of the methods that have to be followed to resolve the incident.

3CYBER CRISIS MANAGEMENT AND RESILIENCE
3. The testing of the system to analyze whether the incident has been resolved and
whether the bank can continue its operations as normal.
4. Providing updates to the customers of the bank regarding the status of the handling of
the incident.
The purpose of the CSIRT is dependent on the type of industry. In the banking sector,
the CSIRT has the main role of continuous scanning of the computer systems and the bank’s
application and website to find faults in them and also to analyze whether there is an incident
of fraud in the organization. The CSIRT’s functions and responsibilities are much more
integrated with the banking sector than what they are in other sectors. The CSIRT’s task is
not just to use the technology to resolve the security incidents in the bank. The CSIRT also
has the task to develop a plan with which consists of many processes. These processes can be
consistent, repetitive and are understood and kept confidential within the bank. The plan that
is developed by the CSIRT must be integrated with the processes in the bank and also with
the organizational structure of the bank. The plan developed by the CSIRT must work in
collaboration with the IT policy and the business structure of the bank. The CSIRT must
include the following processes in the plan to manage the incident in proper order. They are
as follows:
● The CSIRT plan must include a notification related to the actions at the proper time.
● The CSIRT plan must include analysis of the incident, provide an appropriate
response to it and then resolve it.
● The CSIRT plan must work in collaboration with the IT team in the bank.
● The maintenance of the banking application and website and also track the previous
records in the responsibility of the CSIRT.

3CYBER CRISIS MANAGEMENT AND RESILIENCE
● The CSIRT’s plan must also include evaluating and assuring the quality of the mobile
application, website and the bank’s computer system to the bank and also to the
customers of the bank.
Incident process and response
If the customers of the bank have faced the security threat known as phishing the
CSIRT has the responsibility to resolve the incident. The CSIRT can use the NIST
framework to fight against the incident and to resolve the issue (Abe, 2018). According to the
NIST framework, the CSIRT must firstly detect or identify the route through which the
fraudster has been able to get the information of the customers of the bank. Then the CSIRT
team will try to analyze which security filter is at threat and what components of the bank can
be accessed by the fraudster (Hagiwara Kenta & Sugiura Yoshiki, 2017). Then the CSIRT
must develop plans that will safeguard the bank’s assets and also the assets of the customers
of the bank. This plan is executed by the CSIRT immediately so that the loss that will be
incurred by the bank and also the customers of the bank can be minimized. This plan will
include blocking access to the bank’s assets through the bank’s mobile application and also
the internet banking website of the bank. Then the CSIRT will use the NIST framework to
develop the plan of action to secure the system of the bank to normal. The plan that is
developed by the CSIRT is dividend into several processes. These processes consist of
individual tasks that are allotted to the different staff of the CSIRT team (Tsuyoshi Miyasaka
& Atsuhiro Goto, 2017). The tasks performed by each of the members of the CSIRT help to
identify the phishing technique that has been used by the fraudster to get the information of
the customers and the bank. The CSIRT will then check whether the phishing incident that
has occurred now is in any way related to any other incident that has been recorded before by
the CSIRT. The CSIRT stores all the incidents that occur in the bank in the database of the
bank. The plan that will be developed by the CSIRT will be based on the plan that was

3CYBER CRISIS MANAGEMENT AND RESILIENCE
adopted before in the similar cases of phishing that has occurred in the bank (Tsuyoshi
Miyasaka & Atsuhiro Goto, 2017). The response to the incident will be correlated with the
response that was made in similar cases of phishing before. So, the maintenance of the
database consisting of the previous incidents, the plan adopted to resolve them and also the
responses made to the incident are very crucial (Tsuyoshi Miyasaka & Atsuhiro Goto, 2017).
Then the CSIRT will analyze how much threat the phishing incident poses to the bank and to
the customers of the bank. Then the methods that will be adopted to eradicate the threat that
has been made by the fraudster (Paolo Gasperi & First, 2018). The CSIRT will provide
updates in the response of the plan to the phishing incident. These updates will be provided to
the customers through the use of notifications. The CSIRT will then eradicate the phishing
incident with the use of a step by step process (Paolo Gasperi & First, 2018). The CSIRT will
update the current system to be able to block the current phishing attack that has been made
by the fraudster. The CSIRT will then test the new system and then implement it. The CSIRT
will then contain the phishing incident into the database of the bank. The CSIRT will look for
malware eradication processes that can be used for the phishing incident. Finally, the system
will be recovered by the CSIRT and the incident will be recorded into the database of the
bank. This recording of the incident will help the CSIRT to manage future incidents that
might be similar to this incident.

3CYBER CRISIS MANAGEMENT AND RESILIENCE
Reference
Tanczer, L. M., Brass, I., & Carr, M. (2018). CSIRT s and Global Cybersecurity: How
Technical Experts Support Science Diplomacy. Global Policy, 9, 60-66.
Lekota, F., & Coetzee, M. (2019, August). An Aviation Sector CSIRT for Sub-Saharan
Africa. In International Information Security Conference (pp. 28-42). Springer, Cham.
Pfleeger, S. L. (2017). Improving Cybersecurity Incident Response Team (CSIRT) Skills,
Dynamics and Effectiveness. Trustees of Dartmouth College Hanover United States.
Valladares, P., Fuertes, W., Tapia, F., Toulkeridis, T., & Pérez, E. (2017, July). Dimensional
data model for early alerts of malicious activities in a CSIRT. In 2017 International
Symposium on Performance Evaluation of Computer and Telecommunication Systems
(SPECTS) (pp. 1-8). IEEE.
Miranda, J. M., & Ramirez, H. (2016). Estableciendo controles y perímetro de seguridad para
una página web de un CSIRT. RISTI-Revista Ibérica de Sistemas e Tecnologias de
Informação, (17), 01-15.
Jalal, I., Shukur, Z., & Mokhtar, M. R. (2017, November). 3C-CSIRT model a sustainable
national CSIRT for afghanistan. In 2017 6th International Conference on Electrical
Engineering and Informatics (ICEEI) (pp. 1-4). IEEE.
de Jesus Martins, R., Knob, L. A. D., da Silva, E. G., Wickboldt, J. A., Schaeffer-Filho, A., &
Granville, L. Z. (2019). Specialized CSIRT for Incident Response Management in Smart
Grids. Journal of Network and Systems Management, 27(1), 269-285.
Fuertes, W., Reyes, F., Valladares, P., Tapia, F., Toulkeridis, T., & Pérez, E. (2017). An
Integral Model to Provide Reactive and Proactive Services in an Academic CSIRT Based on
Business Intelligence. Systems, 5(4), 52.

3CYBER CRISIS MANAGEMENT AND RESILIENCE
Mena, F. X. R., Díaz, W. M. F., Jaramillo, C. E. G., Estévez, E. P., Barzallo, P. F. B., &
Silva, C. J. V. (2018). Application of business intelligence for analyzing vulnerabilities to
increase the security level in an academic CSIRT. Facultad de Ingeniería, 27(47), 19-27.
Fučík, J. (2019). CSIRT: V přední linii boje proti kybernetickým hrozbám. Univerzita
Obrany. Ustav Strategickych Studii. Obrana a Strategie, 2019(1), 55-56.
Mejía, J., Muñoz, M., Ramírez, H., & Peña, A. (2016). Proposal of content and security
controls for a CSIRT website. In New Advances in Information Systems and Technologies
(pp. 421-430). Springer, Cham.
Reyes, F., Fuertes, W., Tapia, F., Toulkeridis, T., Aules, H., & Pérez, E. (2018, July). A BI
Solution to Identify Vulnerabilities and Detect Real-Time Cyber-Attacks for an Academic
CSIRT. In Science and Information Conference (pp. 1135-1153). Springer, Cham.
Mohd, N., Yunos, Z., Ariffin, A., Nor, A., & Malaysia, C. (2016, September). CSIRT
Management Workflow: Practical Guide for Critical Infrastructure Organizations. In
Proceedings of the 10th European Conference on Information Systems Management, ECISM.
Mejía, J., Muñoz, M., & Ramírez, H. (2016, June). Proposed framework for the CSIRT
protection. In 2016 11th Iberian Conference on Information Systems and Technologies
(CISTI) (pp. 1-7). IEEE.
Paolo Gasperi, C. I. S. M., & First, C. T. (2018). Web Monitoring: From Big Data to Small
Data Analysis Through OSINT.
Reyes-Mena, F. X., Fuertes-Díaz, W. M., Guzmán-Jaramillo, C. E., Pérez-Estévez, E.,
Bernal-Barzallo, P. F., & Villacís-Silva, C. J. (2018). Application of business intelligence for
analyzing vulnerabilities to increase the security level in an academic CSIRT. Revista
Facultad de Ingeniería, 27(47), 21-29.

3CYBER CRISIS MANAGEMENT AND RESILIENCE
Luna, H. E. R., & Miranda, J. M. (2016). Propuesta de infraestructura técnica de seguridad
para un Equipo de Respuesta ante Incidentes de Seguridad (CSIRT). ReCIBE, 4(1).
Abe K. (2018). The role of CSIRT in the ANA Group: How to achieve the CSIRT expected
by management with a minimum number of in-house personnel (Special Issue IT Strategy
and Security). Business research , (1083), 18-27.
Hagiwara Kenta, & Sugiura Yoshiki. (2017). Minimum requirements of CSIRT. Computer
Security Symposium 2017 Proceedings , 2017 (2).
Tsuyoshi Miyasaka, & Atsuhiro Goto. (2017). Information exchange between CSIRTs. Proc.
Of the 79th Annual Conference , 2017 (1), 563-564.