Chapter 1: Fundamentals of Cyber Security

Every modern financial institution, exchange, clearing corporation, depository, and market intermediary in the Gujarat International Finance Tec-City (GIFT) International Financial Services Centre (IFSC) depends intrinsically on digital information technology to execute cross-border capital transactions, maintain multi-currency ledgers, and deliver instantaneous market connectivity. This extreme operational reliance transforms information assets into critical corporate capital that must be safeguarded against sophisticated cyber adversaries, systemic outages, and data corruption.

Cyber security is defined as the comprehensive body of technologies, processes, and practices designed to protect computer systems, communication networks, digital applications, and data from unauthorized access, malicious exploitation, theft, alteration, or disruption. Its overarching objective is to preserve the confidentiality, integrity, and availability of digital information assets while maintaining institutional trust and compliance with international and statutory norms.

                           THE CIA TRIAD FOUNDATION
                                      │
                   ┌──────────────────┼──────────────────┐
                   ▼                  ▼                  ▼
          [ CONFIDENTIALITY ]    [ INTEGRITY ]     [ AVAILABILITY ]
          - Data privacy         - Accuracy        - Timely access
          - Need-to-know         - Completeness    - High resilience
          - Encryption / ACLs    - Hashing / MACs  - Redundancy / DR

The Foundational CIA Triad

1. Confidentiality:

   • Ensures that sensitive financial data, customer identities, proprietary trading algorithms, and strategic business information are accessible only to explicitly authorized personnel and applications.
   • Prevents unauthorized observation, interception, or exfiltration during storage (at-rest), transit across public/private networks, or runtime memory execution (in-use).
   • Core Controls: Multi-layered encryption (AES-256), cryptographic key lifecycle management, granular Access Control Lists (ACLs), role-based permissions, and strict physical access security.

2. Integrity:

   • Guarantees that financial records, contract specifications, transaction audit trails, and core banking databases remain completely accurate, authentic, and unaltered throughout their lifecycle.
   • Shields data against unauthorized, undetected modifications, deliberate tampering, malicious injection, or accidental system corruption.
   • Core Controls: Cryptographic hashing (SHA-256, SHA-3), Message Authentication Codes (HMAC), digital signatures (PKI), database transaction logs, write-once-read-many (WORM) storage, and dual-custody authorization.

3. Availability:

   • Ensures that critical systems, high-speed matching engines, clearing interfaces, and real-time payment settlement gateways are accessible to authorized market participants whenever demanded by business operations.
   • Mitigates downtime risks arising from hardware failures, network fiber severance, power grid collapse, distributed denial-of-service (DDoS) attacks, or ransomware extortion.
   • Core Controls: High-availability system clustering, automated load balancing, geo-redundant Disaster Recovery (DR) data centers, active-active server replication, uninterruptible power supply (UPS), and robust Business Continuity Plans (BCP).

Global Supporting Principles of Information Security

Beyond the CIA triad, internationally recognized standards—including ISO/IEC 27001, the CPMI-IOSCO Guidance on Cyber Resilience for Financial Market Infrastructures, and IFSCA guidelines—mandate adherence to six critical supporting principles:

Effective cyber risk governance requires a common, standardized lexicon. In accordance with international risk frameworks (ISO 31000, NIST SP 800-30), cyber risk represents the potential operational, financial, legal, or reputational loss resulting from the exploitation of information system vulnerabilities by cyber threats.

Standardized Cyber Security Risk Terminology

   [ THREAT AGENT ] ──────> [ THREAT EVENT ] ──────> [ VULNERABILITY ] ──────> [ BUSINESS IMPACT ]
   (Nation-State /          (Phishing / DDoS /       (Unpatched Flaw /         (Financial Loss /
    Cybercriminal /          Ransomware)              Weak Config / Human)      Regulatory Fine /
    Malicious Insider)                                                          Downtime)
            │                                                 │
            └───────────────> [ INHERENT RISK ] <─────────────┘
                                      │
                         [ MITIGATING CONTROLS ]
                                      │
                                      ▼
                             [ RESIDUAL RISK ]
                                      │
                   ┌──────────────────┴──────────────────┐
                   ▼                                     ▼
        Within Risk Appetite?                 Exceeds Risk Appetite?
             [ ACCEPT ]                       [ TREAT / MITIGATE ]
                                              [ TRANSFER (Insurance) ]
                                              [ AVOID (Terminate) ]

• Threat: Any circumstance, natural disaster, human adversary, or malicious event with the potential to cause harm to an information system, data, or organizational operations.
• Vulnerability: A flaw, architectural weakness, or misconfiguration in technology, processes, physical security, or human behaviour that can be exploited by a threat agent (e.g., an unpatched software flaw, default admin credentials, or lack of employee cyber awareness).
• Exploit: A piece of software, script, payload, or technique developed by threat actors to take advantage of a specific vulnerability to gain unauthorized access or compromise a system.
• Exposure: The extent to which an organization's digital assets and attack surface are open and susceptible to external threats (e.g., exposing an unauthenticated remote desktop port directly to the public internet).
• Inherent Risk: The raw, baseline level of risk present in a system or business activity in the total absence of any compensating safeguards, security controls, or managerial countermeasures.
• Residual Risk: The remaining risk level after security controls, patches, policies, and compensating safeguards have been implemented and validated.
• Risk Appetite: The aggregate quantum and type of cyber risk an organization's Board of Directors is explicitly willing to accept in pursuit of its commercial objectives and strategic mission.
• Risk Tolerance: The maximum acceptable variation or boundary around risk appetite; the absolute limit beyond which risk exposure is considered unacceptable and requires immediate remediation.

The Threat Actor Taxonomy

Modern financial institutions face a diverse spectrum of threat actors characterized by varying capabilities, resources, and motivations:

1. Nation-State and Advanced Persistent Threats (APTs): Highly sophisticated, state-sponsored cyber military groups with immense resources. Motivations: Geopolitical espionage, systemic economic disruption, critical infrastructure surveillance, and intelligence exfiltration.
2. Organized Cybercrime Syndicates: Financially motivated professional criminal networks. Specializations: Ransomware-as-a-Service (RaaS), banking trojans, automated credential stuffing, business email compromise (BEC), and wire fraud.
3. Malicious and Negligent Insiders: Employees, contractors, or third-party vendor staff with legitimate network credentials. Malicious insiders act out of financial bribery, extortion, or grievance; negligent insiders inadvertently cause data leaks through phishing clicks or misconfigured cloud storage.
4. Hacktivists: Politically or ideologically motivated actors utilizing distributed denial-of-service (DDoS) attacks, website defacements, and unauthorized data dumps to publicize socio-political causes.

Threat Modelling Methodologies: STRIDE and DREAD

Threat modelling is an engineering-based approach to systematically identifying, enumerating, and prioritizing potential threats confronting an application architecture, network interface, or business workflow.

The STRIDE Threat Classification Model (Microsoft)

The DREAD Risk Rating System

DREAD calculates a quantitative risk score (typically on a 1–10 scale across five parameters) to rank identified vulnerabilities: $$ ext{DREAD Score} = rac{ ext{Damage} + ext{Reproducibility} + ext{Exploitability} + ext{Affected Users} + ext{Discoverability}}{5}$$

Where:

• Damage Potential: Severity of operational or financial destruction caused by exploitation.
• Reproducibility: Ease with which an attacker can consistently replicate the exploit.
• Exploitability: Technical sophistication and tooling required to execute the exploit.
• Affected Users: Proportion of user base, accounts, or critical servers compromised.
• Discoverability: Likelihood that threat actors will locate the flaw through automated scanning or reverse engineering.

Global financial market regulators, including the International Financial Services Centres Authority (IFSCA), expect regulated entities to anchor their cyber defense architecture in globally validated cybersecurity frameworks. These frameworks provide structured taxonomies, control catalogues, and benchmarking mechanisms to ensure comprehensive defense, governance, and resilience.

                      GLOBAL CYBER SECURITY FRAMEWORKS
                                     │
     ┌───────────────────┬───────────┴───────────┬───────────────────┐
     ▼                   ▼                       ▼                   ▼
[ NIST CSF 2.0 ]   [ ISO/IEC 27001:2022 ]  [ CPMI-IOSCO ]      [ PCI DSS v4.0 ]
- 6 Core Functions - ISMS Management System- Resilience for     - Cardholder Data
  (GOVERN added)   - 4 Control Themes        FMIs (Exchanges,     Environment
- Outcome-driven     (93 controls)           Clearing Corps)    - 12 Requirements

1. NIST Cybersecurity Framework (NIST CSF 2.0)

Published by the National Institute of Standards and Technology (NIST), CSF 2.0 expands the classic 5-function paradigm by introducing GOVERN as the central, foundational pillar that informs and orchestrates the entire cybersecurity lifecycle:

                          NIST CSF 2.0 CORE FUNCTIONS
                                       │
                                 [ GOVERN (GV) ]
                       Organizational Context, Risk Strategy,
                          Policy & Oversight Architecture
                                       │
                 ┌─────────────────────┴─────────────────────┐
                 ▼                                           ▼
          [ IDENTIFY (ID) ]                           [ PROTECT (PR) ]
     Assets, Risks, Supply Chain               Identity, Data, Access, Training
                 │                                           │
                 └─────────────────────┬─────────────────────┘
                                       ▼
                                [ DETECT (DE) ]
                          Monitoring, Anomalies, SOC
                                       │
                 ┌─────────────────────┴─────────────────────┐
                 ▼                                           ▼
          [ RESPOND (RS) ]                            [ RECOVER (RC) ]
      Triage, Mitigation, Comms                 Restoration, Improvements

1. Govern (GV): Establishes organizational cybersecurity risk strategy, policies, operational roles, enterprise alignment, regulatory compliance mandates, and board oversight mechanisms.
2. Identify (ID): Determines enterprise digital assets, hardware inventories, software configurations, suppliers, vulnerabilities, and cyber risk profiles.
3. Protect (PR): Deploys protective engineering safeguards, access controls, data security, zero-trust perimeters, identity management, and employee awareness training.
4. Detect (DE): Operates continuous security monitoring, SIEM log analysis, EDR anomaly detection, and Security Operations Centre (SOC) workflows to identify cyber events rapidly.
5. Respond (RS): Executes incident response plans, containment protocols, forensic triage, regulatory reporting, and stakeholder communications during an active breach.
6. Recover (RC): Restores systems, critical services, and data repositories to normal operations, incorporating lessons learned to strengthen future cyber resilience.

2. ISO/IEC 27001:2022 Information Security Management System (ISMS)

ISO/IEC 27001 is the internationally audited benchmark for establishing, implementing, operating, monitoring, reviewing, and continuously improving an enterprise ISMS:

• Clauses 4 through 10: Organizational context, leadership commitment, risk planning, support resources, operational controls, performance evaluations, and internal audit mechanisms.
• Annex A (2022 Revision): Streamlined into 93 controls categorized across 4 distinct operational themes:
  1. Organizational Controls (37 controls): Policies, asset management, cloud services governance, threat intelligence, and third-party security.
  2. People Controls (8 controls): Background screening, remote working, confidentiality agreements, and disciplinary processes.
  3. Physical Controls (14 controls): Physical security perimeters, environmental controls, equipment siting, and secure disposal of media.
  4. Technological Controls (34 controls): Secure authentication, access restriction, configuration baselines, cryptography, vulnerability management, and network segregation.

3. CPMI-IOSCO Guidance on Cyber Resilience for Financial Market Infrastructures (FMIs)

The Committee on Payments and Market Infrastructures (CPMI) and the International Organization of Securities Commissions (IOSCO) published specialized guidelines tailored specifically for high-systemic-impact entities—such as international stock exchanges, clearing corporations, and central securities depositories operating in GIFT IFSC:

• Two-Hour Recovery Time Objective (2-Hour RTO): Mandates that critical financial market infrastructures must design their systems to recover operations and resume processing within 2 hours following a severe cyber disruption.
• End-to-End Resilience by Design: Requires FMIs to maintain independent, air-gapped disaster recovery ledgers, continuous real-time cross-site data mirroring, and zero data loss objectives (RPO $pprox$ 0).
• Adversarial Testing (Red Teaming): Regular threat-led penetration testing using real-world cybercriminal tactics, techniques, and procedures (TTPs).

4. Payment Card Industry Data Security Standard (PCI DSS v4.0)

Applies to all banking units, payment processors, and fintech entities in GIFT IFSC handling debit/credit card transactions:

• Structured around 12 prescriptive requirements across 6 control objectives:
  1. Build and maintain secure networks (firewalls, default passwords eliminated).
  2. Protect cardholder data (encryption of stored PAN, TLS 1.3 in transit).
  3. Maintain vulnerability management programmes (anti-malware, secure software).
  4. Implement strong access control measures (need-to-know, unique IDs, MFA).
  5. Regularly monitor and test networks (logging, wireless scanning, annual penetration testing).
  6. Maintain an information security policy.