Security architecture

Why it matters

Banks are attractive targets because they hold money and personal data, and because their systems connect to thousands of others. Security architecture decides how far an attacker can get after the first mistake: a phished password, an unpatched server, a misconfigured cloud bucket. The goal is not a system that can never be breached, but one where a breach is contained, detected quickly and reported properly.

This page describes principles and common patterns only. It does not describe any organisation’s actual controls.

The model explained

Defence in depth and zones

Defence in depth stacks independent controls so that each failure is caught by the next layer. The network is split into zones by trust level, and traffic between zones passes through controlled points. The most sensitive systems, such as the core ledger and the systems that handle keys and PINs, sit in the innermost zone and accept connections only from specific systems in the zone next to them.

Card data scope

Systems that store, process or transmit card numbers fall under strict card-industry security rules. Architects shrink that scope by keeping card data in as few systems as possible and replacing it with tokens everywhere else, so most of the estate never sees a real card number.

Hardware security modules

A hardware security module (HSMHardware security module. A tamper-resistant device that stores cryptographic keys and performs operations such as PIN verification.) is a tamper-resistant device that stores cryptographic keys and performs operations with them, such as verifying a PIN or signing a message, without ever revealing the key. Payment PINs are checked inside HSMs, so no application server ever holds a PIN in clear text.

Privileged access, just in time

Administrator accounts can change anything, so they are the most valuable thing an attacker can steal. Privileged access management (PAMPrivileged access management. Tools and controls that govern who can use powerful administrator accounts, and record what they do.) keeps those credentials in a vault, grants access through a controlled gateway and records every session. Just-in-time access goes further: nobody holds standing administrator rights, and access is granted for a specific task, approved, time-limited and revoked automatically.

Secrets, zero trust and detection

Applications need passwords, keys and certificates to talk to each other. A secrets vault issues them at run time and rotates them, so they are never written into code or configuration files. Zero trust means no request is trusted just because it comes from inside the network; every call is authenticated and authorised. A SIEMSecurity information and event management. A system that collects security logs from many sources and raises alerts on suspicious patterns. collects logs from across the estate and raises alerts on suspicious patterns, and a security operations team investigates them.

How it plays out in Indian banking

RBIReserve Bank of India. India's central bank. It regulates banks and payment systems, runs RTGS and NEFT, and holds the accounts in which banks settle with one another. sets the governance frame for IT and cyber security: RBI issued the Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices on 7 November 2023 (RBI/2023-24/107).^{5Reserve Bank of India. Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices (RBI/2023-24/107). As of 7 November 2023.} Reporting deadlines are short, and they apply even when the incident happens at a supplier. CERT-In's directions of 28 April 2022 under section 70B(6) of the IT Act require reportable cyber incidents to be reported to CERT-In within 6 hours of noticing them; they took effect 60 days after issue.^{1CERT-In, Ministry of Electronics and Information Technology. Directions under sub-section (6) of section 70B of the IT Act, 2000 (28 April 2022). As of 28 April 2022.} A service provider must report cyber incidents to the regulated entity without undue delay, so that the entity can report them to RBI within 6 hours of the provider detecting them.^{2Reserve Bank of India. Master Direction on Outsourcing of Information Technology Services (RBI/2023-24/102). As of 10 April 2023.} Detection and escalation therefore have to be fast enough to meet those clocks.

Card data rules have shrunk the attack surface for online payments. Since 1 October 2022, no entity in the card payment chain other than card issuers and card networks may store actual card data; merchants use tokens instead.^{3Reserve Bank of India. Restriction on Storage of Actual Card Data [i.e. Card-on-File (CoF)] (RBI/2022-2023/95). As of 28 July 2022.} Digital certificates for the banking sector have their own certifying authority: IDRBT is the certifying authority for digital certificates in the Indian banking and financial sector under the IT Act, 2000.^{4Institute for Development and Research in Banking Technology. About IDRBT. As of 1 January 2025.}

Trade-offs

Failure modes

• Flat networks, where one compromised server can reach the core directly.
• Standing administrator accounts shared by teams, with no record of who did what.
• Secrets in code or configuration files that end up in a repository or a backup.
• Alerts no one reads, where monitoring exists but is not staffed or tuned.
• Supplier blind spots, where an incident at a service provider is not passed on quickly enough to meet reporting deadlines.

When to use it, and when to avoid it

Every principle here applies to every bank; the question is depth. Put the strongest controls around what would hurt most: money movement, keys, customer data and administrator access. Avoid security measures that people work around, such as approval steps so slow that teams share credentials to meet a deadline. A control that is bypassed in practice gives false comfort.

Questions for a design review

• If one application server is compromised, which systems can it reach?
• Who holds standing administrator rights today, and could that be replaced with just-in-time access?
• Where are keys and PINs handled, and does any application ever see them in clear?
• Where are application secrets stored, and how often are they rotated?
• Can an incident at a supplier be detected and reported to the regulator within the deadline?