---

By Chandeepa Wettasinghe

espite Sri Lanka currently not being in a state of war and not facing foreign invasion, the country is ceaselessly engaged in cyber warfare, and a gap in the lines may bring the country’s economy to its knees, Central Bank Governor, Ajith Nivard Cabraal said.

Cabral expressed his views on protecting our cyber presence, especially in the banking sector from such attacks during the launch of Bank Computer Security Incident Readiness Team (Bank CSIRT) yesterday, a body formed to prevent cyber attacks on banks.

“Banks must maintain integrity, and protect sensitive privileged information, or the public will lose faith in the institutions. Therefore The Central Bank is committed to maintaining stability in the banking system,” Cabraal noted.

Secretary to the President, Lalith Weeratunga who delivered the keynote speech said, CSIRT is “one of the most important things in modern internet and banking.”
He stated that previously, if attacks originated within the country, they were easy to isolate due to the relatively fewer Information and Communication Technology (ICT) users compared with the present.

He also revealed that many people have been victims of cyber attacks recently, divulging their personal and financial information, and even transferring funds to the account of the attackers.

 “Invasion of information systems occur daily, however, a sudden spike in major phishing attacks, over 250, were recorded during the recent turbulence in Aluthgama, with attackers attempting to take advantage of the chaos.”

Banks must maintain integrity, and protect sensitive privileged information, or the public will lose faith in the institutions

 However, Weeratunga said the Computer Emergency Readiness Team | Coordination Centre (CERT|CC) the national CERT which created CSIRT was up to the challenge of protecting the country’s data, and act as the country’s front line soldiers, fighting the war thanklessly, away from the public eye.

 CERT|CC was established in 2008, following the implementation of the Computer Crimes Act in 2007, and Weeratunga expressed his disappointment over the lack of public focus and awareness of such a critical Act compared to others.

 The 2007 Act was derived from the Council of Europe’s Convention on Cybercrime 2001, also known as the Budapest Act. In a move to become integrated with the global cyber security efforts, the Cabinet of Sri Lanka this year became a signatory of the Budapest Convention.

 “The presence of cyber terrorism and cyber laundering have increased globally, while the types of threats encountered evolve in complexity daily, and a high price will have to be paid if the country’s ICT network collapses,” said Weeratunga.

 He said that ICT allowed the public new convenience, being able to transfer money before their morning cup of coffee, or withdrawing money from an ATM on their way to work.

 He concluded his speech saying that ICT must be taken to the rural areas and that the wide ICT networks that are being created should be fully utilized, giving the public simple knowledge in using it.

 Invasion of information systems occur daily, however, a sudden spike in major phishing attacks, over 250, were recorded recently

 According to a government survey last year, ICT literacy- which in the modern age is also factored in with general literacy in the country rose to 45 percent, from just 3 percent in 2005.

 Sri Lanka’s efforts towards increasing cyber security was recognized by the UN in the 2014 United Nations eGovernment Development Index, according to which, the country has advanced 41 places to the 74th position.

Bank CSIRT was launched by LankaClear (Pvt) Ltd; a company owned jointly by The Central Bank of Sri Lanka and all Commercial Banks, and the country’s CERT. The goal of this new organization is to protect all banks within the country from cyber attacks.

 “Some banks have more sophisticated security while many are less privileged banks with not much resources. Yet attacks are common on them all, and resolving issues in isolation is not enough,” said Sunimal Weerasooriya, GM/CEO of LankaClear addressing CEOs and CIOs of banks who were present.

CSIRT will allow all banks to share instances of cyber attacks, fraud information and other issues, while also allowing the registration of 3rd party security providers and instant response to attacks.

 He did reassure that “even though banks will share information with CSIRT, sensitive information of customers will not be shared.” A new secure website was launched, allowing financial institutions to report about attacks.

 CSIRT will implement updates from International CERT organizations; over 400 composed of both national and private institutes, including from Google and governments of USA, Japan and South Korea.

 Finally, speaking of the future of CSIRT, he envisioned Banks establishing private Security Operation Centres (SOCs) in collaboration as well as creating a centralized SOC to take part in the ongoing battle for cybersecurity.

CERT wishes to establish CSIRTs for Military, Education and Internet Services in the near future.