Circular Regarding Confronting Cyberattack Risks No. (8821/1/10) dated 2016/6/29

In the Name of Allah, the Most Gracious, the Most Merciful

Number: 8831
Date: 10/1/1437 AH
Corresponding to: 29/6/2016 AD

Circular to Licensed Banks

Greetings,

In light of the increasing reliance of banks on information systems and telecommunications technologies in their operations, which has led to an increased probability of exposure to operational, reputational, and liquidity risks, particularly those resulting from fraud, identity theft, and extortion via information and communications technology means, and in the face of increasing cyberattack risks faced by banks worldwide, I emphasize the necessity of continuing to develop and operate mechanisms capable of effectively protecting the bank's assets and interests, as well as those of its clients, by identifying, detecting, and recovering from any attempts at electronic intrusion.

Whereas attackers in cyberattacks use diverse and new techniques, such as deploying malware that disrupts bank services in various ways, including so-called (Ransomware), in addition to Distributed Denial of Service (DDoS) attacks, and stealing identity data and sensitive bank and customer data to execute unauthorized banking transactions and transfers, and to extort the bank and its clients.

I emphasize the necessity of banks continuing to develop their operations related to information technology, information security, risk management, and business continuity to confront cyberattack risks, including those mentioned above, by observing the following matters, detailed in the attachment:

1. Continuing to identify and assess information technology and security risks, including new risks from emerging hacking technologies.

P.O. Box 37 • Amman 11118 Jordan • Phone: 4630301 Fax: 4638889, 4638624 • Website: www.cbj.gov.jo • Email: info@cbj.gov.jo Form (1/1/09)

---

2. Regulating the standards of operating systems, software, network elements, and protection systems, and managing them in a manner that limits the risk of electronic intrusion.
3. Providing protection controls against unauthorized intrusion, by limiting the number of identification codes used for access and use of various systems by those with sensitive privileges (Administrators).
4. Utilizing information technology resources to monitor and prevent unauthorized access, such as Intrusion Detection Systems and antivirus systems, ensuring they are continuously updated and effectively utilized in monitoring and intrusion detection processes.
5. Continuously updating training and awareness programs to include cyberattack methods (Cyber Attack), including extortion, and how to identify, prevent, and report information security incidents for both bank employees and customers.
6. Continuously utilizing and examining protection controls for systems, such as access controls and identity authentication, segregation of conflicting duties, and utilizing fraud detection and monitoring systems.
7. Reviewing and examining the reliability and updating of incident response and handling procedures specific to information security, and the bank's business continuity plans, as well as those of service providers.
8. Utilizing information provided regarding emerging hacking technologies and how to counter, handle, and mitigate their risks by participating in reliable forums and websites for awareness regarding protection from electronic security breaches, such as (Computer Emergency Response Team) (CERT) worldwide, or any other similar sources.

Emphasizing the necessity of complying with reporting to the Central Bank about any intrusions or incidents the bank faces in a timely manner, according to our instructions in this regard.

Please accept the highest respect,

The Governor
Dr. Ziad Friez

• Attachment

Form (1/1/09)

---

Attachment

1. Continuing to identify and assess information technology and security risks, including new risks from emerging hacking technologies, and working to utilize protection controls for services and sensitive data against identity theft risks using "Strong Authentication" means by utilizing identity confirmation technologies that use two or more of the following authentication categories (Something you Know, Something you Have, Something you Are, and Something you Do), and utilizing layered security controls (Security in Depth Layered Security), in addition to providing necessary work mechanisms to ensure that service providers assisting with the bank's and customers' data are committed to utilizing necessary controls to control risks, including regular examination of those controls by trusted third parties (Trusted Third Parties), and committing to providing banks with immediate reports on intrusion attempts and information security incidents affecting the bank's data and services by providers.
2. Regulating the standards of operating systems, software, network elements, and protection systems, and managing them in a manner that limits the risk of electronic intrusion, by utilizing virtual and physical network segmentation technologies and using strong encryption methods for transmitting and storing sensitive data, maintaining an inventory log of authorized systems and devices, and deleting or disabling unused devices and services.
3. Providing protection controls against unauthorized intrusion, by limiting the number of identification codes used for access and use of various systems by those with sensitive privileges (Administrators), and continuously monitoring their use to detect any attempts at unauthorized intrusion, and continuously reviewing the access and usage privileges granted on various systems to ensure they are appropriate to the nature of work (Role-based Access Privileges) and used legitimately, and deleting or disabling unused identification codes immediately, and establishing rules for access and use for systems such as the principle of least privilege (Least Privileges) and defining a specific time and place for the administrator for access, in addition to conducting regular periodic reviews, as needed, of the access and usage privileges granted on systems and software, and not allowing users to possess (Administrator) privileges on their devices except in the narrowest limits and with justified exceptional approvals, and changing default passwords (Default Passwords) for new systems immediately upon use, and prohibiting the use and connection of computers and mobile devices owned by employees, users, and third parties with the bank's networks and technological infrastructure, and utilizing monitoring controls to detect devices connected to the bank's networks and resources in unauthorized ways.
4. Utilizing information technology resources to monitor and prevent unauthorized access, such as Intrusion Detection Systems and antivirus systems, ensuring they are continuously updated and effectively utilized in monitoring and intrusion detection processes, and utilizing protection rules via (Firewalls) systems operating at the (Application Layer) and detecting and monitoring changes to those rules immediately to ensure they are not altered in preparation for an intrusion (Passive Attack), and continuing to activate vulnerability detection processes (Vulnerability Assessment) and penetration testing (Penetration Testing), and working to follow accepted international measurement standards in developing and modifying software and ensuring adequate protection conditions are available when developed by the bank, and ensuring the availability of examination certificates according to accepted international standards from authorized third parties when purchasing ready-made software or when relying on others for software development, and continuously updating various (System Software) systems, particularly updates related to closing security vulnerabilities by providers of those systems.
5. Continuously utilizing and examining protection controls for systems, such as access controls and identity authentication, segregation of conflicting duties, and utilizing fraud detection and monitoring systems, and determining a (Threshold) for the number of users of systems in real-time, and utilizing alerting and notification controls for system users when protection conditions are changed or when accessing and using those systems, and examining system controls to ensure their effectiveness continuously and informing executive management and the Board of Directors as necessary, and reviewing password policies and applying them continuously, and following strict procedures for storing or destroying sensitive data to preserve confidentiality, including used storage media, and limiting employee access to the Internet to reliable sites only, necessary for operating bank operations safely, and following strict procedures in backup mechanisms to ensure data availability and confidentiality.

Form (1/1/09)

---

6. Reviewing and examining the reliability and updating of incident response and handling procedures specific to information security, and the bank's business continuity plans, as well as those of service providers, including determining individual responsibilities regarding operations, reputation, liquidity, information security, fraud, service provider management, and customer requests and complaints, and ensuring that those procedures and plans include electronic intrusion, extortion, and Distributed Denial of Service (DDoS) incidents, in cooperation with Internet Service Providers (ISP) whenever necessary.

Form (1/1/09)