Cybersecurity & Digital Banking Audit: Peran Internal Audit Menghadapi Risiko Siber
Cybersecurity & Digital Banking Audit: Peran Internal Audit Menghadapi Risiko Siber
Description
Transformasi digital telah menjadi bagian integral dari industri perbankan. Layanan mobile banking, internet banking, open banking, cloud computing, API, artificial intelligence, dan integrasi dengan berbagai pihak ketiga memungkinkan bank memberikan layanan yang semakin cepat dan mudah. Namun, semakin luas ekosistem digital yang digunakan, semakin besar pula permukaan serangan dan kompleksitas risiko siber yang harus dikelola.
Ancaman seperti phishing, social engineering, malware, ransomware, credential theft, account takeover, data breach, insider threat, hingga serangan terhadap pihak ketiga dapat mengganggu kerahasiaan, integritas, dan ketersediaan sistem serta data bank. Risiko tersebut juga dapat berkembang menjadi risiko operasional, finansial, kepatuhan, dan reputasi.
Dalam konteks ini, Internal Audit memiliki peran strategis untuk memberikan independent assurance bahwa kerangka cybersecurity dan pengendalian digital banking telah dirancang secara memadai dan berjalan efektif. Auditor tidak harus menjadi praktisi keamanan siber, tetapi perlu memahami bagaimana risiko siber muncul, bagaimana kontrol dirancang, bagaimana efektivitas kontrol diuji, dan bagaimana kelemahan dapat berdampak terhadap proses bisnis bank.
Objectives
- Memahami lanskap risiko siber dan digital banking.
- Memahami peran Internal Audit dalam Cybersecurity Risk Management.
- Mengidentifikasi cyber risk pada proses bisnis dan teknologi bank.
- Melakukan risk assessment untuk menentukan prioritas audit cybersecurity.
- Mengevaluasi tata kelola cybersecurity.
- Menguji efektivitas IT General Controls (ITGC).
- Mengevaluasi access management dan privileged access.
- Memahami audit terhadap application controls dan system interfaces.
- Mengevaluasi data protection dan data governance.
- Menilai kesiapan bank menghadapi cyber incident.
- Mengevaluasi business continuity dan disaster recovery.
- Mengidentifikasi risiko dari cloud dan third-party providers.
- Memanfaatkan data analytics untuk mendukung audit teknologi dan cybersecurity.
- Menyusun temuan serta rekomendasi audit yang berbasis risiko.
- Menyusun cybersecurity audit program yang aplikatif
Course outline
1. Cyber Risk Landscape in Digital Banking
- Perkembangan digital banking.
- Digital banking ecosystem.
- Cyber threat landscape.
- Cyber risk vs. technology risk.
- Risiko pada mobile/internet banking.
- API dan open banking risk.
- Cloud computing risk.
- Data breach.
- Ransomware.
- Phishing dan social engineering.
- Account takeover.
- Insider threat.
- Third-party cyber risk.
2. Cybersecurity Governance & Three Lines
- Cybersecurity governance.
- Peran Board dan Management.
- Peran IT, Information Security, Risk Management, Compliance, dan Internal Audit.
- Three Lines Model.
- Cyber risk ownership.
- Cybersecurity policy.
- Risk appetite dan risk tolerance.
- Cybersecurity metrics dan reporting.
- Independent assurance oleh Internal Audit.
3. Cyber Risk Assessment for Internal Audit
- Identifikasi cyber risk.
- Threat, vulnerability, dan impact.
- Inherent vs. residual cyber risk.
- Risk scoring.
- Identifikasi critical systems.
- Critical data dan critical services.
- Penentuan high-risk areas.
- Penyusunan cyber audit universe.
- Risk-based audit prioritization.
4. IT General Controls Audit
- IT governance.
- User access management.
- Privileged access.
- Password dan authentication controls.
- Change management.
- Program development.
- IT operations.
- Backup management.
- Job scheduling.
- Incident management.
- Logging dan monitoring.
- Evaluasi desain dan efektivitas ITGC.
5. Identity & Access Management Audit
- Prinsip least privilege.
- Role-based access.
- Joiner-Mover-Leaver process.
- User provisioning dan deprovisioning.
- Privileged account.
- Segregation of duties.
- Multi-factor authentication.
- Periodic access review.
- Dormant dan orphan accounts.
- Access violation dan exception.
6. Digital Banking & Application Audit
- Arsitektur layanan digital banking.
- Application controls.
- Input-validation controls.
- Transaction authorization.
- Authentication controls.
- Transaction limits.
- Error handling.
- Interface controls.
- API security controls.
- Logging dan audit trail.
- System availability.
- Application change management.
7. Data Protection & Privacy Audit
- Data governance.
- Data classification.
- Data ownership.
- Data access controls.
- Encryption.
- Data masking.
- Data retention.
- Data leakage prevention.
- Backup dan recovery.
- Data integrity.
- Monitoring penggunaan data.
- Audit terhadap pengelolaan data sensitif.
8. Cyber Incident Response Audit
- Cyber incident lifecycle.
- Detection dan escalation.
- Incident response plan.
- Security Operations Center.
- Containment dan recovery.
- Incident communication.
- Evidence preservation.
- Post-incident review.
- Lessons learned.
- Evaluasi efektivitas incident response.
9. Business Continuity & Cyber Resilience
- Business Continuity Management.
- Business Impact Analysis.
- Critical business services.
- Recovery Time Objective.
- Recovery Point Objective.
- Disaster Recovery.
- Backup strategy.
- System redundancy.
- Cyber recovery.
- Scenario testing.
- Resilience terhadap ransomware dan system outage.
10. Cloud & Third-Party Cyber Risk
- Cloud service models.
- Shared responsibility.
- Cloud governance.
- Vendor due diligence.
- Third-party risk assessment.
- Security requirements dalam kontrak.
- Service Level Agreement.
- Data location dan access.
- Vendor monitoring.
- Concentration risk.
- Exit dan contingency strategy.
11. Cyber Fraud & Social Engineering
- Hubungan cybersecurity dan fraud.
- Phishing.
- Business Email Compromise.
- Social engineering.
- Credential theft.
- Account takeover.
- Unauthorized transaction.
- Insider misuse.
- Fraud red flags.
- Transaction monitoring.
- Integrasi fraud detection dan cybersecurity controls.
12. Data Analytics for Cyber Audit
- Pemanfaatan data analytics dalam Internal Audit.
- Analisis user access.
- Identifikasi unusual login.
- Privileged account analysis.
- Dormant account detection.
- Transaction anomaly.
- Log analysis.
- Exception reporting.
- Continuous monitoring.
- Pengembangan Cyber Risk Dashboard.
13. Audit Reporting & Root Cause Analysis
- Penyusunan temuan cybersecurity.
- Condition, Criteria, Cause, Consequence, Recommendation.
- Menentukan root cause.
- Risk rating.
- Menilai business impact.
- Menentukan prioritas rekomendasi.
- Penyusunan management action plan.
- Follow-up dan validation
Participants
- Audit Internal
- Information Technology
- Risk Management
- Banking
- Compliance & APUPPT
- Leadership Program
- Law
- Perencanaan & Pengembangan
- Finance, Accounting & Tax
- Corporate Secretary & Humas
Method
- Pre-test
- Presentation
- Discussion
- Case study
- Post-test
Facilities
- Ruang Meeting Representatif
- Sertifikat Pelatihan Resmi
- Instruktur Profesional & Berpengalaman
- Training Kit Eksklusif
- Souvenir
- Pick Up Participant (Yogyakarta)
