Vulnerability Assessment & Penetration Testing (VAPT) for Banking Systems
Vulnerability Assessment & Penetration Testing (VAPT) for Banking Systems
Description
Meningkatnya ancaman siber terhadap industri perbankan menjadikan keamanan sistem informasi sebagai prioritas strategis. Serangan seperti ransomware, data breach, credential theft, malware, exploitation terhadap aplikasi, hingga advanced persistent threat (APT) dapat mengganggu operasional bank, menyebabkan kerugian finansial, serta menurunkan kepercayaan nasabah dan regulator.
Untuk memastikan ketahanan keamanan sistem, bank perlu melakukan Vulnerability Assessment & Penetration Testing (VAPT) secara berkala sebagai bagian dari cyber security governance dan regulatory compliance. Vulnerability Assessment bertujuan mengidentifikasi kelemahan sistem, sedangkan Penetration Testing menguji sejauh mana kelemahan tersebut dapat dieksploitasi oleh attacker dalam kondisi nyata.
Pelatihan ini dirancang untuk memberikan pemahaman menyeluruh mengenai metodologi VAPT pada lingkungan perbankan, termasuk identifikasi kerentanan, simulasi serangan, pengujian keamanan aplikasi dan jaringan, pelaporan risiko, serta tindak lanjut remediation untuk meningkatkan cyber resilience bank.
Objectives
Setelah mengikuti pelatihan ini, peserta diharapkan mampu:
- Memahami konsep dasar Vulnerability Assessment & Penetration Testing (VAPT).
- Mengidentifikasi ancaman dan kerentanan pada sistem perbankan.
- Memahami metodologi dan tahapan pelaksanaan VAPT.
- Menguji keamanan jaringan, aplikasi, dan infrastruktur digital bank.
- Menginterpretasikan hasil VAPT dan menentukan prioritas remediation.
- Memahami regulatory compliance terkait cyber security testing.
- Mengembangkan strategi penguatan keamanan dan cyber resilience.
- Mengintegrasikan VAPT dalam cyber security governance bank.
Course outline
1. Fundamental Cyber Security & VAPT
- Cyber threat landscape industri perbankan
- Konsep vulnerability dan exploit
- Perbedaan Vulnerability Assessment dan Penetration Testing
- Jenis-jenis cyber attack pada bank
- Security testing dalam cyber security lifecycle
2. Regulatory & Security Framework
- Regulasi keamanan TI sektor perbankan
- Compliance requirement cyber security testing
- Framework keamanan informasi (ISO 27001, NIST, CIS)
- Regulatory expectation terhadap cyber resilience
- Governance dan audit cyber security
3. Vulnerability Assessment Methodology
- Asset identification & risk classification
- Vulnerability scanning techniques
- Network vulnerability assessment
- Web application vulnerability assessment
- Database & server security assessment
- Configuration review & hardening assessment
4. Penetration Testing Methodology
- Tahapan penetration testing
- Reconnaissance & information gathering
- Exploitation techniques
- Privilege escalation & lateral movement
- Post exploitation analysis
- Reporting & remediation recommendation
5. Web & Mobile Application Security Testing
- OWASP Top 10 vulnerabilities
- SQL Injection, XSS, CSRF, SSRF
- Authentication & session management weakness
- API security testing
- Mobile banking application security
- Secure coding awareness
6. Network & Infrastructure Security Testing
- Firewall & IDS/IPS assessment
- Wireless network security testing
- Active Directory & privilege assessment
- Cloud infrastructure vulnerability
- ATM & electronic banking system security
- Endpoint security assessment
7. Red Teaming & Advanced Security Simulation
- Red team vs blue team concept
- Simulasi cyber attack scenario
- Social engineering & phishing simulation
- Insider threat simulation
- Attack path analysis
- Cyber range exercise
8. Risk Analysis & Remediation Management
- Risk rating & vulnerability prioritization
- CVSS scoring interpretation
- Remediation tracking
- Patch management governance
- Root cause analysis
- Security improvement roadmap
9. Operational Resilience & Incident Response
- Integrasi VAPT dengan SOC
- Threat monitoring & incident detection
- Cyber incident response process
- Digital forensic awareness
- Business continuity & disaster recovery
- Lessons learned process
10. Case Study & Workshop
- Studi kasus cyber attack pada bank
- Simulasi penetration testing scenario
- Workshop vulnerability analysis
- Penyusunan VAPT report & executive summary
- Penyusunan action plan cyber security strengthening
Participants
- Information Technology
- Risk Management
- Audit Internal
- Compliance&ApuPpt
- Operational
- Electronic Banking
- Data Management
- Legal
- Finance
- Leadership Program
Method
- Pre-test
- Presentation
- Discussion
- Case study
- Post-test
Facilities
- Ruang Meeting Representatif
- Sertifikat Pelatihan Resmi
- Instruktur Profesional & Berpengalaman
- Training Kit Eksklusif
- Souvenir
- Pick Up Participant (Yogyakarta)
