RBI Cyber Security Framework for UCBs¶
The Reserve Bank of India (RBI) Cyber Security Framework for Urban Cooperative Banks (UCBs) provides baseline cybersecurity standards for urban cooperative banking institutions in India. This framework mandates implementation of security controls covering governance, risk management, IT operations, and incident response specific to the cooperative banking sector. It applies to all Urban Cooperative Banks regulated by the Reserve Bank of India.
Terraform Registry Subdomain: rbicybersecurity¶
module "..." {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}
module "..." {
source = "https://rbicybersecurity.compliance.tf/terraform-aws-modules/<module>/aws"
}
Refer to the Terraform Registry Endpoints section for more details.
Implemented Controls¶
The following controls are implemented as part of this framework.
- API Gateway stage should uses SSL certificate
- API Gateway stage cache encryption at rest should be enabled
- API Gateway stage logging should be enabled
- At least one enabled trail should be present in a region
- CloudTrail trails should be integrated with CloudWatch logs
- CloudTrail trail logs should be encrypted with KMS CMK
- Log group retention period should be at least 365 days
- DMS replication instances should not be publicly accessible
- DynamoDB table should be encrypted with AWS KMS
- DynamoDB table point-in-time recovery should be enabled
- Attached EBS volumes should have encryption enabled
- EBS volume encryption at rest should be enabled
- EC2 instances should be in a VPC
- EC2 instances should not have a public IP address
- EFS file system encryption at rest should be enabled
- ElastiCache Redis cluster automatic backup should be enabled with retention period of 15 days or greater
- ELB application and classic load balancer logging should be enabled
- ELB application load balancers should be configured to drop HTTP headers
- Application Load Balancer should be configured to drop invalid http headers
- ELB application and network load balancers should only use SSL or HTTPS listeners
- ES domain encryption at rest should be enabled
- ES domains should be in a VPC
- Elasticsearch domain should send logs to CloudWatch
- Elasticsearch domain node-to-node encryption should be enabled
- IAM password policies for users should have strong configurations
- KMS CMK rotation should be enabled
- Lambda functions should be in a VPC
- Log group encryption at rest should be enabled
- RDS DB instance automatic minor version upgrade should be enabled
- RDS DB instance backup should be enabled
- RDS DB instance encryption at rest should be enabled
- Database logging should be enabled
- RDS DB instances should prohibit public access
- AWS Redshift clusters should have automatic snapshots enabled
- Redshift cluster encryption in transit should be enabled
- Redshift cluster audit logging and encryption should be enabled
- AWS Redshift clusters should be encrypted with KMS
- AWS Redshift should have required maintenance settings
- Redshift clusters should prohibit public access
- S3 bucket cross-region replication should be enabled
- S3 bucket default encryption should be enabled
- S3 bucket default encryption should be enabled with KMS
- S3 bucket logging should be enabled
- S3 buckets should prohibit public read access
- S3 buckets should prohibit public write access
- S3 bucket versioning should be enabled
- SageMaker endpoint configuration encryption should be enabled
- SageMaker notebook instances should not have direct internet access
- SageMaker notebook instance encryption should be enabled
- SNS topics should be encrypted at rest
- VPC subnet auto assign public IP should be disabled
Enable/Disable Controls¶
You can customize the Terraform module for the desired compliance requirements by enabling/disabling individual controls.
Examples¶
S3 bucket module with RBI Cyber Security Framework for UCBs compliance framework controls enabled, and a couple of controls disabled¶
module "..." {
source = "https://rbicybersecurity.compliance.tf/terraform-aws-modules/s3-bucket/aws?disable=apigateway_rest_api_stage_use_ssl_certificate,apigateway_stage_cache_encryption_at_rest_enabled"
}