Security of customers and their funds

The Bank has a security policy in place, which also relates to the principles of digital security. The policy was approved by the Management Board in 2015. The Bank has a Cybersecurity Department which deals with:

• ensuring the security of the Bank’s IT system,
• development of systems and monitoring of cybersecurity parameters and critical services,
• servicing cybersecurity events and incidents, including the events and incidents in the area of electronic banking.

The current level of infrastructure security is the responsibility of the department director, who also supervise the Security Operations Centre (SOC). The director of the Cybersecurity Department is responsible for implementing the cybersecurity policy and for controlling cybersecurity. The Vice-President of the Management Board responsible for the Technology Area supervises the performance of these functions. The President of the Management Board oversees the implementation of the policy. In order to improve the methods of counteracting crime at the Bank, the Cybersecurity Department prepares analyses and presents the Management Board and the Supervisory Board of the Bank with conclusions and recommendations concerning the implementation and/or modification of specific solutions.

The monitoring of and responding to incidents are performed by the specialist CERT unit of the Bank. In order to ensure IT security of the Bank’s services, incident response operates on a 24/7/365 basis.

Since 2021, a CyberSecurity Operations Centre has been in operation at the Bank, which also includes monitoring and incident response for the Bank’s Group companies. The 24/7 SOC operates on the basis of a SOAR-class system allowing automation in monitoring, response as well as handling security incidents. In 2023, the PKO BP CERT team notified and blocked, in cooperation with CSIRT PFSA, CERT Polska and CERT Orange, more than 1,930 fake pages. The frauds mainly targeted electronic services and customers of the Bank, but 20% of the cases concerned frauds of a different type, which shows the contribution of the PKO BP CERT team to the overall level of ICT security in the Polish cyberspace. The bank uses advanced protection mechanisms against DDoS attacks, which allows CERT PKO BP to quickly and efficiently respond to and remove the effects of volumetric attacks targeting e-banking services

CERT PKO BP is a member of an international forum of cybersecurity incident responders FIRST and belongs to the task force of European response teams (TERENA TF-CSIRT) and the related Trusted Introducer organization. It is also a leading member of the Banking Cybersecurity Centre, operating under the patronage of the Polish Bank Association.

The Bank educates its employees regularly in ICT environment security and the security of information processed in that environment. It provides employees with e-learning courses on cyber-security (10 modules) to help users gain knowledge of potential threats. This training is mandatory for new employees. The Bank performs training in accordance with the agreed schedule of training and monitors their performance by employees on an ongoing basis as part of independent monitoring of control mechanisms.

In accordance with the Bank’s policy, the principles of cybersecurity must be complied with also by third parties (contractors). The Bank sets security requirements for the providers of IT services with respect to the protection of the Bank’s information, access to the Bank’s buildings and rooms, and the protection of the Bank’s information systems.

The awareness-raising of employees also engages a program of simulated phishing attacks. The messages are sent to all persons employed in the Bank and imitate the actual risks to which users are exposed on a daily basis. Since 2022, Security Awareness training has been carried out periodically and extended to all employees and the Bank’s Management Board.

The Bank operates an internal unit (RedTeam), which simulates potential attacks in a controlled manner, in order to identify weaknesses before their use by criminals. Activities to simulate attacks have been automated through, among other things, the implementation of a BAS (Breach and Attack Simulation) tool. In 2023, the Purple Team unit became active with the development of a dedicated platform for offensive and defensive teams to work together.

In response to trends related to attacks on corporate environments, in terms of the technologies currently implemented in the Bank at various levels, particular attention was paid to security of:

• the use of 'open source’ software in application release processes (CI/CD),
• implementation of tools based on generative artificial intelligence (genAI) to support business processes (e.g. customer communication, holistic analytics),
• tools based on Blockchain technology and cloud environments.

In 2023, information within the scope of ThreatIntelligence was widely analysed in the scope of activities carried out in cyberspace related to the conflict of Russia/Ukraine, with the simultaneous inclusion of threats which may materialise at the Bank. At the same time, a system to identify trends in attacks on customers based on customer reports has been implemented in view of the constantly high threat posed by false investments and phishing attacks. The system is designed to monitor changes in customer attack scenarios.

The bank responds to cyber security threats on an ongoing basis. It monitors information sources, creates potential threat scenarios, analyses risks, implements safeguards and responds to incidents in a structured manner. The Bank has a formalized process in place for verifying the security and sensitivity of new or modified systems and applications before the launch of their production. Every project change that involves a system that is critical to business processes is analysed and undergoes an IT security audit.

An internal audit of the IT processes is performed at least once every 3 years. The selection of IT processes to be audited in a given year depends, among other things, on the following factors: the results of the internal audits preformed, changes in the ICT environment, risks associated with identified internal and external frauds, and changes in internal and external regulations affecting the Bank’s functioning and operating activities. Internal audits of IT processes are performed by the IT and Security Audit Team of the Bank in accordance with a predefined schedule. External cybersecurity audits are outsourced to the audit firms with which the Bank has signed framework agreements.

The most important threat to the security of customers identified by the Bank and PKO Towarzystwo Funduszy Inwestycyjnych S.A. is associated with potential criminal activities of third parties targeted at customers using electronic channels of access to banking and investment services.

Firstly, the Bank uses the latest ICT security solutions which guarantee secure access to funds held by customers. The Bank is constantly improving the quality of its IT systems security, in particular with regard to the applications used by the Bank’s customers. This concerns, among other things, combating actively phishing websites pretending to be the Bank’s websites, identifying criminals intentions and ability, taking into account tactics, techniques and procedures (standardization and structuring of information about threats within a single data model), tracking the development of malware attacking the Bank’s customers, developing mechanisms of detecting infected customers’ computers, as well as improving the rules and extending the scope of monitoring of electronic transactions.

Secondly, the Bank attaches a great deal of importance to informing and raising customers’ awareness of the safe use of electronic banking services and payment cards. This is because security in this respect depends to a large extent on the users’ actions. The Bank’s educational activities include, in particular:

• regular educational campaigns conducted on social media and other channels for contact with customers, e.g. the educational portal www.bankomania.pkobp.pl,
• videos with examples of real attacks published on YouTube,
• educational articles in electronic media and press,
• webinars and trainings with the most common attacks,
• responding to customers’ enquiries on an ongoing basis (e-mail, social media),
• onsite meetings for customers and banking stakeholders on the most common scams (aimed at seniors, entrepreneurs and students),
• ongoing communication of the Bank’s views on various issues and provision of educational materials on cybercrime and the principles of security to the media,
• on-going campaigns and spreading awareness through external information channels (cooperation with radio is currently underway through participation in programmes on cyber security),
• responding to other signals regarding threats on an ongoing basis,
• provision of information on cybersecurity to customers through the Bank’s websites, the transactional platform and by e-mail.

In 2023, mechanisms were implemented to detect and prevent vishing attacks, which consist of attempts to impersonate the Bank’s call centre and thereby persuade the Bank’s customers to execute fraud scenarios.

In 2023, the Bank was improving systems for incident, anomaly and advanced malware detection and a large number of actions relating to incident handling was automated. The technology stack of solutions used for computer forensics purposes was replaced. It ensured the technological validity of the solutions used for computer forensics purposes in accordance with the current requirements profile.

Representatives of the Bank also engage in the work of the Banking Cybersecurity Centre (BCC) operating at the Polish Bank Association. The purpose of BCC is to take comprehensive and long-term measures which are aimed at improving the safety of mobile and electronic banking and preparing tools (structures, procedures, information exchange mechanisms) enabling crisis management (e.g. in the event of a massive attack).

The Bank does not have an ISO 27001 certificate, however, its cybersecurity processes and regulations are developed on the basis of the requirements of this standard. The high organizational maturity in the area of handling cybersecurity incidents is particularly important in the light of the PFSA’s decision issued in 2018 on recognizing PKO Bank Polski S.A. as a key service operator as defined in the Act on the national cybersecurity system.