BB website will not be launched until cyber risk is eliminated

Bangladesh Bank’s (BB) website, which was kept closed due to the risk of cyber attack, has not been launched even after three days. The central bank has decided to keep the website closed until the global risk is eliminated. However, officials have said that preparations have been kept to launch the website on Sunday morning.

Bangladesh Bank spokesperson and Executive Director Arif Hossain Khan has said on Saturday night, “There is preparation to open it, but the risk is still there (at 8:30pm). As long as the global risk remains, the website will not be launched. The IT team is constantly alert.”

As a precautionary measure to avoid the potential risk of global cyber attack, the central bank’s website has been kept closed since after evening on Thursday.

Bangladesh Bank has a plan to launch the website on Sunday, the day banks open after five consecutive days of holiday.

This caution was issued after two serious security flaws were identified in the widely used programming language PHP worldwide. The European Union’s cyber security agency advised temporarily closing websites that are at risk of being attacked. Such steps are recommended if it is not possible to quickly install security updates or patches.

After that Bangladesh Bank kept the website closed as a precautionary measure. On Thursday Arif Hossain Khan had informed bdnews24.com that the website was kept closed in the interest of security as a risk of cyber attack had been created globally.

The PHP development team announced the release of an emergency security update to fix the two flaws last Wednesday.

A report in the British media The Independent has said that after concerns spread about the two flaws, various government agencies in Europe have also kept their websites closed as a precautionary measure.

Although Bangladesh Bank’s website is closed, the websites of other regulatory bodies in the financial sector remain operational. These include Bangladesh Securities and Exchange Commission (BSEC), Financial Institutions Division of the Ministry of Finance, Dhaka Stock Exchange (DSE) and Insurance Development and Regulatory Authority.

State institution BGD e-GOV CIRT (CIRT) issues cautions regarding cyber security. On Thursday the organisation informed that two risky vulnerabilities have been identified in the PHP system, which have been identified as ‘PHP2Shell’. Taking advantage of these vulnerabilities, unauthorised persons can break the security system of websites operated with PHP technology and enter.