Investigating key factors investigating effective cybersecurity governance: a study of Pakistan's private commercial banks

In the contemporary digital landscape, the effective governance of e-banking information systems poses a global challenge. Similarly, despite the financial soundness of the banking industry in Pakistan, its vulnerability to cyber threats remains a significant concern. This study aims to identify key factors influencing cybersecurity governance in Private Commercial Banks of Pakistan (PCBP, Lahore), exploring internal and external challenges, and providing practical recommendations. The theoretical framework of this thesis draws on the institutional logics perspective to highlight how stakeholders' actions reshape the social institutions governing cybersecurity in the banking sector. The study also incorporates the Technology Acceptance Model (TAM) and motivation concepts alongside the three lines of defence model. This comprehensive approach emphasizes institutional actions for robust cybersecurity governance in banks. Empirically, findings based on 21 semi-structured interviews across 13 PCBP highlight an increasing threat of social engineering linked to customer awareness. In particular, digital literacy was proven more effective than formal degrees in combating cyberthreats. The study advocates immediate nationwide awareness programs by the government to instil a culture of cybersecurity, acting as a deterrent against cybercriminals. Moreover, hurdles such as insufficient legislation, the capabilities of law enforcement agents, and corrupt agents were found to impede effective cybercrime prevention. The findings of the study indicate that the State Bank of Pakistan (SBP) faces challenges due to a lack of cybersecurity experts and experienced audit teams, enabling banks to manipulate performance superficially. Furthermore, inadequate cybersecurity training for directors contributes to governance issues, fostering cyberthreats like social engineering, ATM skimming, malware, and DDoS attacks. The study also highlights the potential threat of deepfake technology in the context of low cybersecurity awareness in Pakistan's banking sector. In summary, this thesis advocates a holistic approach involving collaboration between PCBP, SBP, and the government to enhance cybersecurity governance. Leveraging institutional logics, the proposed framework holds potential applicability to developing countries grappling with similar cybersecurity challenges.