Kavitha Prabhakar

The role of CISO is evolving at a phenomenal pace. The expectation from the senior leadership in quantifying and managing cyber risks has picked up pace. Many think tanks are predicting it to get bifurcated between CTSO and CISO depending upon the size and maturity of the organisation. With this backdrop in mind there is a new paradigm for CISO's approach. I had the privilege to moderate an esteemed panel Prabhat Pathak, Hussain AlKhalsan CISO and dearly missed Vishal Vijaykumar Bhawnani due to his ill health. Their thoughts and inputs from their rich experiences were very well received by the community of delegates present during the event. We discussed a few burning issues within the industry which I am sharing below for industry peers to reflect upon within their organization too. 1. The shift from qualitative to quantitative risk assessment methodologies: a) As a CISO, what are the primary advantages of adopting quantitative risk assessment methodologies over qualitative approaches? b)What challenges have you encountered when implementing quantitative risk assessment methodologies within your organization? c) How do you communicate the outcomes of quantitative risk assessments to senior management effectively? 2. Leveraging data analytics and machine learning for accurate risk quantification: a)How has the integration of data analytics and machine learning enhanced the accuracy and reliability of risk quantification in your organization? b)hat types of data sources and algorithms do you find most valuable for predictive risk modeling? c)What steps have you taken to ensure the security and integrity of data used in risk analytics and machine learning models? 3. Balancing risk mitigation efforts with business objectives and resource constraints: a)ow do you prioritize and allocate resources between risk mitigation efforts and other strategic business initiatives? b)What frameworks or methodologies do you use to assess the cost-effectiveness of risk mitigation strategies? c)How do you evaluate the residual risk that remains after implementing mitigation measures? 4. The role of risk quantification in regulatory compliance and reporting: a)How does risk quantification support compliance with regulatory requirements in your industry? b)How do you ensure that your risk quantification methods satisfy auditors and regulatory authorities? c)Can you describe a scenario where risk quantification played a crucial role in meeting regulatory compliance obligations? d)How do you keep abreast of evolving regulatory requirements and adjust your risk quantification strategies accordingly? #isaca #tahawultech #cybersecurity #dubai #uae #abudhabi

75

5 Comments

Sharing a new resource on my website (allaboutgrc.com): a template to assess Reserve Bank of India's regulations around IT and Security. It covers around 660 requirements I collected from 4 regulations on: ✔ Cybersecurity framework ✔ IT GRC & Assurance ✔ Outsourcing of IT Services ✔ Digital Payment Security They are valuable not only for banks in India but also as references for those seeking to understand best practices in these four areas. Link: https://lnkd.in/dZW-yr9y

15

1 Comment

#CISA Prep: Domain 5 Amendments Series as per CISA job practice 2024 : Article 2 Privileged Access Management (PAM) : "Principle of Least Privileges (POLP)" Auditors needs to know benefits, risks and best practices associated with PAM #cybersecurity #riskmanagement #cisa #isaca #itaudit #isaudit #cyberthreat

108

2 Comments

SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) Insights SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), introduced in August 2024, sets clear guidelines to enhance the security posture of SEBI-regulated entities (REs), including stock exchanges, depositories, mutual funds, and other financial intermediaries. The framework focuses on cybersecurity (protecting systems and data) and cyber resilience (recovering from cyberattacks). Here's a summary with an example: Key Components of CSCRF: Comprehensive Cybersecurity Policy: REs must adopt a cybersecurity and resilience policy covering threat identification, risk management, response, and recovery. This ensures continuous protection across all IT systems. Risk Management Framework: Organizations must develop and implement a framework to regularly assess and manage cyber risks. Example: A stock exchange conducts risk assessments every quarter, identifying potential vulnerabilities in its trading systems, and implements countermeasures. Data Protection: REs are required to use Full-Disk Encryption (FDE) and File-based Encryption (FE) for sensitive data protection, both in storage and transmission. Example: A mutual fund company encrypts all client financial data and uses secure encryption protocols for online transactions to prevent unauthorized access. Security Operations Center (SOC): Larger REs must set up a SOC for real-time threat monitoring. Smaller entities can use Market SOCs established by the Bombay Stock Exchange (BSE) or National Stock Exchange (NSE) for their monitoring needs. Example: A depository sets up a SOC to monitor all incoming traffic for unusual activities, ensuring quick responses to potential security breaches. ISO 27001 Certification: Large entities must obtain ISO 27001 certification, which ensures adherence to international standards for information security management. Vulnerability Assessment & Red Teaming: REs must conduct Vulnerability Assessments and Penetration Testing (VAPT) regularly to identify potential weaknesses in their IT systems. Additionally, red teaming exercises (simulated cyberattacks) assess the organization's defensive capabilities. Example: A brokerage firm simulates a cyberattack on its trading platform, analyzing how well its defenses can handle the breach and where improvements are needed. Incident Response: REs must establish protocols for detecting, reporting, and recovering from cyber incidents. This ensures quick recovery and minimal business disruption in the event of a cyberattack. Example: In case of a data breach, a portfolio management service automatically triggers a response plan, including notifying SEBI and affected clients within a prescribed timeframe. Implementation Deadlines: Entities with existing cybersecurity policies must comply with the new framework by January 1, 2025, while newly regulated entities have until April 1, 2025.

4

"India Enforces Six-Hour Deadline for Reporting #Cyber Incidents to Strengthen #National #Security" A new rule from the Indian Department of #Telecommunications (DoT) mandates that #companies report #cybersecurity problems within six hours of becoming aware of them. Through prompt #threat responses and damage mitigation, this directive seeks to strengthen India's cybersecurity architecture. Events include #ransomware attacks, #data breaches, and significant #system intrusions will be covered by the required reporting. This action emphasises accountability and transparency in addressing cyber threats, which is in line with international best practices. The action is severe since #noncompliance could result in #regulatory penalties for #organisations. Additionally, this strategy supports India's international pledges to improve cybersecurity resilience and readiness. It does, however, impose a heavy compliance burden on #businesses, necessitating strong #internal systems for threat #detection and #reporting in real time. Penalties or harm to one's reputation could result from noncompliance. Although the goal of the policy is to create a safer online #environment, it also emphasises how urgently advanced cybersecurity #technology and capacity-building are needed to handle changing threats. Compliance Requirements: 1. Organizations must implement robust threat detection systems capable of identifying cyber incidents in real time. This involves deploying tools like #SIEM (Security Information and Event Management) and leveraging #AI-based #monitoring for #anomalies. 2. #Companies need to establish 24/7 incident response teams to ensure they can meet the six-hour deadline for reporting incidents to #CERT-In, as per the directive. 3. Businesses must classify incidents such as ransomware, #phishing #attacks, or data #breaches and prioritize their response based on criticality. 4. The policy encourages sharing detailed incident logs with CERT-In, including source IP addresses, #attack patterns, and timestamps. 5. Organizations must maintain proper #logs and reports to demonstrate #compliance in case of #audits or #investigations by #regulatory bodies. #cyber #india #government #ransom #attacker #safety #secure #hacker #cyber Cyber Security News ®

11

As per latest Global Cyber Capability Index (GCCI) , India stands 10th position globally in terms of adherance towards Cybersecurity Commitments. Recently, SEBI #SEBI has launched a revised Cybersecurity framework to Boost Regulated Market Entities Security associated with it, by mandating Market SOC (M-SOC) set up in order to do continous security monitoring these entities and assess their cybersecurity maturity and resilience regularly. This Market driven framework is a part of revised Cybersecurity and Cyber Resilience Framework (CSCRF) and is getting implemented in two phases Jan'25 & April"25 as per new Security Regulations Guidelines from SEBI, India. Some key benefits apart from Risk Governance, Regular Assessment 24x7 monitoring - 1. Data Classification and localisation plays key role here, Regulated data is mandate to be localised while its logs injestion to M SOC goes through well defined offshore gaurdrails. 2. Auto Software Bill of Materials (SBOM) generation to mitigate Security Market Entities supply chain risks. 3. Well defined Guidelines around API security and Mobile app security Its a well defined strategic move by SEBI to safegaurd investors money, improving volatile market stability by maintaining robust Cybersecurity Resilience from Cyber attacks /threats / Risks. Bosch Software and Digital Solutions #bosch #NSE # BSE #cybersecurity #securitymarkets #sebi #SOC

21

🚀 NIST CSF 2.0 2024 Update: A Game Changer for India’s Cybersecurity Landscape 🌐 The 2024 update to the NIST Cybersecurity Framework (CSF) 2.0 brings a significant shift in how we approach cyber security globally, and it's set to offer massive benefits for India as well. ✳️ Enhanced Risk Management: In keeping with India's expanding digital economy and diverse business ecosystem, the new version incorporates more robust and scalable risk management procedures. Indian businesses don't have to be overwhelmed by complexity in order to improve their cybersecurity posture by taking a flexible strategy. ⛓️ Focus on Supply Chain Security: India is a key global centre for IT services and outsourcing, and as such, it depends a lot on safe supply chains. The new supply chain risk management principles in NIST CSF 2.0 enable Indian organisations to protect their whole operation. 👨‍🎓 Alignment with International Standards: The upgrade emphasises adherence to international cybersecurity principles and international engagement more than before. This provides a means of proving compliance with international cybersecurity requirements for Indian companies hoping to grow internationally or cater to clients outside. 📈 Enhanced Cyber Resilience: New cyber resilience methods are included in NIST CSF 2.0, which is important for India's vital industries including banking, healthcare, and energy. Increasing resilience guarantees fewer downtime and a quicker recovery from attacks. 🤑 Support for Digital Transformation: By providing guidance on safeguarding cloud, IoT, and AI-driven infrastructures, this update enables secure digital transformation as India moves closer to being a $5 trillion digital economy. #Cybersecurity #NISTCSF #DigitalIndia #CyberResilience #RiskManagement #SupplyChain #DigitalTransformation ECS Ankusshh Sethi Bhagyesh Takoliya Heetav Rathod Abrar Badarpura NAITIK SHUKLA Parth Shah Mithun Chakravarty Priyanka Chauhan Priyanshi Patel

23

1 Comment

‘Pig Butchering apps removed from Google Play and iOS stores’ Fake trading apps on Google Play and Apple's App Store lure victims into “pig butchering” scams that have a global reach. The apps have been removed from the official Android and iOS stores after accumulating several thousand downloads, say researcher at cybersecurity company Group-IB, who discovered the fraud. Pig butchering is the name of a scam where the victim is led to believe they are getting high investment returns on a fake trading platform that displays fabricated information. Fraudsters use social engineering to keep the victim depositing funds and prevent them from withdrawing the displayed "profit." The scam is revealed when the victim attempts to cash their money, which the fraudsters have already moved to their accounts. Fraudulent apps in iOS and Android stores The fraudulent apps, which Group-IB categorizes under the “UniShadowTrade” malware family, are built using the UniApp framework and were first spotted in May. Malicious app on the Apple App Store Malicious app on the Apple App Store Source: Group-IB Their names are SBI-INT (iOS), Finans Insights (Android), Finans Trader6 (Android) and a look at the download counter for the last two shows that they were downloaded 5,000 times.

3

2 Comments

Vulnerability Management - Audit types for ISO management systems Posting this because we all go through audits regardless of our individual domains, so thought we should all know basic terminology related to audits. Following are the 3 types based on the organization conducting audit: 1. First-Party Audit --> Definition: Conducted by an organization on its own management system. --> Purpose: To evaluate internal processes and compliance with ISO standards. It helps identify areas for improvement. --> Who Conducts: Internal auditors or designated staff within the organization. --> Focus: Self-assessment, identifying non-conformities, and ensuring ongoing compliance. 2. Second-Party Audit --> Definition: Conducted by one organization on another organization, often a supplier or partner. --> Purpose: To assess the quality management system of a supplier to ensure they meet specific requirements and standards. --> Who Conducts: Auditors from the purchasing organization or a contracted third party. --> Focus: Evaluating the performance and compliance of suppliers or partners, ensuring alignment with contractual obligations. 3. Third-Party Audit --> Definition: Conducted by an independent auditing body not affiliated with either party. --> Purpose: To certify an organization’s compliance with ISO standards, typically resulting in an official certificate. --> Who Conducts: Accredited certification bodies. --> Focus: Comprehensive assessment of the entire management system, ensuring it meets the necessary ISO standards. Summary --> First-party audits are internal evaluations for continuous improvement. --> Second-party audits focus on supplier compliance and risk management. --> Third-party audits provide formal certification and external validation of adherence to ISO standards. Each type of audit plays a vital role in the overall effectiveness of ISO management systems, ensuring quality, compliance, and continual improvement. #Cybersecurity #VulnerabilityManagement

36

1 Comment

Enhancing #securityawareness among employees is a fundamental control prospect in protecting organisational assets from cyber threats. A well-informed workforce is the first line of defense in identifying and mitigating risks. Here are some key strategies to bolster security awareness: 1. Regular Training Sessions: Conduct comprehensive training programs to educate employees on the latest security threats and best practices. This includes recognising phishing attempts, avoiding suspicious links, and understanding social engineering tactics. 2. Simulated Attacks: Implement simulated phishing attacks to test and improve employee response to potential threats. These simulations help identify vulnerabilities and reinforce training. 3. Clear Policies and Procedures: Establish clear security policies and procedures that are easily accessible to all employees. Ensure everyone understands their responsibilities in maintaining security protocols. 4. Strong Password Practices: Educate employees on the importance of creating strong, unique passwords and regularly updating them. Encourage the use of password managers to manage and store passwords securely. 5. Multi-Factor Authentication (MFA): Promote the use of MFA to add an extra layer of security. This can significantly reduce the risk of unauthorised access. 6. Secure Communication Channels: Advocate for the use of encrypted communication channels for sharing sensitive information. Ensure employees are aware of the risks of using unsecured methods. 7. Incident Reporting: Foster a culture where employees feel comfortable reporting security incidents or suspicious activities without fear of repercussions. Quick reporting can prevent potential breaches from escalating. 8. Regular Updates and Reminders: Keep security awareness top of mind with regular updates, reminders, and bulletins. Use multiple channels, such as emails, intranet, and team meetings, to reinforce key messages. 9. Leadership Support: Ensure that leadership actively supports and participates in security awareness initiatives. Their commitment sets a tone for the entire organisation. 10. Recognition and Rewards: Recognise and reward employees who demonstrate exceptional security practices. Positive reinforcement encourages others to follow suit. By implementing these strategies, organisation's can create a security-conscious culture where every employee plays a vital role in safeguarding data and resources. Let's build a resilient workforce equipped with the knowledge to protect our digital environment. #CyberSecurity #EmployeeTraining #SecurityAwareness #DataProtection #CyberSafety

20

The Securities and Exchange Board of India (SEBI) has introduced the Cybersecurity and Cyber Resilience Framework (CSCRF) for its regulated entities. This framework outlines a comprehensive set of guidelines and standards, addressing various aspects of cybersecurity and incident response. It helps entities identify, assess, and mitigate cybersecurity risks, ensuring the protection of sensitive data and operational integrity. Compliance with the CSCRF is essential for meeting regulatory requirements and implementing security measures within specified timelines. Furthermore, the framework promotes best practices in cybersecurity, leading to enhanced security measures and reduced vulnerabilities. Additionally, the circular leverages existing industry and regulatory standards such as ISO 27001, NIST 800-53, and guidelines from CERT-IN.

8

ISO 27001 Risk: Single Point of Knowledge In smaller organizations, it's common for one individual to manage the information security management system (ISMS), handling all documentation and understanding the system's intricacies. If this person leaves the company, the management system can become difficult, if not impossible, for others to manage effectively. To mitigate this risk, organizations should involve multiple people in designing the ISMS from the beginning and establish clear documentation requirements to ensure the system can be maintained by others. #ISO27001 #CyberSecurity #InformationSecurity #RiskManagement

9

2 Comments

The release of "Privacy Across Borders: Guidance on Cross-Border Data Transfers for Indian Organisations" by Data Security Council of India is a timely and crucial resource, especially in the context of the newly enacted Digital Personal Data Protection Act, 2023 (DPDPA). As businesses increasingly engage in cross-border data transfers, it is vital for organizations to stay updated on legal obligations and best practices to ensure the highest level of data privacy and security. The guide's emphasis on Data Protection Impact Assessments, audits, and harmonizing global compliance requirements is particularly valuable. It offers practical steps that not only support compliance but also foster trust with clients and users across borders. For organizations serving a global user base, this resource is a must-read to maintain robust data protection standards while navigating the complex landscape of international data transfers. Kudos to Data Security Council of India for providing this clear, actionable framework! https://lnkd.in/gCE2fZi7 #DPDP #CyberSecurity #DataProtection #DPDPA #CrossBorderTransfers #Privacy #Compliance

4

What is the completion date for PCI DSS assessments documented in a Report on Compliance and its related Attestations of Compliance? In PCI DSS assessments documented in a Report on Compliance (ROC), the "Date of Report" is considered the completion date, marking when the QSA Company and assessed entity agree on the final version of the ROC. This date can be found in Section 1.2 of the ROC and on the cover page and in Section 3 of the ROC Attestations of Compliance (AOCs). The AOC includes a Merchant (or Service Provider) Attestation and a Qualified Security Assessor (QSA) Acknowledgement, both requiring signatures within a reasonable timeframe (typically two to three weeks) of the Date of Report. These signatures confirm the ROC's accuracy but do not indicate the actual completion date of the assessment. Any questions about these dates should be directed to the relevant submitting entity, such as an acquirer or payment brands. https://lnkd.in/gQ_yKQkX

11

BY LEVERAGING PSYCHO.LOGICAL TRICKS, ATTACKERS CONVINCE USERS TO MAKE SECURITY MISTAKES OR DISCLOSE SENSITIVE INFORMATION. . . . . . . . #CyberSecurity #InformationSecurity #DataSecurity #CyberRiskManagement #CyberResilience #DigitalTransformation #CyberThreatIntelligence #CyberAwareness #CyberDefense #DataProtection #ZeroTrust #ThreatDetection #NetworkSecurity #CloudSecurity #RiskManagement #SecurityOperations #EthicalHacking

2

Cloudsecurity 101: DFIR for Cloud Forensic - Are you a blue-teamer who detect & handle incidence for your organisation? - Are you equipped with all the data required for incident response in cloud? Let’s give a try!! 1/ IAM Logs - Are you getting logs from all your IAM tools? Microsoft AD, Azure AD, AWS IAM, SSO integrations? 2/ Cloud platform logs - Do you get the platform level log from your cloud? Does it cover Insights, data & management events? 3/ Resource management logs - Do you get logs of create, delete, start or stop of the resources? 4/ Resource logs - Do you see data that’s extracted, their quantification & relative ranking wiht usual volume? Does it include VMs, Network and storage level? 5/ Application logs - Do you get the application logs to know if there’s unprecedented requests or logon failures? Will you be able to flag errors for such events? Remember when logs are not comprehensive, your IR is not effective. Stay Secure, Security Sentinel!! #cybersecurity101 #dfir #incidentmanagement #cloudforensic #cloudsecurity Ref: Log Hierarchy - SANS Enterprise Forensics & Cloud Response

24

1 Comment

*Unpopular opinion* #CISSP is a mandatory pain and the book is after exam good for... being a brick under kettlebell. 💪 📜 Many jobs are non-sensely having CISSP as a must-have condition, regardless of the #knowledge or #experience of candidate. When you do not have CISSP, you are dropped out. And when you pass it, you have to pay yearly fee. Yeah, it is common for the most of #certifications. But is there for the others such strong pressure for having it active? What makes me quite wondering: Most of the people are not going for this certification to learn something new (as is usual for the most of #CyberSec certifications), but because they feel that it is a roadblock in their growth. Is it really the right approach?

128

91 Comments

Q- An information security manager has observed multiple exceptions for a number of different security controls. Which of the following should be the information security manager's FIRST course of action? A. Inform respective risk owners of the impact of exceptions B. Prioritize the risk and implement treatment options. C. Design mitigating controls for the exceptions. D. Report the noncompliance to the board of directors.

2

3 Comments