Divyesh Solanki

Tackling #GenAI risks needs focus on all three fronts 1. Appropriate Policy and process governance backed by user awareness 2. Technical Controls which are kept upto date through iterative feedback cycles 3. Consequence management tackling advertant violations #InsiderRisk #GenAIOpportunityAndChallenge #DataPrivacy #IPBreach

20

As time passed, Nandi, the CISO of Kailasha, Inc., became aware of the limitations of the DREAD model. To ensure Kailasha stayed resilient against the ever-evolving complexity of threats, he decided to use a more advanced risk assessment model to categorise and assess the severity of potential threats and vulnerabilities. This model, called STRIDE, was an evolution of traditional threat modeling techniques and specifically designed to tackle the complexities of modern cyber threats. By using STRIDE, Kailasha’s security teams could conduct in-depth threat modeling exercises, where each identified threat was carefully scored and analysed. This approach helped prioritise risks, focusing first on those with the most severe consequences and the highest likelihood of exploitation. In the real world, STRIDE builds on the foundational concepts of DREAD but is specially designed to address modern challenges and provide a more comprehensive approach to risk assessment. The components of STRIDE include: 1. Spoofing Identity - This component evaluates the risk of an attacker impersonating a legitimate user to gain unauthorised access to systems and data. High risk is assigned when spoofing could lead to significant breaches or data theft. 2. Tampering with Data - This component measures the risk of an attacker altering or corrupting data within the system. The greater the impact of such tampering, the higher the risk score. 3. Repudiation - This considers the possibility of an attacker denying their actions within a system, making it difficult to track malicious activities. Systems without adequate logging and tracking capabilities score higher in this area. 4. Information Disclosure - This assesses the likelihood of sensitive information being exposed to unauthorised entities. The more sensitive and extensive the data at risk, the higher the score. 5. Denial of Service - This component examines the risk of an attacker disrupting access to services or resources, potentially crippling operations. A high score indicates a significant threat to availability and business continuity. 6. Elevation of Privilege -This evaluates the risk of an attacker gaining elevated permissions within a system, allowing them to perform actions typically restricted to higher-level users. The easier it is to escalate privileges, the greater the risk. However, like DREAD model, STRIDE has its limitations. Although it offers a more comprehensive approach than traditional models, it can still be subjective, depending on the assessor’s perspective. This subjectivity can lead to variations in scoring, making it extremely important for CyberSec teams to maintain consistency in their evaluations. Importantly, the complexity of STRIDE may pose challenges when applied to large, intricate systems, requiring significant time and resources for thorough assessments- something the CyberSec teams are always short on 🙂. Prabh | Santosh | Patrick | Group Captain Ashok Kumar | ELITECISOs

36

15 Comments

Data Security Posture Management is most critical tool for data governance and privacy apart from cybersecurity. Must attend session.

13

A day after tomorrow! I love this movie name :) Excited to share the 1st post of 1-min read series on "Application Security" on 16th Oct '2024. The purpose of creating 1-min read post is to make the content crispier and breaking complex content into slices for easier understanding. #dayaftertomorrow #1minreadseries #appsec #applicationsecurity #security #1minread #linkedinlearning #timemanagement #valuedriven

5

A very informative article published in latest Newsletter of ISACA, clarifying Risk Appetite and Risk Tolerance in the context of AI.

1

AI indeed cannot fully replace human intelligence…

46

2 Comments

Illuminate Your #Diwali: Stay #Safe from QR Scan Fraud! 🎉✨ ‘’Shine Bright, Stay Right!" As we gear up for the joyous celebrations of Diwali, it's essential to keep our festivities safe from the shadows of fraud. QR scan scams are on the rise, and I want you to enjoy the festival without worry! What is QR Scan Fraud? Scammers use deceptive QR codes to trick you into sharing personal information or making unwanted payments. These codes can appear anywhere, even on festive decorations! Here’s How to Stay Safe: ✅ Verify Before You Scan: Always ensure the QR code is from a trusted source. If it looks suspicious, skip it! 🔍 ⭕️Check the URL: After scanning, carefully examine the URL. If it seems off, don’t enter any details! 🚫 🟢Use Security Apps: Equip your phone with reliable security apps to detect potential threats and protect your data. 🔒 🔊🔊Spread the Word: Share these tips with your loved ones so everyone can celebrate safely together! 🗣️❤️ 🧑‍🚒🧑‍🚒Report Scams: If you encounter a suspicious QR code, report it to local authorities. Let’s keep our community safe! 📢 This Diwali, let’s light up our homes and hearts without fear. Stay smart, stay safe, and enjoy the festival to the fullest! 🪔🌟 #cybersecurity #cyberawareness

43

2 Comments

#CyberSecurity #PCIDSSv4 #Requirement11 #ContinuousLearning Requirement 11 of PCI DSS Version 4.0 focuses on regular security testing and monitoring to ensure that systems are protected against potential vulnerabilities and threats. Join Deepak's Continuous Learning sessions to gain expert insights and practical guidance on implementing and maintaining compliance with Requirement 11. Stay ahead in the ever-evolving landscape of cybersecurity! 🚀

7

1 Comment

I am excited to share that I have contributed to the release of the #CISO #Handbook 2024! This edition delves into crucial insights on navigating #regulatory #compliance in the banking sector, with a focus on balancing robust cybersecurity measures and legal requirements. In this handbook, I’ve contributed my perspective highlighting strategies and best practices to ensure security while meeting regulatory expectations. Grab your copy today and stay ahead in the ever-evolving landscape of banking cybersecurity. #Cybersecurity #Banking #Leadership #compliance Hatton National Bank PLC ISACA Sri Lanka ISC2 Colombo Chapter, Sri Lanka StrategINK Kanchi Shah

174

13 Comments

🚨 New RBI Cybersecurity Master Directions Alert! 🚨 Are you prepared for RBI's latest security directive? The Reserve Bank of India (RBI) has shared a new Master Directive on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators (PSOs). For anyone operating in the fintech or digital payments sector, compliance with these guidelines are essential. Ensuring compliance with these new standards will be help protect your business and your customers from emerging cyber threats. Here’s a view of the compliance timelines: Large non-bank PSOs: Compliance required by April 1, 2025 Medium non-bank PSOs: Compliance required by April 1, 2026 Small non-bank PSOs: Compliance required by April 1, 2028 I've put together a simplified summary of these guidelines that will help you seamlessly integrate these new requirements into your organization. From enhancing governance controls to fortifying data security and refining your incident response, this guide is designed to equip you with the knowledge you need. Download your free copy now from the link below. Grab your copy here --> https://lnkd.in/dSMm2SFb #CyberSecurity #DigitalPayments #Fintech #RBI #Compliance #CyberResilience #SecurityStrategy #MasterGuidelines

409

26 Comments

Yes, it is a matter of great concern indeed, looking at the size and sensitivity of the stolen data, which includes, apart from PII, medical details of company’s 3 crore clients. Details about how the data was stolen in the Star Health breach are still unclear, but some information points to a few potential methods. The breach is believed to involve unauthorized access to Star Health’s systems, possibly through compromised API details or login credentials. The stolen data was made accessible via Telegram chatbots, which were used to distribute stolen records, including sensitive medical information. The hacker allegedly obtained the data by exploiting weaknesses in Star Health’s security protocols, although the exact technical methods (e.g., whether it involved exploiting vulnerabilities in APIs, phishing attacks, or other forms of unauthorized access) have not been fully disclosed. The company has initiated a forensic investigation to understand the breach further and prevent future incidents. Once we get details about modus operandi of the attack, it will throw some light on the vulnerabilities exploited.

9

𝗧𝗵𝗿𝗲𝗲 𝗰𝗶𝘁𝗶𝗲𝘀, 𝗰𝗼𝘂𝗻𝘁𝗹𝗲𝘀𝘀 𝗶𝗻𝘀𝗶𝗴𝗵𝘁𝘀, 𝗼𝗻𝗲 𝗺𝗶𝘀𝘀𝗶𝗼𝗻: 𝘀𝗶𝗺𝗽𝗹𝗶𝗳𝘆𝗶𝗻𝗴 𝗚𝗦𝗧 𝗰𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲! Over the past few weeks, we had the privilege of hosting 𝗘𝗩𝗢𝗟𝗩𝗘: 𝗗𝗲𝗰𝗼𝗱𝗶𝗻𝗴 & 𝗜𝗺𝗽𝗹𝗲𝗺𝗲𝗻𝘁𝗶𝗻𝗴 𝘁𝗵𝗲 𝗜𝗻𝘃𝗼𝗶𝗰𝗲 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 𝗦𝘆𝘀𝘁𝗲𝗺 (IMS) in 𝗠𝘂𝗺𝗯𝗮𝗶, 𝗗𝗲𝗹𝗵𝗶 and 𝗔𝗵𝗺𝗲𝗱𝗮𝗯𝗮𝗱. It was an incredible journey, interacting with professionals and industry leaders across these key cities. At each event, we dove deep into the practical challenges of the new 𝗜𝗻𝘃𝗼𝗶𝗰𝗲 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 𝗦𝘆𝘀𝘁𝗲𝗺 and 𝗜𝗻𝗽𝘂𝘁 𝗦𝗲𝗿𝘃𝗶𝗰𝗲 𝗗𝗶𝘀𝘁𝗿𝗶𝗯𝘂𝘁𝗼𝗿 (𝗜𝗦𝗗) mechanism under GST and 𝗺𝗮𝗻𝗮𝗴𝗶𝗻𝗴 𝗹𝗶𝘁𝗶𝗴𝗮𝘁𝗶𝗼𝗻. We explored how these new systems may seem daunting at first but can become powerful tools for streamlining compliance and transforming business operations—if approached proactively with the right technology. A heartfelt thank you to all who attended and contributed to the discussions in Mumbai, Delhi, and Ahmedabad. Together, we’re turning challenges into opportunities and shaping the future of GST compliance! Cygnet.One #GSTCompliance #InvoiceManagementSystem #TaxTech #GSTEvents #SupplyChainInnovation #GST #GSTCouncil

220

4 Comments

Excited to share my latest article for CXO Digital Pulse on the #CyberSurakshitSeries! In today's digital age, banks face a complex challenge: balancing robust cybersecurity defenses with strict regulatory compliance. This article explores how financial institutions can achieve this balance by: * Enhancing risk management frameworks * Adapting to evolving regulations * Leveraging technology for compliance efficiency I delve into key strategies to help banks navigate this landscape effectively. #Banking #Cybersecurity #RegulatoryCompliance #RiskManagement #FinancialSecurity #DataProtection #DigitalTransformation #strESCONStrategINK #CyberSecurityAwarenessMonth #CSAM #CyberSurakshitBharat Hatton National Bank PLC ISC2 Colombo Chapter, Sri Lanka ISACA Sri Lanka

76

14 Comments

Building Resilient Enterprises with regards to AI

26

Yesterday every post is NEWS, but what is lesson for CISO... Look for fact of Crowdstrike 1) Software update exposing a major single point of failure and triggering outages of essential and important services. 2) More than half the world is down, airplanes grounded, banking systems etc. 3) Most concerning is that a rollback is may be not possible. 4) Batch Operation to correct the issue not possible, Manual intervention is necessary to boot into safe mode and delete the update file on each affected instance. Lesson for CISO 1) Think about HA technologies stacks to rollback. 2) Restrict dynamic updates if possible. 2) Always prepare and practice IR and DR to manage “Customer Trust”, during such outage. 3) Technology stacks needs to be tested and maintained with solid availability metrics especially for updates. 4) Think of investing in Software Composition Analysis Tools to identify open source element in application. 5) Don’t panic and wait for formal vendor response. 6) Make sure the vendor fix is well tested before mass deployment. 7) Rebuilding user trust and learning from the incident is key. #outage #updates #ciso

29

1 Comment

Industry recognised White-Paper on managing Non-Human Identity Management Risks. A MUST-READ for anyone who wants to understand about the risks and challenges and how to go about addressing them. Reach out to the NHI Mgmt Group or Lalit Choda if you require further guidance and advice, including a FREE 1 hour consultation, on how to get started, understanding and managing these risks within your organisation. #nonhumanidentity #identitymanagement #machineidentity #workloadidentity https://lnkd.in/eptw2j5R

39

14 Comments

Singapore’s major retail banks are taking a bold step to enhance security for their digital customers. The Monetary Authority of Singapore (MAS) and the Association of Banks in Singapore (ABS) have jointly announced that within the next three months, one-time passwords (OTPs) will be phased out for bank account logins by customers using digital tokens. Why the Change? OTPs, while widely used for years, have limitations. Scammers can easily hijack them through social engineering tactics or spyware, making them ineffective against phishing attacks. In contrast, digital tokens in secure banking apps generate push notifications for second-factor authentication, significantly reducing the risk of unauthorized transactions. #banking #cybersecurity #Singapore #DigitalTokens #Authentication #PhishingPrevention #Banks #RBI #IBA #CII #BankingSector #CRO #CISO #CTO #CIO #MFA

41

1 Comment

RBI has recently expressed concerns that many regulated entities (like banks and financial institutions) are not properly following the prescribed guidelines for reporting cybersecurity incidents and data breaches. Here are the key issues: 1. Delayed Reporting - Companies are required to report any cybersecurity incidents within 6 hours of detection - Many organizations are failing to meet this timeline, sometimes taking days or weeks to report - This delay hampers the RBI's ability to assess systemic risks and take preventive measures 2. Incomplete Disclosures - Some companies are not providing full details about the nature and extent of breaches - Critical information about affected customers and potential damage is often omitted - This makes it difficult for the RBI to evaluate the true impact of incidents 3. Non-compliance with Guidelines - The RBI has established clear protocols for incident reporting through its Cyber Security Framework - Many entities are not following the structured reporting format - Some are bypassing official channels for breach notification 4. Impact on Customer Protection - Delayed or incomplete reporting can leave customers vulnerable to financial fraud - It prevents timely alerts and protective measures from being implemented - This undermines the RBI's mandate to protect consumer interests The RBI is likely to take stricter action against non-compliant entities to ensure better adherence to cybersecurity guidelines and protect the financial system's integrity. Companies need to strengthen their incident response mechanisms and ensure timely reporting of all security breaches. Thoughts on this?

31

1 Comment

Contributed my views in an article titled “Digital Trust journey and the perspective of CISOs” for The CISO Handbook by CXODIGITALPULSE.COM from StrategINK.  The publication consists with number of strategic insights from leading information security professionals in South Asia (Sri Lanka, India, Bangladesh, Nepal, Bhutan and Maldives). True cybersecurity goes beyond technology—it’s a culture of vigilance, where every individual is empowered to protect the integrity of the digital world and organization. A heartfelt big THANK YOU to Prateek Tokas and Kanchi Shah (StrategINK team) for the invite extended to join with the team of information security professionals at South Asia Enterprise Security Connect (ESCON2024) which is a premiere south Asia CISOs program in the lap of Aravalli – India.  The 5th edition of the ESCON Summit, aimed to unite experts, thought leaders and innovators across South Asian countries successfully delved into the evolving landscape of digital risks and resilience strategies. The event's success demonstrated the visionary leadership of Vinod Singh (Managing Director - StrategINK). It was an excellent opportunity that provided significant exposure and relationship-building, which has undoubtedly elevated my professional career. Also, it was a good gathering of quite a number of members ISACA in the region. ISACA leads the way in the pursuit of Digital Trust. Please visit for the survey report https://lnkd.in/gDPv4Hyd Please visit for the CISOs Handbook https://lnkd.in/ghErmb3y #digitaltrust #ESCON2024 #ISACA #cisohandbook #cxodigitalpulse #strategINK #infosec #securityculture

39

3 Comments