Rajesh Laskary

Should Cyber be Part of Change Advisory Board A debate started with few stake holders where the question of including Cyber Stakeholders in Change Advisory Board was discussed. Few were of the opinion that cyber should only be part of the process but not a stakeholder, whereas the cyber wants to be a stake holder. What are your views on this?

9

3 Comments

The National Institute of Standards and Technology (NIST) recently released the updated Special Publications (SP) 800-63B, outlining the technical guidelines for organisations implementing digital identity services. See https://lnkd.in/gVT3sDei The "Password Verifiers" section outlines a 𝗺𝗼𝗿𝗲 𝗺𝗼𝗱𝗲𝗿𝗻 𝗮𝗽𝗽𝗿𝗼𝗮𝗰𝗵 𝘁𝗼 𝗽𝗮𝘀𝘀𝘄𝗼𝗿𝗱 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 and the move away from overly complex passwords and password policies. Instead, it emphasises using longer passwords and passphrases with more memorable combinations of words that reduce the predictability patterns that make them easier to crack. The new password requirements include several key updates: • 𝗣𝗮𝘀𝘀𝘄𝗼𝗿𝗱 𝗟𝗲𝗻𝗴𝘁𝗵: Emphasis is placed on 𝗹𝗼𝗻𝗴𝗲𝗿 𝗽𝗮𝘀𝘀𝘄𝗼𝗿𝗱𝘀 rather than complex composition rules. The minimum recommended length is 8 characters, the suggested length is 15, and the maximum length of at least 64 characters. • 𝗖𝗼𝗺𝗽𝗼𝘀𝗶𝘁𝗶𝗼𝗻 𝗥𝘂𝗹𝗲𝘀: Traditional complexity requirements (e.g., including uppercase letters, digits, and symbols) are 𝗻𝗼 𝗹𝗼𝗻𝗴𝗲𝗿 𝗿𝗲𝗰𝗼𝗺𝗺𝗲𝗻𝗱𝗲𝗱. Instead, users are encouraged to create longer, more memorable passwords. • 𝗣𝗮𝘀𝘀𝘄𝗼𝗿𝗱 𝗘𝘅𝗽𝗶𝗿𝗮𝘁𝗶𝗼𝗻: Routine 𝗽𝗮𝘀𝘀𝘄𝗼𝗿𝗱 𝗲𝘅𝗽𝗶𝗿𝗮𝘁𝗶𝗼𝗻 𝗶𝘀 𝗱𝗶𝘀𝗰𝗼𝘂𝗿𝗮𝗴𝗲𝗱 unless there is evidence of a compromise. • 𝗦𝗰𝗿𝗲𝗲𝗻𝗶𝗻𝗴 𝗔𝗴𝗮𝗶𝗻𝘀𝘁 𝗖𝗼𝗺𝗺𝗼𝗻 𝗣𝗮𝘀𝘀𝘄𝗼𝗿𝗱𝘀: Passwords should be 𝗰𝗵𝗲𝗰𝗸𝗲𝗱 𝗮𝗴𝗮𝗶𝗻𝘀𝘁 𝗹𝗶𝘀𝘁𝘀 𝗼𝗳 𝗰𝗼𝗺𝗺𝗼𝗻𝗹𝘆 𝘂𝘀𝗲𝗱 𝗼𝗿 𝗰𝗼𝗺𝗽𝗿𝗼𝗺𝗶𝘀𝗲𝗱 𝗽𝗮𝘀𝘀𝘄𝗼𝗿𝗱𝘀 to prevent easy guessing. • 𝗡𝗼 𝗞𝗻𝗼𝘄𝗹𝗲𝗱𝗴𝗲-𝗕𝗮𝘀𝗲𝗱 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻: Knowledge-based authentication (e.g., first pet) is 𝗱𝗶𝘀𝗰𝗼𝘂𝗿𝗮𝗴𝗲𝗱 due to its known vulnerability. • 𝗣𝗮𝘀𝘀𝘄𝗼𝗿𝗱 𝗠𝗮𝗻𝗮𝗴𝗲𝗿𝘀: Password managers are 𝗲𝗻𝗰𝗼𝘂𝗿𝗮𝗴𝗲𝗱 𝘁𝗼 𝗵𝗲𝗹𝗽 𝘂𝘀𝗲𝗿𝘀 𝗺𝗮𝗻𝗮𝗴𝗲 𝗽𝗮𝘀𝘀𝘄𝗼𝗿𝗱𝘀 securely. We always recommend implementing MFA and Conditional Access Policies to help protect your identities even further. And of course, you can always move to use passwordless authentication (or passkeys) and negate the need for a password at all! #BareCoveTechnology

14

1 Comment

The release of "Privacy Across Borders: Guidance on Cross-Border Data Transfers for Indian Organisations" by Data Security Council of India is a timely and crucial resource, especially in the context of the newly enacted Digital Personal Data Protection Act, 2023 (DPDPA). As businesses increasingly engage in cross-border data transfers, it is vital for organizations to stay updated on legal obligations and best practices to ensure the highest level of data privacy and security. The guide's emphasis on Data Protection Impact Assessments, audits, and harmonizing global compliance requirements is particularly valuable. It offers practical steps that not only support compliance but also foster trust with clients and users across borders. For organizations serving a global user base, this resource is a must-read to maintain robust data protection standards while navigating the complex landscape of international data transfers. Kudos to Data Security Council of India for providing this clear, actionable framework! https://lnkd.in/gCE2fZi7 #DPDP #CyberSecurity #DataProtection #DPDPA #CrossBorderTransfers #Privacy #Compliance

4

#CISA Preparation: Domain 5 Amendments Series: Article 4 Digital Rights Management: "Protecting Digital Content, Empowering Creators" #cisaaspirant, #riskmanagement, #cybersecurity

77

9 Comments

#questionforthegroup Data Breaches on the Rise? ISO 27001 Lead Auditors are in High Demand. Get Certified & Lead the Way in Information Security. #GetCertified #InfoSec #ISO27001 #leadauditor #informationsecurityawareness #infosecjobs #cybersecurity #tuvsud #leadauditorcertification #achieveyourgoals #weekend #data #securitybreach

1

Every corporate aspires to maintain discipline in their processes and document policies that sometimes remain at their desktop. Falcon Eye Cyber Security launches a tool "Cyber Risk Guard for Risk Management, and Smart Comply" for Compliance Management, ISO 27001/ ISO 22301/ ISO 27701 that ensures assignment of risk to the risk owner of relevant department and provides an effective layer of governance to attain and maintain compliance. During the launch at ISNR 2024, Abu Dhabi we received a tremendously encouraging response from visitors and exhibitors alike. ISNR 2024, Abu Dhabi is the premier national exhibition for Cybersecurity and National Resilience and is attended by ministry officials and dignitaries from UAE, Middle East and Africa. #isnr2024 #Cybersecurity #digitalforensics #nationalresilience #grc #iso27001 #iso22301 #iso27701 #riskmanagement #iso31000 #NIST800 #compliancemanagement #iso17025 #digitalization #homelandsecurity #digitalizationinhomelandsecurity #sharingintelligence #intelligenceledpolicing #falconeyecybersecurity

11

I now work in Risk and Compliance domain focused on Cyber Risk. Prioritising risk management activity based on frequency and severity of impact is the right approach in this domain. There are multiple types of discriminations which generate risks for organisations with different frequencies and intensities. LGBTQ+ is one such type of discrimination Caste is another. What is the evidence that LGBTQ+ discrimination is more frequent and/or intense compared to Caste discrimination, in India? Why then do corporates in India prioritize reducing LGBTQ+ discrimination at the cost of doing anything about Caste Discrimination? The answer is that there is no consensus about what to do about Caste Discrimination in private sector while this exists for LGBTQ+. All the DEI guys talking about Caste Discrimination, want to do is Bhajans and Kirtans about it. Caste discrimination (overt and covert) is much too prevalent. But there are no well specified policies that corporates can adopt. Every DEI person and media wants to just talk about it without drafting a policy. They want to post some content to showcase that they are supportive of anti-caste movement, but nobody, not even well funded DEI people in the USA have written even a single policy that can be implemented by any corporate anywhere. They just want to beat their loud drums... Caste this, Caste that, Caste A, Caste B.... One can hardly blame corporates for not touching the hot potato unless there is a consensus policy in place. Unless DEI people sit down to draft a proper policy, they will not understand the gravity of the issue. Since posting random chants about caste sates them, they never sit down to draft a policy. The last person who offered to draft such a policy drafted something unrelated to it. Looks like people just do not even get the problem. They just continue... Caste this, Caste that, Caste A, Caste B....

24

CERT-In Guidelines Simplified: Secure Application Design & Operations We’ve simplified the CERT-In Guidelines issued by the Indian Computer Emergency Response Team (CERT-In) and mapped them to ISO:27001 for your convenience! 🔗 Read More: Easy-to-Understand CERT-In Guidelines for Secure Application Design - https://lnkd.in/ddppMEM2 💡 Claim Your Free Checklist Today! Fill out the form below to get your Free CERT-In Compliance Checklist and ensure you stay compliant. Fill out the form here - https://lnkd.in/d8Q-JmcB 🚀 Bonus: We’ve also added the checklist to AuditG.io—our compliance management app — so you can implement it easily. Get started with AuditG today and manage your compliance like a pro! FREE DEMO available. For a deeper dive, check out our full guide on CERT-In Guidelines for Secure Application Lifecycle: 🔗 CERT-In Guidelines for Secure Application Lifecycle on our website - https://lnkd.in/dmzJ72jT Don’t miss out on staying compliant!

1

ISO 22301 Business Continuity Management System Why should you take this training course? Disasters have various impacts in organisations. Disasters can result from natural events, information security breaches, or various other incidents. They are often unpredictable and that highlights the significance of preparedness in setting your business apart and shaping its future. As such, proper planning is essential in reducing risks, minimising consequences, and managing the negative impacts of disasters and incidents while ensuring the continuity of daily operations to meet customer needs without interruption. Establishing a BCMS based on ISO 22301 can help organisations progress toward understanding and managing disasters, incidents, and risks. Therefore, this training course is designed to provide participants with the necessary knowledge and skills to implement a business continuity management system (BCMS) based on the requirements of ISO 22301. By participating in this training course, you will learn the best practices of business continuity management, enabling the establishment of a framework that ensures an organisation's continued operational effectiveness during disruptive events. We also have other ISO Trainings, ISO 9001 Quality Management System ISO 27001 Information Security Management System ISO 37301 Compliance Management System many more just ping me, we are glad to guide and serve you.

3

I have received a few queries on the practical use of GenAI for exposure management after the last post. Thought of explaining it with a practical example. Imagine your external exposure management platform, like NST Assure, continuously discovers assets, technologies, and associated exposures. It also collects contextual information about the asset from the customer and learns about the context dynamically. For instance, it identifies a web asset in a client’s attack surface, “share.abcBank[.]com,” as a MoveIT instance intentionally exposed for legitimate file transfers. Additional contextual information reveals details such as “Owner: Partner,” “Data Type: KYC,” and “Purpose: Loan Processing.” This indicates that the asset is owned by a partner of ABC Bank and is used to share collected KYC documents with the bank as part of loan processing. Even though the asset is owned by a partner, the data collected is sensitive. A leak could result in significant business or reputational damage to the organization. Now, suppose the exposure management platform detects a trending MoveIT RCE vulnerability on this asset. Using GenAI and the contextual information it has, the platform can predict the actual business impact and threat scenario. Eg: 🚩Predicted Threat Scenario 1: “Exploitation of this vulnerability will allow attacker to collect sensitive PII data which can be used for self onboarding to digital banking platform.” This allows platform to rate the risk accurately and prioritize attention for better remediation, thereby improving the Mean Time To Remediate (MTTR). Another example use case for GenAI is the continuous correlation of attack surface data to identify emerging component or library-level vulnerabilities. These are just a few examples of how GenAI can be beneficial in exposure management, highlighting its potential for many other interesting and useful applications.

21

The recent regulatory guidelines, viz RBI Master Directions of Nov 2023 and SEBI Cybersecurity and Cyber Resilience Framework (CSCRF) of Aug 2024 lay added importance to cyber resilience, business continuity and disaster recovery, incident response and recovery from cyber incidents. Boards are being increasingly attentive and seeking deeper insights on the organizations' preparedness to respond to and recover from cyber incidents. Being part of the Boards of regulated entities, I saw this quarter's IT Strategy and Technology Committee meetings, as well as the Board meetings delve deep and enquiring with the security and technology leadership and sometimes, directly from the MD/CEO, on : 1. Cyber incidents reported, their impact and root-cause assessments. Note : for the organizations, these were mostly hits or false positives. 2. Resilience scores, with Q-o-Q and Y-o-Y comparatives 3. Business Continuity Drills and results 4. Disaster Recovery exercises and results 5. Health check report on the primary as well as the recovery sites, including cloud DR assessments 6. Cyber / technology risk assessments 7. Compliance and reporting (technology) 8. Ongoing governance and improvement around the Cyber Crisis Management Plan (or similar plan, by whatever nomenclature it's defined) 9. Adequacy of technology & security resourcing and training 10. Data protection, with special emphasis on vendor / third party access to critical data & resources and controls around the same The above were some of the top discussion points, but not the only ones. As Boards are made more and more involved and responsible over governance of the organizations' cyber security, resilience, technology governance and risk assurance, Board members will engage more regularly on discussions about cyber risks, inquire of the management their capacity-capability-readiness to respond to and recover effectively from cyber incidents. And above all, the Board would like to ensure compliance to all the relevant regulatory provisions, including on technology and #cybersecurity. To all Technology and Security leaders - the message is very clear, the regulators and the Boards would like to see much more than mere tick mark exercise, specially if you're a regulated entity. - read through each clause in the directions & circulars from regulators - assess thoroughly your current status, including process, operations, technology architecture, procedures, documentation et all - perform risk assessment - technology and operations, over each part of your business - conduct data flow analysis, ascertain your data protection strategy - analyze your third party / vendor connections at all business touchpoints Once you analyze your current state, compare with the requirements given by regulatory directions. Then, step-by-step, put in the measures, updates, upgrades. These are critical steps and require expert acumen - take help from external experts, as required. #technologygovernance

315

24 Comments

Very Often companies get confused to choose between CERT-In Empaneled vs. Non-Empaneled Audit Vendors for cyber security audits. In India, the requirement for CERT-IN empaneled audit vendors varies across industry sectors: Industries Requiring CERT-IN Empaneled Vendors: 1.Banking and Financial Services: Given the highly regulated nature of the banking and financial sector, organizations in this industry often require CERT-IN empaneled vendors for cybersecurity audits. Compliance with regulations such as RBI guidelines necessitates the use of accredited vendors to ensure data security and regulatory adherence. 2.SEBI Regulations: Business and related software covered by the SEBI Cybersecurity and Cyber Resilience Framework rules. 3.Government Agencies and Public Sector Undertakings (PSUs): Government entities and PSUs deal with vast amounts of sensitive data and play a crucial role in national security and public service delivery. Compliance with cybersecurity guidelines issued by CERT-IN is imperative for these organizations, making the engagement of CERT-IN empaneled vendors essential for cybersecurity audits. 4.UIDAI Regulations: Companies or people employing software should adhere to the UIDAI – AUA KUA Compliance mandate. Industries Where CERT-IN Empaneled Vendors May Not Be Mandatory: 1.Small and Medium-sized Enterprises (SMEs): While SMEs are increasingly becoming targets of cyber threats, they may not always be subject to the same regulatory requirements as larger enterprises. Consequently, while cybersecurity audits are advisable, the use of CERT-IN empaneled vendors may not be obligatory, allowing flexibility in vendor selection based on factors such as budget and specific cybersecurity needs. 2.Startups and Technology Companies: Startups and technology firms operate in dynamic environments characterized by innovation and agility. While cybersecurity is crucial for these entities, regulatory obligations may not always mandate the use of CERT-IN empaneled vendors. As such, they have the flexibility to choose audit vendors based on their unique requirements and growth trajectories. Understanding these industry-specific considerations empowers organizations to make informed decisions when selecting audit vendors, ensuring alignment with regulatory requirements, cybersecurity objectives, and operational realities. #Cybersecurity #Audits #EmpaneledVendors #IndustrySpecific #India #Regulations

5

#CyberWhisper #CyberSecurity #Rogueware : Rogueware - This is a type of deceitful malware which claims to be a trusted and harmless software program (such as antivirus). Cyber criminals use rogueware to harvest data from their victims or to trick them intro paying money. Often, rogueware also includes adware functions, which adds a burden and a potential risk to the infected PC.

16

𝐔𝐧𝐝𝐞𝐫𝐬𝐭𝐚𝐧𝐝𝐢𝐧𝐠 𝐑𝐢𝐬𝐤: 𝐀 𝐃𝐢𝐚𝐥𝐨𝐠𝐮𝐞 𝐰𝐢𝐭𝐡 𝐭𝐡𝐞 𝐁𝐨𝐚𝐫𝐝 𝐨𝐧 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐓𝐡𝐫𝐞𝐚𝐭𝐬 🔐 As we navigate the complex landscape of cybersecurity, one of the critical conversations we must have is with our board of directors. Their role in overseeing risk management is pivotal, but there are often gaps in understanding that we need to address to ensure our organisation's security posture is robust. 𝐖𝐡𝐚𝐭 𝐭𝐡𝐞 𝐁𝐨𝐚𝐫𝐝 𝐔𝐧𝐝𝐞𝐫𝐬𝐭𝐚𝐧𝐝𝐬: • 𝐑𝐞𝐩𝐮𝐭𝐚𝐭𝐢𝐨𝐧 𝐑𝐢𝐬𝐤: Boards are acutely aware of the potential damage a security breach can cause to the organisation's reputation. They understand that trust is hard-earned and easily lost. • 𝐅𝐢𝐧𝐚𝐧𝐜𝐢𝐚𝐥 𝐈𝐦𝐩𝐚𝐜𝐭: The financial consequences of cyber incidents, including fines, litigation, and loss of business, are well understood. This drives the board’s interest in ensuring adequate cybersecurity budgets. • 𝐑𝐞𝐠𝐮𝐥𝐚𝐭𝐨𝐫𝐲 𝐂𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞: Board members recognise the importance of adhering to regulatory requirements and the risks associated with non-compliance. 𝐖𝐡𝐚𝐭 𝐭𝐡𝐞 𝐁𝐨𝐚𝐫𝐝 𝐎𝐟𝐭𝐞𝐧 𝐌𝐢𝐬𝐬𝐞𝐬: • 𝐓𝐞𝐜𝐡𝐧𝐢𝐜𝐚𝐥 𝐍𝐮𝐚𝐧𝐜𝐞𝐬: The complexity of cyber threats and the intricacies of defensive measures often escape the board’s grasp. They may not fully understand the technical depth required to counteract these threats. • 𝐄𝐯𝐨𝐥𝐯𝐢𝐧𝐠 𝐓𝐡𝐫𝐞𝐚𝐭 𝐋𝐚𝐧𝐝𝐬𝐜𝐚𝐩𝐞: Cyber threats evolve rapidly, and staying updated requires continuous learning. Boards may not always appreciate the dynamic nature of these threats and the need for ongoing investment in advanced defences. • 𝐏𝐫𝐨𝐚𝐜𝐭𝐢𝐯𝐞 𝐯𝐬. 𝐑𝐞𝐚𝐜𝐭𝐢𝐯𝐞 𝐌𝐞𝐚𝐬𝐮𝐫𝐞𝐬: There is sometimes a misconception that cybersecurity is about reacting to breaches rather than proactively preventing them. This can lead to underinvestment in proactive measures like threat intelligence and continuous monitoring. 𝐁𝐫𝐢𝐝𝐠𝐢𝐧𝐠 𝐭𝐡𝐞 𝐆𝐚𝐩 𝐰𝐢𝐭𝐡 𝐄𝐥𝐞𝐦𝐞𝐧𝐝𝐚𝐫: To foster a more comprehensive understanding, it’s essential to translate technical jargon into business impact. At Elemendar , we bridge this gap by offering products that make cybersecurity intelligence actionable and understandable for all stakeholders: • 𝐀𝐈-𝐃𝐫𝐢𝐯𝐞𝐧 𝐈𝐧𝐬𝐢𝐠𝐡𝐭𝐬: Our AI-driven solutions transform complex threat data into clear, actionable insights, helping board members understand the real impact of potential threats. • 𝐂𝐨𝐧𝐭𝐢𝐧𝐮𝐨𝐮𝐬 𝐋𝐞𝐚𝐫𝐧𝐢𝐧𝐠: We provide continuous updates on the evolving threat landscape, ensuring that the board stays informed about the latest trends and necessary defences. • 𝐏𝐫𝐨𝐚𝐜𝐭𝐢𝐯𝐞 𝐓𝐡𝐫𝐞𝐚𝐭 𝐌𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭: Elemendar’s products focus on proactive measures, integrating threat intelligence into everyday security practices. This helps in shifting the mindset from reactive to proactive, enhancing overall security posture. #CyberSecurity #RiskManagement #BoardOfDirectors #CyberThreats #Leadership #CISO

19

Cyber Assurance is a massive step up from the Cyber Essentials foundation that it builds on. In our experience, our clients who have upgraded to Cyber Assurance have significantly improved their business security and resilience as a result - as well as opening new market and investment opportunities. #cyberassurance #cyberessentials

3