Bharat Raigangar

ISO/IEC 27005: Information security, cybersecurity and privacy protection — Guidance on managing information security risks, Fourth edition: 3954 ISO/IEC 27005: Information security, cybersecurity and privacy protection — Guidance on managing information security risks, Fourth edition: 3954 To post comments, create a FREE account and add comments in the box with the red balloon https://hubs.la/Q02KSvc50 #unifiedcompliance #cybersecurity #authoritydocuments #riskmanagement

5

ICS Advisory Project Weekly Summary [8 - 12 April 2024. Here is this week's ICS Advisory, Other CERT, & Vendor vulnerability advisories weekly summary for 22 – 26 April 2024. Attached are this week's CISA ICS Advisory summary slides. This past week, CISA released four new ICS Advisories for Siemens, Honeywell, and Hitachi Energy. Updated CISA ICS Advisories were released for the Rockwell Automation - 5015-AENFTXT [ICSA-24-102-09], Chirp Systems - Chirp Access [ICSA-24-067-01], Mitsubishi Electric - Electrical discharge machines [ICSA-24-051-03], Mitsubishi Electric - MELSEC iQ-R Series/iQ-F Series EtherNet/IP Modules and EtherNet/IP Configuration Tool [ICSA-23-157-02], and Mitsubishi Electric - MELSEC Series CPU module [ICSA-23-143-03]. Based on the new CISA advisories, Critical Manufacturing, Energy, Chemical, and Water and Wastewater Systems are the potentially affected critical infrastructure (CI) sectors. The ICS Advisory Project identified 11 new advisories from other CERTs and Vendors for the following vendors: MOXA [Industrial Switch], Delta Electronics [Industrial Gateway], Dräger [Medical Device and Software], OMRON [PLC], Meinberg [LANTIME], Secomea [Industrial Access Management Server for remote machine maintenance.], Welotec [SMART Enterprise Management System], Grassroot DICOM [DICOM medical files], and DCMTK [Medical software]. See the Weekly Summary of Other Vendor & CERT Advisories for potentially impacted CI sectors. Four new Known Exploited Vulnerability (KEV) Catalogs were added this past week. However, CISA released ICSA-24-116-03 - Siemens RUGGEDCOM APE1808 Devices Configured with Palo Alto Networks Virtual NGFW for CISA Known Exploited Vulnerability (KEV) Catalog match CVE-2024-3400 —Palo Alto Networks PAN-OS Command Injection Vulnerability.

3

Achieving ISO 27001 or other Security Compliance certifications marks a momentary security status, but continuous internal auditing ensures ongoing protection. This proactive approach not only identifies risks in real time but also ensures sustained compliance and adapts quickly to new threats. With the possibility of integrating with a GRC platform levels up the automated continues auditing and the implemented Cyber Security maturity level too. GRC Platform can make stuff dynamically managed in an easy way which helps the business go forward in a certain level of confidence 🚀 #cybersecurity #grc

8

𝐔𝐧𝐝𝐞𝐫𝐬𝐭𝐚𝐧𝐝𝐢𝐧𝐠 𝐓𝐡𝐢𝐫𝐝-𝐏𝐚𝐫𝐭𝐲 𝐑𝐢𝐬𝐤 𝐌𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭 (𝐓𝐏𝐑𝐌) : Importance and objective of TPRM,5 Phase of TPRM, TPRM Framework, TPRM best practices, TPRM lifecycle, How do we conduct a TPRM program? In today's interconnected business environment, effectively managing the risks associated with third-party vendors is crucial for mitigating potential threats to an organization's IT infrastructure. Third-party risk management involves the diligent identification, assessment, and mitigation of potential risks stemming from the engagement of external suppliers, service providers, and business partners. By implementing a robust and comprehensive framework for third-party risk management, organizations can proactively defend themselves against a wide array of threats, including cybersecurity breaches, violations of data privacy regulations, operational disruptions, and non-compliance issues that may arise from the actions or oversights of third-party entities. This proactive approach not only helps safeguard the integrity, security, and resilience of the organization's IT ecosystem but also bolsters the overall operational continuity and trustworthiness of the business. An Article by Praveen Singh, An Infographics by Netpoleon India, Techtalk Seres-An initiative by Mohan Kumar T L #ciso #cybersecurity #TPRM #cro

263

22 Comments

𝘾𝙮𝙗𝙚𝙧 𝙎𝙚𝙘𝙪𝙧𝙞𝙩𝙮 𝙖𝙣𝙙 𝘾𝙮𝙗𝙚𝙧 𝙍𝙚𝙨𝙞𝙡𝙞𝙚𝙣𝙘𝙚 𝙁𝙧𝙖𝙢𝙚𝙬𝙤𝙧𝙠 𝙛𝙤𝙧 𝙎𝙀𝘽𝙄 𝙍𝙚𝙜𝙪𝙡𝙖𝙩𝙚𝙙 𝙀𝙣𝙩𝙞𝙩𝙞𝙚𝙨 (𝙍𝙀𝙨) In today’s fast evolving digital landscape, SEBI regulated entities face a growing array of cyber threats. It’s essential for organizations to not only defend against these threats but to also build resilience for a quick recovery from incidents. SEBI’s Cyber Security and Cyber Resilience Framework provides a comprehensive roadmap for organizations to: 1. Enhance threat detection and prevention  2. Strengthen incident response mechanisms 3. Ensure business continuity and disaster recovery 4. Foster a culture of cyber security awareness Priya Gandhi and Khushboo Sharma have covered the categorization of regulated entities, key compliance obligations, the challenges in implementing the framework and implementation period for the applicability of the said CSCRF for different Regulated Entities. Jyant Kohli | Mayank Vashist | Kuldeep Singh | Pratima Arora | Deepeshh Kr. Sharma | Anjali Singh | Shweta Khandelwal | Trishal Jeet Singh | Prem Kumar Tailor | Mukesh Jakhar | Sumit Kaushik | Akshit Rai | Khushboo Chaudhary https://lnkd.in/gRm2FZGT

26

Discover insights on risk management frameworks, cybersecurity assessment tools, and other #risk & #compliance topics in this week’s resource roundup! Browse the selection: https://lnkd.in/gBw8Rncm #RiskManagement #GRC #Cybersecurity

1

"Cybersecurity Risk Management Specialist | Mitigating Cyber Threats | Delivering Strategic Risk Assessment & Protection Solutions for Businesses" #CyberSecurity #RiskManagement #CyberRisk #ThreatMitigation #DataProtection #RiskAssessment #InfoSec #CyberResilience #SecurityStrategy #Compliance #RiskMitigation #BusinessProtection

8

DORA refers to ICT concentration risk, defined as "an exposure to individual or multiple related critical ICT third-party service providers creating a degree of dependency on such providers so that the unavailability, failure or other type of shortfall of such provider may potentially endanger the ability of a financial entity to deliver critical or important functions, or cause it to suffer other types of adverse effects, including large losses, or endanger the financial stability of the Union as a whole". So does that mean individual EU banks etc. should be wary of using the big tech players such as Microsoft, Apple, Amazon, HP, Dell, IBM etc.? Could it imply or lead to some sort of EU cap per supplier, such that, say, the first 20% of banks may contract with Microsoft but the remaining 80% must find another ICT supplier? Cue bun fight to snap-up the big ones!

6

22 Comments

🔐 Strengthening Cybersecurity Governance with NIST CSF 2.0 🔐 Effective cybersecurity governance starts with understanding your organizational context. The Governance Function in the NIST CSF 2.0 Framework helps organizations monitor their cybersecurity posture, manage risks, and ensure compliance with industry regulations. Key Governance Elements: Governance Understanding: Tailoring strategies for healthcare, financial services, and government agencies. Organizational Context: Clear mission, objectives, and stakeholder engagement. Regulatory Compliance: Ensuring adherence to industry-specific regulations like HIPAA and GDPR. Risk Management: Evaluating risk tolerance and high-risk exposure areas. Stakeholder Engagement: Involving internal and external stakeholders in cybersecurity efforts. Cultural and Technological Alignment: Fostering innovation, awareness, and addressing IT vulnerabilities. Financial Strategy: Allocating budgets effectively and conducting cost-benefit analyses. Incident History: Learning from past breaches to improve future security measures. By implementing these practices, organizations can maintain high standards of cybersecurity governance, protecting their operations and customer trust. https://lnkd.in/dyf4XUGN

5

The 22nd control under Technical Controls in ISO 27001:2022 A.8.22 - Segregation of Networks #ISMS #ISO27001 #ISO27002

25

🚨 New Interview Alert! 🚨 🌐 The Importance of Implementing a Governance System in the Electronic Security Sector with Talal Al Asmi. Talal Alasmi, CISM, CISA, CDPSE, CSNE, CSNA,CRISC, a seasoned IT Auditor with over 20 years of experience in Information Security and Governance, shares invaluable insights into the critical role of governance in the electronic security sector. In this must-read interview, we explore: ✅ The significance of accountability and clear role definitions. ✅ Aligning security strategies with organizational objectives and regulatory frameworks. ✅ How robust governance enhances resilience, compliance, and proactive risk management. ✅ Best practices, common challenges, and the transformative impact of governance on cybersecurity operations. With a career marked by strategic leadership, cost-saving innovations, and initiatives like the Cyber Safe Project, Talal offers practical advice and visionary strategies for security professionals. 🔗 Read the full interview now: https://lnkd.in/e8VAUPg5 Don't miss this opportunity to gain expert knowledge and elevate your understanding of governance in the electronic security landscape. #CyberSecurity #Governance #InformationSecurity #Leadership #RiskManagement #ISO27001 #CyberGovernance #CyberSafe #SOC #ElectronicSecurity

3

#Managing_Digital_Entropy : with right ZTNA solution In today’s fast-paced world, where everything is becoming digitized, and the emergence of AI technologies is accelerating digital transformation. To embrace the digital shift, organizations are striving to secure their digital presence by enabling access to systems from anywhere, which in turn is expanding digital perimeters. As these perimeters expand, the complexity (entropy) of digital ecosystems increases. Much like the second law of thermodynamics, this rise in digital entropy leads to a corresponding increase in cyber risk. To maintain equilibrium, organizations must secure their digital ecosystems through three key pillars: skilled people, strong processes, and the right technologies. Here, we will focus on critical pillars: choosing the right technologies. Many organizations have shifted their priorities to Zero Trust Network Access (ZTNA) to secure remote or hybrid workforces. ZTNA improves organizational flexibility, agility, and scalability without exposing services directly to the Internet, making it more secure than remote access VPN. While many service providers offer ZTNA solutions, it is crucial for organizations to carefully evaluate whether these solutions meet the true objectives of ZTNA, particularly considering risks such as data breaches, unauthorized access, and application vulnerabilities. ZTNA has become a buzzword, but organizations need to carefully assess the key aspects of solutions. In my opinion, below are essential questions that organizations should ask when selecting a ZTNA provider. 📍Portal Security: Service providers offer portals for accessing internal applications. How is the service provider securing their portal against web attacks, DDoS attacks, session hijacking, and OWASP Top 10 vulnerabilities? 📍Authentication and Authorisation: How does the service provider manage users’ AAA (Authentication, Authorization, and Accounting). Does the solution offer MFA and how is it implemented? 📍Access Control: How granular is the access control? Can access be restricted based on user roles, device trust levels, user or device risk profile? 📍Cloud Exposure: Since remote access requires exposing internal applications to the cloud backbone of ZTNA provider. If a user’s system is compromised, what controls are in place to prevent web attacks, data exploitation, or exfiltration launched from compromised system? 📍Internal URL Protection: How does the service provider protect or obscure internal URLs from exposure when accessed through the ZTNA portal, minimizing risks of external attacks on internal systems? 📍Data Theft from Unmanaged Devices: What measures are in place to prevent data theft when access is provided from unmanaged/personal devices? In conclusion, as organizations navigate the complexities of digital transformation, evaluating ZTNA solutions with the right questions is critical for maintaining secure, scalable access. #Cybersecurity

103

11 Comments

#Cybersecurity "The digital transformation of organisations is embedded in the Risk Manager’s scope of work " #risk #risks #enterpriserisk #enterprisesecurityriskmanagement #intelligence #threatlintelligence #riskmanagement #riskanalysis #riskassessment #riskmanagementframework #operationalriskmanagement #projectriskmanagement #projectrisk #operationalresilience #resilience #operationalrisk #riskintelligence #governance #crisis #crisismanagement #complexity #chaos #crisisleadership #crisisplan #crisismanagementplan #stress #governance #decisionmaking #riskmanagement #riskinformed #securitymanagement #securityriskmanagement #resilience #humanfactors #emergency #disaster #emergencyresponse #safety #safetyfirst #safetymanagement #safetyassessment #safetyrisks #safetyculture #safetyanalysis #personalsafety #workplacesafety #healthandsafety #hazard #danger #peril #threat #PPE #protectivesafety #workplacesafety #security #securityriskmanagement #securitymanagement #securityrisks #enterprisesecurity #cybersecurity #physicalsecurity #informationsecurity #digitalsecurity #securityoperations #enterprisesecurityriskmanagement #securityassessment #intelligence #threatlintelligence #risk #riskmanagement #travelsecurity #travelsafety #travel #businesstravel #tourism #travelrisks #travelriskmanagement

12

2 Comments