Surain Silva 🎯

Attended a half day intensive interaction session between Fintech representatives and Law Enforcement Agencies to find the measures to minimise cyber crimes and frauds . Varoious suggestions received from both sides such as use of tech , prompt response from Nodel rep of banks and fintechs , evidence based action during first golden hour after fraud , identifying mule accounts proactively based on deep tech , creating fear psychosis among fraudsters , capturing geo location of payment transactions etc. Extremely happy to inform that different LEAs have appreciated the efforts of #NPCI for providing prompt support to these agencies specifically API based access and other insights etc. . Cyber crimes and frauds are realities as we move to the path of further digitisation. However , if entire ecosystem work as a team , this can be managed and brought to the acceptable level . NPCI will continue to be the guiding force in this ecosystem to fight this menace. #frauds #cybercrimes #fintech #digitalpayment #NPCI #cyberpolice

70

4 Comments

🔐 Understanding NIST Cybersecurity Framework (CSF): Subcategory GV.SC-04 🔐 I am firing this series back up. Let’s break down another subcategory! Today, let’s talk about GV.SC-04—a key subcategory in the framework that focuses on ensuring organizations inventory their suppliers and prioritize them by criticality. Why does this matter? Imagine your organization has top-notch security measures, but (somehow) does not know what vendors are critical to your day-to-day operations. This misalignment can lead to poor vulnerability prioritization, disastrous incident response, and probably legal issues. 🔍 GV.SC-04 ensures you keep a record of all suppliers and develop criteria for supplier criticality. Criticality could be based on the sensitivity of data processed by the vendor, the degree of vendor access to your systems, or simply the vendor's involvement in your critical business processes. This not only helps in protecting your data but also in avoiding potential legal pitfalls. For those not familiar with the NIST CSF, think of it as a guide that helps organizations manage and reduce cybersecurity risks. It’s widely respected and used across various industries. 🌐 As cybersecurity becomes more critical, understanding and implementing these best practices can make a significant difference in protecting your organization’s data and reputation. #Cybersecurity #NISTCSF #Compliance #InformationSecurity #RiskManagement

15

3 Comments

🔒 **You’ve got cybersecurity basics covered… what next ….? Identity Governance and Administration has to come next 🔒 sorry not sorry long post!!! Implementing basic cybersecurity controls is a significant first step in protecting any organisation. If you stand still at the implementation of basic controls, you will move backwards in a world of increasing risk and evolving threat. Identity Governance and Administration (IGA) is a critical next phase that ensures continued protection, ensuring users have the right access at the right time for the right reason. 🎯 **Why IGA Matters:** 1. **The castle and moat model no longer reflects reality**: Organisations data no longer lives within a single boundary. We have data everywhere and an IGA enables real-time monitoring and management of user access, preventing unauthorized access and potential breaches. 2. **Protect business value**: ensure users have the right access at the right time for the right reason and nothing more. 3.. **Be efficient and simple**. Give the access they need on day 1. Give them a single portal for all IT requests including access to resources. Remove access when it’s no longer needed- automatically. 4..**Risk Mitigation**: Automate access controls and reviews, to meet internal audit findings of access controls and prevent manual audits taking weeks of time. 5. **Operational Efficiency**: Streamline identity processes and self-service capabilities to free up IT resources for other value added initiatives. 🔗 **Integrated Approach**: Combining cybersecurity basics with comprehensive IGA strategy creates a multi-layered defense system that is resilient against evolving threats. Combined with Network Access Contol it goes a long way to a Zero Trust Network Access approach. Safeguarding identity is not just an IT task but a strategic imperative. Let’s prioritize IGA to build a secure and compliant future. #CyberSecurity #IdentityGovernance #IGA #DataProtection #Compliance #RiskManagement

53

5 Comments

#PCI4.0 #Cybersecurity #DataProtection #ContinuousLearning #Pcidsscertified #pcidssconsultant Stay ahead in the cyber game with insights from Deepak! 🚀 PCI DSS Version 4.0's Requirement 10 is paving the way for stronger data protection. Learn how it's reshaping cybersecurity practices and keeping your information secure. 💡💳

9

#CyberSecurity #PCIDSSV4.0 #Requirement12#ContinuousLearning 🚀📚 🔒💻 Ready to level up your cyber security and PCI DSS 12 knowledge? Join me and explore with Continuous Learning by Deepak! Gain expert insights and comprehensive guidance to stay ahead of the curve.

5

DORA refers to ICT concentration risk, defined as "an exposure to individual or multiple related critical ICT third-party service providers creating a degree of dependency on such providers so that the unavailability, failure or other type of shortfall of such provider may potentially endanger the ability of a financial entity to deliver critical or important functions, or cause it to suffer other types of adverse effects, including large losses, or endanger the financial stability of the Union as a whole". So does that mean individual EU banks etc. should be wary of using the big tech players such as Microsoft, Apple, Amazon, HP, Dell, IBM etc.? Could it imply or lead to some sort of EU cap per supplier, such that, say, the first 20% of banks may contract with Microsoft but the remaining 80% must find another ICT supplier? Cue bun fight to snap-up the big ones!

6

22 Comments

Operation requirements address the issues of providing they customers/users with a mechanism of using the system. The security requirememtns speak to the issues of reducing risk to enterprise by addressing the confidentiality, Integrity, and availability of the system. #requirements #gapanalysis #informationsecurity #risk #confidentiality #integrity #availability

2

🚀 Understanding and Mapping NIST CSF 2.0 to ISO 27001:2022 🚀 In today’s evolving cybersecurity landscape, organizations look towards globally recognized frameworks and standards to safeguard their digital assets. Two significant ones are NIST CSF 2.0 and ISO 27001:2022. Let’s break them down: ### NIST CSF 2.0: A comprehensive framework guiding organizations in managing and reducing cybersecurity risks. The five core functions are: 1. Identify: Understand cybersecurity risks. 2. Protect: Implement safeguards to manage risks. 3. Detect: Identify cybersecurity events. 4. Respond: Take action during a cybersecurity event. 5. Recover: Restore services after a cybersecurity event. ### ISO 27001:2022: This international standard outlines best practices for information security management. It provides requirements for establishing, implementing, maintaining, and continuously improving an Information Security Management System (ISMS). ### Mapping NIST CSF 2.0 to ISO 27001:2022: - Govern (GV) in NIST CSF aligns with ISO 27001’s context, leadership, and planning sections (e.g., risk management, policies, and roles). - Identify (ID) aligns with Asset Management and Risk Assessment in ISO 27001, ensuring organizations understand their information security risks and asset landscape. - Protect (PR) maps to Access Control, Awareness Training, and Data Security in ISO 27001, safeguarding critical assets through security measures and education. - Detect (DE) mirrors Continuous Monitoring and Adverse Event Analysis in ISO 27001, ensuring incidents are spotted and analyzed in time. - Respond (RS) aligns with Incident Management in ISO 27001, covering how to handle security incidents efficiently. - Recover (RC) relates to Business Continuity and Incident Recovery in ISO 27001, ensuring resilience and fast recovery after incidents. By combining NIST CSF 2.0 and ISO 27001:2022, organizations can build a robust and comprehensive cybersecurity strategy, leveraging both a framework for managing risks and a standard for compliance and best practices. #Cybersecurity #NISTCSF #ISO27001 #RiskManagement #CyberResilience

19

1 Comment

Cybersecurity QMS Management System with ISO/IEC 27001 ISMS. Many professionals tasked with implementing ISO/IEC 27001 ISMS immediately jump to Annex A, overlooking the most important controls listed in clauses 4 to 10. In this short 12-minute video, I will explain the difference, and you will learn why the information security management system is so important. You will also learn from my experience how easy it is to adopt this globally accepted framework for cybersecurity, ISO/IEC 27001 ISMS. Please remember to like, share, and click on the bell to subscribe to my YouTube channel and never miss another update. #qms #cqms #quality #qualitymanagement #cybersecurity #security #compliance #iso27001 #nist #fedramp #fisma #gdpr #privacy #hitech #ccpa #sox #glba #ccpa #pcidss #isae3402 #ssae18 #nydfs #itar #soc2 #nerc #cmmc #nis2 #nist800171 #nistsp80053 #cobit #saphana #csa #cloud #architecture #programmanagement #mergersandacquisitions #law #regulations #contractmanagement #crisismanagement #breach #incidentmanagement #policy #procedures #standards #knowledge #ooda #pmi #ciso #dpo #projectmanagement #markesbernard Link; https://lnkd.in/gFwGS9gn

3

2 Comments

CISM is back on 7th May. This interactive, online 4-day programme will teach you how to use COBIT, ValIT and RiskIT to implment a InfoSec Risk Management Programme that supports core business goals. Sign up now on our website. #CISM #InformationSecurity #InfoSecTraining

4

NIST AI Risk Management Framework (AI RMF) Voluntary framework to improve trustworthiness in AI design, development, use and evaluation. Developed through open collaboration with various stakeholders. Focuses on: Identifying and managing AI risks and potential impacts. Building trustworthy AI systems. Key Sections: Framing Risk: Understanding and addressing risks, impacts, and harms. Challenges of AI risk management. Target audience for the framework. AI Risks and Trustworthiness: Characteristics of trustworthy AI. Guidance for achieving trustworthiness. AI RMF Core: Four functions for managing AI risks: Govern, Map, Measure, Manage. AI RMF Profiles: Implementation of the framework for specific use cases. Access to the AI RMF framework and playbook https://airc.nist.gov/Home

64

Cybersecurity Reasonableness Policy Checklist Part 3 The following items comprise essential policy elements an organisation should perform to achieve cybersecurity reasonableness. An organisation should carefully document the steps it takes to address, implement, and maintain each of these elements. Additionally, these activities should be performed on a recurring basis to maintain an up-to-date cybersecurity program. 1.  Understand the organisation’s mission, stakeholders, and obligations. 2. Develop and implement a cybersecurity program. 3. Identify resources: funds, personnel, outsourced roles, automated tools. 4. Follow an industry-recognised cybersecurity framework or standard. 5.  Measure conformity to the framework and mitigate findings to ensure ongoing compliance with its program. 6.  Conduct periodic risk assessments in accordance with methodology defined in cybersecurity program, and mitigate findings. 7.  Conduct periodic independent assessments of the cybersecurity program and mitigate findings. FortMesa Infoprotect UK

3

SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) Insights SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), introduced in August 2024, sets clear guidelines to enhance the security posture of SEBI-regulated entities (REs), including stock exchanges, depositories, mutual funds, and other financial intermediaries. The framework focuses on cybersecurity (protecting systems and data) and cyber resilience (recovering from cyberattacks). Here's a summary with an example: Key Components of CSCRF: Comprehensive Cybersecurity Policy: REs must adopt a cybersecurity and resilience policy covering threat identification, risk management, response, and recovery. This ensures continuous protection across all IT systems. Risk Management Framework: Organizations must develop and implement a framework to regularly assess and manage cyber risks. Example: A stock exchange conducts risk assessments every quarter, identifying potential vulnerabilities in its trading systems, and implements countermeasures. Data Protection: REs are required to use Full-Disk Encryption (FDE) and File-based Encryption (FE) for sensitive data protection, both in storage and transmission. Example: A mutual fund company encrypts all client financial data and uses secure encryption protocols for online transactions to prevent unauthorized access. Security Operations Center (SOC): Larger REs must set up a SOC for real-time threat monitoring. Smaller entities can use Market SOCs established by the Bombay Stock Exchange (BSE) or National Stock Exchange (NSE) for their monitoring needs. Example: A depository sets up a SOC to monitor all incoming traffic for unusual activities, ensuring quick responses to potential security breaches. ISO 27001 Certification: Large entities must obtain ISO 27001 certification, which ensures adherence to international standards for information security management. Vulnerability Assessment & Red Teaming: REs must conduct Vulnerability Assessments and Penetration Testing (VAPT) regularly to identify potential weaknesses in their IT systems. Additionally, red teaming exercises (simulated cyberattacks) assess the organization's defensive capabilities. Example: A brokerage firm simulates a cyberattack on its trading platform, analyzing how well its defenses can handle the breach and where improvements are needed. Incident Response: REs must establish protocols for detecting, reporting, and recovering from cyber incidents. This ensures quick recovery and minimal business disruption in the event of a cyberattack. Example: In case of a data breach, a portfolio management service automatically triggers a response plan, including notifying SEBI and affected clients within a prescribed timeframe. Implementation Deadlines: Entities with existing cybersecurity policies must comply with the new framework by January 1, 2025, while newly regulated entities have until April 1, 2025.

4

Should Cyber be Part of Change Advisory Board A debate started with few stake holders where the question of including Cyber Stakeholders in Change Advisory Board was discussed. Few were of the opinion that cyber should only be part of the process but not a stakeholder, whereas the cyber wants to be a stake holder. What are your views on this?

9

3 Comments

The NIST Cybersecurity Framework (CSF) is a set of guidelines and best practices developed by the National Institute of Standards and Technology (NIST) to help organizations manage and reduce their cybersecurity risks. The training would focus on how to effectively implement and apply the NIST CSF within an organization

18

1 Comment

🔐 Navigating Third-Party Risks: NIST CSF GV.SC-07 🔐 In today’s interconnected world, managing cybersecurity risks isn’t just about safeguarding your own organization—it’s also about understanding and managing the risks associated with your suppliers and third-party partners. That’s where NIST CSF Subcategory GV.SC-07 comes into play. GV.SC-07 focuses on ensuring that the risks posed by a supplier, their products and services, and other third parties are thoroughly understood, recorded, prioritized, assessed, responded to, and continuously monitored throughout the relationship. This sounds similar to GV.SC-05, which ensures the *contract language* with the vendor allows for the monitoring called for by GV.SC-07. Why is this important? Even if your internal security measures are robust, a vulnerability in a third-party provider can expose your organization to significant risks. GV.SC-07 emphasizes a proactive approach to third-party risk management, ensuring that you don’t just evaluate risks at the start of a relationship but continuously monitor and address them as the relationship evolves. For those new to the NIST Cybersecurity Framework, it’s a comprehensive guide used by organizations to manage and reduce cybersecurity risks effectively. GV.SC-07 helps organizations maintain a secure and resilient supply chain by keeping a close eye on third-party risks. 🌐 In a world where supply chains are more interconnected than ever, understanding and managing third-party risks is crucial for protecting your organization’s data and reputation. #Cybersecurity #NISTCSF #ThirdPartyRisk #SupplyChainSecurity #RiskManagement

9

🔒7 Components of an Effective “Data Protection Strategy”. 🔒 1.       Data Risk Analysis 2.       Data Back-up and Recovery 3.       Data Breach Prevention 4.       Data Access Management 5.       Data Storage Management 6.       Data Standards and Regulatory Compliance 7.       Data Encryption By focusing on these key areas, organizations can enhance their cybersecurity posture and safeguard valuable information. #DataProtection #Cybersecurity #DataPrivacy #InfoSec #Compliance #RiskManagement #DataEncryption #cybersecurityawareness

14

3 Comments