Praveen Singh

Implementing Defense in Depth is crucial for comprehensive cybersecurity. 🛡️ Key layers include: Physical Security: Protect hardware from unauthorized access. Network Security: Use firewalls and intrusion detection systems. Endpoint Security: Secure devices with antivirus and patch management. Application Security: Ensure software is free from vulnerabilities. Data Security: Encrypt sensitive information and use access controls. Password Complexity: Enforce strong password policies. Multi-Factor Authentication (MFA): Add an extra layer of security for logins. User Awareness: Train employees on security best practices. A multi-layered defense strategy significantly reduces risk. Stay secure! #CyberSecurity #DefenseInDepth #InfoSec

9

1 Comment

Dive into our latest #blog: 'NIST Cybersecurity Framework 2.0', authored by our Subject Matter Expert, Anamika Naikwadi Read more: https://lnkd.in/gr-hydhh #Cybersecurity #NetworkIntelligence #ArtificialIntelligence #SecurityThreats #Technology #NIST #CybersecurityFramework #RiskManagement K K Mookhey Arun K. Singh Karishma Mookhey Pratik Samant

12

Conditions for Collecting PII 📝  as per Privacy Information Management  System (#PIMS) Collecting PII involves obtaining data that can be used to identify an individual directly or indirectly. #ISO27701 outlines specific conditions that organizations must adhere to ensure lawful and ethical data collection. 1. Lawfulness and Fairness ⚖️ Organizations must ensure that the collection of PII is lawful and fair. This means: Complying with legal requirements: Collect PII only if there is a legal basis for doing so. Transparency: Inform data subjects about the purpose of data collection and how their information will be used. Consent: Obtain explicit consent from data subjects where necessary. 2. Purpose Limitation 🎯 PII should be collected for specified, explicit, and legitimate purposes. Organizations must: Define the purpose: Clearly state why the PII is being collected. Avoid reuse: Do not process PII in ways that are incompatible with the original purposes. 3. Data Minimization 📉 Only PII that is necessary for the specified purpose should be collected. This involves: Evaluating necessity: Regularly review the data being collected to ensure it is essential. Avoiding excess: Do not collect more data than is required for the intended purpose. 4. Accuracy ✅ Organizations must take reasonable steps to ensure that PII is accurate and up to date. This includes: Verification: Implement procedures to verify the accuracy of the data. Correction: Provide mechanisms for data subjects to correct their information.   #isms #pii

4

Peter Theobald, thanks for starting this thread Security automation is a profoundly intricate topic, so much so that I could write a book. (Pun intended) ;) However, the following are a few key considerations. -   As I've mentioned, the predictability of the task's outcome and, more importantly, the reliability of that prediction is crucial in the realm of security automation. -   How many times does the task get executed? It is probably not a good idea to spend 50 person-hours automating something that I need to do three times a year and takes 5 hours each time. -   Another important consideration is to do a what-if analysis of "how bad things can get" if automation fails or, worse, is manipulated by a threat actor or disgruntled employee. I remember once when my endpoint update playbook worked perfectly in a test lab and then in production, but it messed up when an application was upgraded. While automation is great, it's important to remember that it’s not a panacea. Effective automation requires meticulous planning, skill, and effort.

6

1 Comment

Indian Healthcare Sector Faces 6,953 Cyberattacks Weekly, Outpacing Global Rates: Check Point Threat intelligence report Read more: https://lnkd.in/grh_Y5nb #IndiaTechnologyNews #CyberSecurity #HealthcareSecurity #IndianHealthcare #CyberAttacks #ThreatIntelligence #CheckPointReport #DataProtection #HealthIT #Infosec #CyberThreats

1

🚨 **Cyber Security Alert in India** 🚨 A recent report by Sophos reveals alarming stats: 🔐 **64% of firms in India have faced ransomware attacks** 💸 **65% of those firms chose to pay the ransom** to recover their data 💰 **Average recovery cost**: $1.35 million It's crucial for businesses to strengthen their cyber defenses and adopt robust security measures. #CyberSecurity #Ransomware #India #DataProtection #hipaa #compliance Tarun M. Source https://lnkd.in/gCWcefN2

25

1 Comment

*Real world cyber security challenges for security managers and CISOs: rarely discussed and acknowledged* These factors play pivotal role in organisation security posture irrespective of you are certified/regulated/audited organisation or not. Please feel free to add your view. 1)Unclear expectations from the business and the management. 2)No proper reporting structure of CISO function, involving dotted line reporting to more than one vertical. 3)CISO is not given enough designational power or autonomy to get the things done. 4)Considering CISO function as support/operational function. 5)Unrealistic expectations and ownership from CISO functions. 6)Reluctant/ Resistance to change approach. 7)No proper resource strength to carry out in-scope activities or not sufficiently budgeted team and not able to provide flexibility to retain the talent. #ciso #cybersecurity #organisationalsecurity #cybersecuritychallenges Image credit:unknown

28

1 Comment

Understanding Risk Assessment in Information Security Risk assessment plays a pivotal role in any robust information security strategy. Here's why it's crucial: - Identifies Vulnerabilities: Uncovers potential weaknesses in systems and processes. - Evaluates Threats: Analyzes potential threats that could exploit vulnerabilities. - Prioritizes Risks: Ranks risks based on their potential impact and likelihood. - Informs Decision-Making: Provides data to make informed security decisions. - Supports Compliance: Ensures alignment with regulatory requirements. - Mitigation Planning: Helps in developing effective strategies to mitigate identified risks. - Continuous Monitoring: Encourages ongoing review and adaptation to new threats. By conducting thorough risk assessments, organizations can better protect their assets and ensure a proactive stance against emerging threats. #InfoSec #CyberSecurity #RiskAssessment #DataProtection

1

Cyber-ready organizations proactively strategize during periods of calm rather than wait for a hair-on-fire crisis. By addressing the hard questions and delving deep into #preparedness strategies, they create a fit-for-purpose #incidentresponse plan. A robust and well-practiced plan provides order and structure so organizations can be ready with the right team and flows to stop attacks. https://lnkd.in/eZekGDv4 Learn more in Adam Finkelstein's video for Sygnia.

22

Decoding Shell Vulnerability #CyberSecurity #VulnerabilityAssessment #InfoSec #CyberDefense #RiskManagement #SecurityTesting #ITSecurity #CyberAwareness #TechSecurity #InfoSec #Handbook #StaySecure #WebSecurity #Vulnerabilities #TechInsights #InfoSec #DigitalProtection #StaySafeOnline #ITSecurity #RiskMitigation #DataPrivacy #CyberThreats #nmap #networking #vapt #networkpentesting

48

1 Comment

#CyberSecurity #PCIDSSv4 #Requirement11 #ContinuousLearning Requirement 11 of PCI DSS Version 4.0 focuses on regular security testing and monitoring to ensure that systems are protected against potential vulnerabilities and threats. Join Deepak's Continuous Learning sessions to gain expert insights and practical guidance on implementing and maintaining compliance with Requirement 11. Stay ahead in the ever-evolving landscape of cybersecurity! 🚀

7

1 Comment

Scenario-based Interview Prep Series for SOC Analysts : Join our #freemasterclass on 15 July with Sanyam Negi! Learn proven strategies and nail scenario-based questions on Phishing Email Response, Threat Intelligence, DDoS Attacks, and more. Don’t miss out on enhancing your problem-solving skills and gaining valuable interview tips! 𝑹𝒆𝒔𝒆𝒓𝒗𝒆 𝒚𝒐𝒖𝒓 𝒔𝒑𝒐𝒕 𝒏𝒐𝒘: https://lnkd.in/g4pDKdDU #SOCInterviewPrep #CyberSecurity #InfosecTrainin #PhishingResponse #ThreatIntelligence #DDoSAttacks #soc #freeevent #infosec #infosectrain #learntorise 

31

FDPPI Courses under "Mission DPDPA".. Quick Decisions to bring better rewards As a part of MISSION-DPDPA , FDPPI has introduced the "Subscription based" Self paced study program for all its online programs. For those who register and complete the program within 2 months, there is a substantial rebate in pricing of the courses compared to the current levels. For example the C.DPO.DA program can be completed now with just an outlay of Rs 15000/- (GST Extra) with a participation certificate. For those who want to complete the exam, and be certified as C.DPO.DA., the examination fee would be Rs 10000/- more. (GST Extra). (Total cost Rs 25000/-) As a further incentive to those who are fast to take a decision, it is decided that each month 5 participants who register before the end of the previous month, would get a discount of 30% on the course subscription which means that the net price of the course for the first five persons would be only Rs 10500/- (GST Extra). Those who want to claim the discount for the June 2024 batch may use the Coupon code: FDPPIMay2024 and register before May 31, 2024 FDPPI and its training partners Cyber Law College and iLet Solutions are together contributing to the "Mission DPDPA" by allowing rebates. It is open now to the community how they respond and contribute to the mission. We may remind that once the rules are notified, all the registrants prior to the release of the rules would be provided a free online update of the rules. Hence taking a decision now would be the wisest thing rather than procrastinating. Full details are available on FDPPI.in or naavi.org. Quick registration link: : https://lnkd.in/g9nnZaSc More details at www.fdppi.in

24

Tenable — the #ExposureManagement company, has disclosed that its #CloudSecurity Research Team has recently discovered that #Kinsing #malware, known for targeting Linux-based cloud infrastructures, is exploiting Apache Tomcat servers with new advanced stealth techniques. “Cloud #cryptomining has become an emerging trend in recent years, powered by the scalability and flexibility of cloud platforms,” said Ari Eitan, Manager – Research, Tenable. “Unlike traditional on-premises infrastructure, cloud infrastructure allows attackers to quickly deploy resources for cryptomining, making it easier to exploit. In this case, we’ve detected multiple Kinsing infected servers within a singular environment, including an #ApacheTomcat server with critical vulnerabilities.” . Read in detail at: https://lnkd.in/gVDqGKrT . Eric Colón Prabhat Mundari Satnam Narang Heera Meghwal Patrick Ramseier Leanne Johnson Dan Hewitt Ross Walker Matan Hart . Follow us at SmartStateIndia . #smartstateindia #cybersecuritystrategy #tenableindia #aisecurity #cybersecurity #kinsingmalware #cloudsecurity

4

#CyberWhisper #CyberSecurity #Crimeware - Crimeware is distinct from adware or spyware and it's created for identity theft operations that use social engineering schemes to gain access to a user's online accounts. Crimeware is a growing issue for networks' security, as numerous types of malware look to steal valuable data from the systems. 

17

#ISO27001 study snippets. Steps in defining an Information Security Management System (ISMS) 1. Assess Business Needs and Identify Issues: Start by evaluating your business needs and identifying both internal and external issues. Internal issues include organizational structure and internal policies, while external issues are legal and regulatory requirements, political and economic environments, and technological trends. 2. Determine the Scope of Your ISMS: Clearly define the scope of your ISMS implementation. Consider factors such as organizational entities, locations, business units, departments, and the products or services offered. Identify all areas where information is or will be stored and how it is accessed by users. Explicitly outline what is out of scope, such as outsourced services and third-party products. A well-defined scope ensures comprehensive coverage of all critical areas within your organization. 3. Set a High-Level Timeframe: Develop a realistic timeframe for implementing your ISMS. Account for dependencies and constraints, including commitment from management and employees, budget considerations, availability of necessary tools, current compliance gaps, and geographical factors. A clear timeline will help in maintaining focus and momentum throughout the implementation process. These steps are not one-rule-fit-all but they can be modified depending on an organization's need and nature. The common goal is to develop an ISMS that ensures information assets are well-protected. #informationsecurity #infosec #datasecurity #iso27001 #cybersecuritygrc #studysnippets

5

#Day13/100Days Challenge. Data Loss Prevention (DLP): This is a strategic security measure that ensures sensitive or critical information is secured. It enables organisations to detect and prevent data breaches, data theft, and data loss. The Types of DLP includes: 1. Network DLP: 2. Endpoint DLP 3. Cloud DLP 1. Network DLP: This monitors and protects data that is in transit on networks managed by organisations. It also detects and potentially blocks sensitive data corruption while the data is in motion across the network using various protocols. 2. Endpoint DLP: This is used or deployed as an agent to monitor data created or stored on systems. It is the process of securing data stored on laptops, desktops, smartphones and other devices and preventing it from being accidentally or maliciously leaked, lost, misused or destroyed. 3. Cloud DLP: This connects directly with sanctioned cloud application through APIs to monitor data when it being accessed, shared, or stored. #Learning #Cybersecurity Webfala Digital Skills for all Initiative Shadrack Omileke Toluwani Babatunde

4