Shishir Kumar Singh

Happy to be attending the Finance & Risk Cyber Security Summit 2024, where industry leaders converged to delve into the ever-evolving landscape of cyber threats. One resounding theme echoed throughout the discussions: the imperative need for a Security Everywhere mindset. The Panel discussion focusing on Supply Chain attacks was very informative and emphasized on the importance of radical transparency within the industry to collectively improve our defenses and strengthen one another. Various threat vectors, DDOS attacks, infiltration and attack lifecycle trends were discussed. And of course, can GenAI and it's aggressive growth in today's landscape be left behind? The benefits and risks of GenAI, and trusting the AI generated code were covered in detail. A day well spent!

10

"Continuous learning" One of the good courses on the DPDPA act, I attended several on this topic, but you made it very very well explained and to the point Gokul Narayan, thanks a lot #privacy #DPDPA #cio #CTO #CISO #cro #risk

59

7 Comments

The role of CISO is evolving at a phenomenal pace. The expectation from the senior leadership in quantifying and managing cyber risks has picked up pace. Many think tanks are predicting it to get bifurcated between CTSO and CISO depending upon the size and maturity of the organisation. With this backdrop in mind there is a new paradigm for CISO's approach. I had the privilege to moderate an esteemed panel Prabhat Pathak, Hussain AlKhalsan CISO and dearly missed Vishal Vijaykumar Bhawnani due to his ill health. Their thoughts and inputs from their rich experiences were very well received by the community of delegates present during the event. We discussed a few burning issues within the industry which I am sharing below for industry peers to reflect upon within their organization too. 1. The shift from qualitative to quantitative risk assessment methodologies: a) As a CISO, what are the primary advantages of adopting quantitative risk assessment methodologies over qualitative approaches? b)What challenges have you encountered when implementing quantitative risk assessment methodologies within your organization? c) How do you communicate the outcomes of quantitative risk assessments to senior management effectively? 2. Leveraging data analytics and machine learning for accurate risk quantification: a)How has the integration of data analytics and machine learning enhanced the accuracy and reliability of risk quantification in your organization? b)hat types of data sources and algorithms do you find most valuable for predictive risk modeling? c)What steps have you taken to ensure the security and integrity of data used in risk analytics and machine learning models? 3. Balancing risk mitigation efforts with business objectives and resource constraints: a)ow do you prioritize and allocate resources between risk mitigation efforts and other strategic business initiatives? b)What frameworks or methodologies do you use to assess the cost-effectiveness of risk mitigation strategies? c)How do you evaluate the residual risk that remains after implementing mitigation measures? 4. The role of risk quantification in regulatory compliance and reporting: a)How does risk quantification support compliance with regulatory requirements in your industry? b)How do you ensure that your risk quantification methods satisfy auditors and regulatory authorities? c)Can you describe a scenario where risk quantification played a crucial role in meeting regulatory compliance obligations? d)How do you keep abreast of evolving regulatory requirements and adjust your risk quantification strategies accordingly? #isaca #tahawultech #cybersecurity #dubai #uae #abudhabi

74

5 Comments

🔍 Enhancing Cybersecurity with Effective Cloud Log Management The NSA document highlights the crucial role of cloud logs in safeguarding cyber environments. Proper log management not only aids in threat detection but is also essential for compliance and efficient incident response. - Threat Detection 🚨: Utilize logs for early detection of security threats, enabling proactive defenses. - Incident Investigation 🔎: Logs provide critical data, helping trace the root cause of security breaches. - Regulatory Compliance 📜: Adhere to standards like HIPAA and GDPR through meticulous log management. Strategic Logging: - What to Log 📊: Prioritize logs that provide the most value and security relevance, considering resource constraints. - Log Sources 🌐: Include authentication actions, network events, and API calls to capture a comprehensive security landscape. - Management Tactics 🛠️: Employ strategies such as log filtering, aggregation, and retention to handle large data volumes efficiently. Implementation: - Utilize SIEM and SOAR Tools 🖥️: These tools are crucial for managing and analyzing log data effectively. - Secure Log Storage 🔐: Protect logs from unauthorized access and alterations, ensuring data integrity. Effective cloud log management is a cornerstone of robust cybersecurity frameworks, providing invaluable insights into network activities and potential threats. Organizations must invest in advanced log management solutions to bolster their security posture.

19

𝐔𝐧𝐝𝐞𝐫𝐬𝐭𝐚𝐧𝐝𝐢𝐧𝐠 𝐑𝐢𝐬𝐤: 𝐀 𝐃𝐢𝐚𝐥𝐨𝐠𝐮𝐞 𝐰𝐢𝐭𝐡 𝐭𝐡𝐞 𝐁𝐨𝐚𝐫𝐝 𝐨𝐧 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐓𝐡𝐫𝐞𝐚𝐭𝐬 🔐 As we navigate the complex landscape of cybersecurity, one of the critical conversations we must have is with our board of directors. Their role in overseeing risk management is pivotal, but there are often gaps in understanding that we need to address to ensure our organisation's security posture is robust. 𝐖𝐡𝐚𝐭 𝐭𝐡𝐞 𝐁𝐨𝐚𝐫𝐝 𝐔𝐧𝐝𝐞𝐫𝐬𝐭𝐚𝐧𝐝𝐬: • 𝐑𝐞𝐩𝐮𝐭𝐚𝐭𝐢𝐨𝐧 𝐑𝐢𝐬𝐤: Boards are acutely aware of the potential damage a security breach can cause to the organisation's reputation. They understand that trust is hard-earned and easily lost. • 𝐅𝐢𝐧𝐚𝐧𝐜𝐢𝐚𝐥 𝐈𝐦𝐩𝐚𝐜𝐭: The financial consequences of cyber incidents, including fines, litigation, and loss of business, are well understood. This drives the board’s interest in ensuring adequate cybersecurity budgets. • 𝐑𝐞𝐠𝐮𝐥𝐚𝐭𝐨𝐫𝐲 𝐂𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞: Board members recognise the importance of adhering to regulatory requirements and the risks associated with non-compliance. 𝐖𝐡𝐚𝐭 𝐭𝐡𝐞 𝐁𝐨𝐚𝐫𝐝 𝐎𝐟𝐭𝐞𝐧 𝐌𝐢𝐬𝐬𝐞𝐬: • 𝐓𝐞𝐜𝐡𝐧𝐢𝐜𝐚𝐥 𝐍𝐮𝐚𝐧𝐜𝐞𝐬: The complexity of cyber threats and the intricacies of defensive measures often escape the board’s grasp. They may not fully understand the technical depth required to counteract these threats. • 𝐄𝐯𝐨𝐥𝐯𝐢𝐧𝐠 𝐓𝐡𝐫𝐞𝐚𝐭 𝐋𝐚𝐧𝐝𝐬𝐜𝐚𝐩𝐞: Cyber threats evolve rapidly, and staying updated requires continuous learning. Boards may not always appreciate the dynamic nature of these threats and the need for ongoing investment in advanced defences. • 𝐏𝐫𝐨𝐚𝐜𝐭𝐢𝐯𝐞 𝐯𝐬. 𝐑𝐞𝐚𝐜𝐭𝐢𝐯𝐞 𝐌𝐞𝐚𝐬𝐮𝐫𝐞𝐬: There is sometimes a misconception that cybersecurity is about reacting to breaches rather than proactively preventing them. This can lead to underinvestment in proactive measures like threat intelligence and continuous monitoring. 𝐁𝐫𝐢𝐝𝐠𝐢𝐧𝐠 𝐭𝐡𝐞 𝐆𝐚𝐩 𝐰𝐢𝐭𝐡 𝐄𝐥𝐞𝐦𝐞𝐧𝐝𝐚𝐫: To foster a more comprehensive understanding, it’s essential to translate technical jargon into business impact. At Elemendar , we bridge this gap by offering products that make cybersecurity intelligence actionable and understandable for all stakeholders: • 𝐀𝐈-𝐃𝐫𝐢𝐯𝐞𝐧 𝐈𝐧𝐬𝐢𝐠𝐡𝐭𝐬: Our AI-driven solutions transform complex threat data into clear, actionable insights, helping board members understand the real impact of potential threats. • 𝐂𝐨𝐧𝐭𝐢𝐧𝐮𝐨𝐮𝐬 𝐋𝐞𝐚𝐫𝐧𝐢𝐧𝐠: We provide continuous updates on the evolving threat landscape, ensuring that the board stays informed about the latest trends and necessary defences. • 𝐏𝐫𝐨𝐚𝐜𝐭𝐢𝐯𝐞 𝐓𝐡𝐫𝐞𝐚𝐭 𝐌𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭: Elemendar’s products focus on proactive measures, integrating threat intelligence into everyday security practices. This helps in shifting the mindset from reactive to proactive, enhancing overall security posture. #CyberSecurity #RiskManagement #BoardOfDirectors #CyberThreats #Leadership #CISO

17

Technology, for all its powers, cannot make up for operational, cultural ⚕ , or managerial deficiencies. Therefore, members of an Information Systems team should avoid placing undue reliance on it. 💡 Lot of us have a question in mind, when we have a full functional Information Security and Privacy team and they have implemented tools from MFA 🔒 , VPN, Encryption to Web filtering , firewalls and anything and everything in the world 🌎 , as an employee why should I know about security and worry about the same 🤔 . Let me ask you this, if you have the most sophisticated digital lock installed at your door, but you have used your code as 1234 or your birthday or the first 4 letters of your phone number and thats something all your friends and family are aware of, because you have informed them about the same, does that mean you are Safe and Secure? Another example- If you have installed CCTV cameras at the entry and exit of your house, but the storage is full and the recordings are not getting stored, does that mean you are safe and secure? Good Security standards follow- 90/10 rule  🔒 10% of Security safeguards are technical 🔒 90% of Security safeguards rely on the user to adhere to the good practices. Technology alone cannot compensate for management, cultural or operational deficiencies hence we cannot rely on the same excessively. #Informationsecurity #Privacy #ISMS #Infosec #InfosecAwareness #90_10rule #Security_is_a_sharedresponsibility

12

While cybersecurity is increasingly becoming the focus of attention in most organisation’s security strategies, physical breaches also need to be prioritised as they can expose sensitive data, compromise critical assets, and even harm the people in your organisation. ISACA's insightful whitepaper on 'Physical Penetration Testing: The Most Overlooked Aspect of Security' sheds light on this essential yet often neglected facet of security. The paper delves into the concept of Physical Penetration Testing (PPT), a process that simulates real-world attacks to identify weaknesses in your physical security measures. This report delves into the methodologies used by security professionals, the various types of penetration testing available, and the tools employed to discover vulnerabilities. More importantly, the paper highlights the significant benefits of conducting these tests, empowering you to address physical security concerns and strengthen your organisation's overall security posture. To see why PPT should be a part of your organisation’s resilience strategy, read the ISACA whitepaper here: https://lnkd.in/da4M3UDR If you would like to discuss the next steps in conducting PPT, get in touch with us at info@optimalrisk.com and we will assist you in understanding your risks and formulating an appropriate action plan. #isaca #security #physicalpenetrationtesting #ppt #physicalsecurity #securityindustry #cybersecurity #breaches #securityconcerns #resilience #whitepaper #risks #threats #threatmonitoring #riskmanagement

29

1 Comment

When approaching cyber security in an #Operational #Technology (OT) or ICS environment these factors must be taken into account: - Understanding the applicable IEC 62443 standards - Identifying Target security level (SL-T), Capability security level (SL-C) and the Achieved security level (SL-A) - Aligning the strength of security measures with the risk exposure An IEC 62443-based approach to cyber security in an OT environment requires the integration of robust security measures at various Purdue levels. This ranges from improving the security of the hardware to ensuring secure configuration of software and networks. Several simple measures can be adopted to secure ICS systems and to harden them against potential exploitation by bad actors these include: - Periodic risk assessments based on IEC 62443 to identify and address gaps - Keeping systems patched/updated - Clearly assigning security-related responsibilities at all levels - Test and deploy an incident response strategy and tactics - Conduct Security Acceptance Testing for new devices - Request OEMs to share information on their security practices With a proven portfolio of solutions, threat intelligence, and managed services, Alliance Pro can help you elevate your IEC 62443 Achieved security level (SL-A) in a few easy steps.   #ICS #otsecurity #CYBERSECURITY #threatmanagement #risk #riskmanagement

20

COBIT 5 Domains: COBIT 5's architecture is organized into five primary domains. Evaluate, Direct, and Monitor (EDM): The foundation of the COBIT 5 framework lies within this domain. EDM focuses on ensuring that IT activities are not only in harmony with business goals but also guided by robust governance and management practices. This domain encompasses a spectrum of responsibilities, including setting the direction for IT endeavors, monitoring performance and progress, and ensuring compliance with relevant regulations and organizational policies. By establishing effective evaluation mechanisms, EDM empowers organizations to make informed decisions that drive value and mitigate risks. Align, Plan, and Organize (APO): Translating business aspirations into actionable IT initiatives forms the crux of the APO domain. It involves strategic planning, meticulous process definition, and the orchestration of IT resources to seamlessly support overarching business objectives. The APO domain lays emphasis on formulating a coherent IT strategy that seamlessly aligns with organizational goals, optimizing the allocation of resources for maximum efficiency, and ensuring that IT plans serve as enablers of strategic success. Build, Acquire, and Implement (BAI): The BAI domain pivots around the practical execution of IT initiatives. It encompasses the complete lifecycle of IT projects – from development to procurement and integration. This domain is a crucible for project management expertise, encompassing elements such as risk assessment, quality assurance, and meticulous execution. By adhering to BAI's principles, organizations can ensure the successful delivery of IT projects that are not only aligned with business requirements but also exhibit resilience against risks and uncertainties. Deliver, Service, and Support (DSS): Once IT solutions are implemented, the focus shifts to their ongoing operation and sustenance – which forms the heart of the DSS domain. DSS engulfs service delivery, incident management, and support processes aimed at ensuring that IT services remain steadfast in meeting user needs while adhering to stringent quality and performance standards. In essence, DSS perpetuates a reliable and seamless IT environment that is vital for sustained business operations. Monitor, Evaluate, and Assess (MEA): Continuous improvement is a cornerstone of successful IT governance, and this is where the MEA domain assumes its significance. It entails the perpetual monitoring of IT processes, meticulous evaluation of performance metrics, and the critical assessment of the effectiveness of IT governance and management practices. By embracing MEA, organizations can identify areas for enhancement, tap into data-driven insights, and consequently make informed decisions that foster growth and efficiency.

1

#CyberSecurity #PCIDSSv4 #Requirement11 #ContinuousLearning Requirement 11 of PCI DSS Version 4.0 focuses on regular security testing and monitoring to ensure that systems are protected against potential vulnerabilities and threats. Join Deepak's Continuous Learning sessions to gain expert insights and practical guidance on implementing and maintaining compliance with Requirement 11. Stay ahead in the ever-evolving landscape of cybersecurity! 🚀

7

1 Comment

Excited to speak at Digi-Dialogues on ‘Cybersecurity & Risk Management in Finance’ on 4th July, 3:30 PM. We’ll discuss the evolving roles of CTOs & CISOs, compliance, and balancing innovation with security. Join us! The Digital Fifth #Cybersecurity #RiskManagement #CTO #CISO #Technology

178

4 Comments