Month: October 2021

Cybersecurity For The Hospitality Industry

Posted on by admin

The hospitality industry has been under the continual target of cybercriminals. The compromised reservation system of The Marriott Hotel chain owing to internal security opened gates for threat actors back in 2018. The root cause and the attack point were found to be the systems of an acquired company, Starwood hotels whose computer systems were still not migrated to that of Marriotts due to many internal reasons. An easy spot to attack and that is exactly what happened.

A cyber-attack like this can pose major losses to the organization like loss of revenue due to lawsuits, penalties, and customers being compensated. Not to mention the indirect costs of customers leaving the company and loss of goodwill, decline in brand value, dropping share values, huge financial ramifications.

So what does it take to realize the importance of cyber security, to be aware of the kinds of attacks and prevent this kind of a massive cyber-attack in a highly vulnerable industry like hospitality? Let us read through to find out:

Significance of Cybersecurity in hospitality :

It is critical to realize the importance of cyber security in an industry like hospitality as the vulnerabilities are high. Below are a  few reasons why it is high time to give Cyber security the highlight it deserves:

  • 1. Increasing awareness on cyber security with increasing cyber-attacks in the industry:  With several attacks around the world like the Marriott Hotel case being in news constantly, cyber security in hotels has achieved a new spot in the limelight. The examination of the internal security of the hospitality industry in the eyes of the consumers, legal system, and regulating bodies has been extreme. Several terms like exclusive IT and security programs, annual data security audit, post-incident examination have become common after 2015 when the industry faced several data threats and breaches. Apart from this, the consumers of this industry have been given an adequate amount of counseling on the amount of caution to be practiced during traveling.
  • With this kind of situation, it can be said that mere compliance is barely sufficient anymore and a well-planned cyber risk management strategy has become a prerequisite. Thus, if you have been thinking of upscaling your Cyber risk management and giving it a bit more importance than it deserves, this is the right moment.
  • 2. Conserving brand health and consumer trust:  It can be said that goodwill, trust of customers and patrons are part of crucial resources for the hospitality industry. In hospitality, trust and confidence are brand health, and not safeguarding it is a sure-shot way for downfall. Due to changes in the nature and value of data, the security or privacy breach may not be immediately apparent or its effects felt explicit. Most often, the harm is hidden until it is too late. This leads to legal risks and regulatory risks in addition to affecting brand health and loss on patrons.
     
  • 3. Significant Regulatory complications:  In the event of a cyber-attack in the hospitality industry, multiple class-action lawsuits are filed immediately as the attack is not just on the internal system of the hotel but a huge amount of personal data of the customers is compromised. Penalties under many acts are incurred including under GDPR. It cannot be stressed enough that legal and regulatory problems bring their own complications and issues. The penalties are bound to be heavy. Several countries in the world have passed legal Acts like GDPR, PIPEDA, etc. for the protection of data and privacy.
     
  • 4. Gaining a perception towards data security and privacy:  Data security and data privacy goes a long way from just data risk management and compliance. It can be said that data security and privacy come with a whole new world of possibilities that could aid in the business objectives of the hotel. Factors like personalized services, economic interests can be strategized and developed into well-defined business goals. Such planning must be done with the joint consent of the top management and the internal compliance authorities of the hotel. Data security and privacy must be viewed as a major aspect of the management of the hotel so as to gain different perspectives and put to optimum usage.

Types of Attacks and top ways to prevent i t:

1. Phishing attacks:

The challenge:  Phishing is one of the oldest types of cyber-attack, but still the most used technique. Phishing attacks can enable the aimed victim to do the activity desired by the attacker, from sharing information to authorizing transactions. The term phishing means sending or receiving spoofed emails which aim at tricking the victim and enabling them to reveal sensitive information. In most cases, this sensitive information is passwords or financial information and in the hospitality industry, it is aimed at the most authoritative personnel.

Solution:  Phishing has been prevalent for many years now. Although several comprehensive security awareness training programmes have been developed across industries, the training regime for the hospitality industry requires exclusive methodology. Instead of opting for only audio-video training material, going a step ahead and providing real life scenario training proves to be more effective. To give a glimpse of how it is to be on the scene of an attack or at the receiving end of an attack helps.

2. Ransomware Attacks

The challenge:  Research suggests that the hospitality industry has incurred huge losses due to Ransomware attacks like “WannaCry”, with each hotel losing close to  $17,000. The intention behind a ransomware attack is usually to gain financial profit in return for letting the victim have a ransomware-free system.

Solution:  When it comes to Ransomware attacks, safe surfing is the key. And when it comes to safe surfing, it is to be taken seriously by all parties in focus from the internal staff to the travelers. Mere training does not help as ransomware requires constant practice of caution, hence adequate awareness must be constantly present in the hotel property. Steps like checking the security of the websites visited before providing credentials, pop-up disabling, verifying the security of the applications downloaded in personal devices must be practiced.

3.DDoS

The challenge:  DDoS refers to Distributed Denial of Service attack. DDoS is a prevalent form of attack used across the world in the hospitality industry. It aims at attacking the various internal systems used by a hotel. It is not restricted to just the computer systems or databases present in the property, but any internal system from the automated sprinkler system or cleaning system to the security cameras in the surveillance system. DDoS can gain access to the complete system in the hotel through these access points and crash down the whole system.

Solution:  An intrusion detection system is an immediate solution to block access. An intrusion detection system does a dynamic analysis of all probabilities towards attacks, suspicious activities, and breaches in the internal systems by identifying existing system errors, availability, and confidentiality of data.

4. PoS Attacks

The challenge:  PoS refers to a Point-of-Sales attack. This type of attack poses the highest intensity of threat to the hospitality industry as it attacks the vendor in case, instead of attacking the hotel alone. This majorly occurs due to human error or unidentified weak spots in the systems. Media exposure becomes unavoidable in such attacks as it involves a probable financial loss for customers.

Solution:  Physical security of systems must be taken seriously. All the equipment in the hotel property must be kept updated and networks must be secured with high-level restriction in access. Staff must practice hygienic cyber behaviour. This must reflect in day-to-day routine activities like password sharing, maintaining an orderly work-desk, filing and securing sensitive documents in safe systems, handling customer identification documents.

5. Dark Hotel hacking method

The challenge:  This type of attack was first reported in 2007. Here the attacker targets the networks which can provide access to guest information, like a Wi-Fi network. The hotel server is first hacked with a code that provokes the guest network to download software.

Solution:  Investing in high-quality cyber security software and firewall can prove effective in battling Dark Hotel attacks. A firewall system tracks all hardware and software devices, the traffic levels and identifies malware and viruses.

6. Data and identity theft:

The challenge:  One of the biggest challenges against data theft is protecting customer information. Stealing and spoofing of identity like credit card information, financial information is a prevalent form of cyber-attack.

Solution:  Installing a Biometric system and restricting access. Biometric systems focus on authorization and processes data by storing specific data at the time of usage. Biometric systems use tools like fingerprint recognition, voice recognition, face and retina recognition for identification. This ensures access limitation and protection of the entire system.

Strengthening information security towards cyber resilience

One needs to build a rigid cybersecurity posture on two fronts while combating cybersecurity in the hospitality domain

  • 1. Inherent risks and security risks
  • 2. Financial and Legal risks

Inherent risks and security risks

  1. Attain all the necessary baseline requirements:  Being your best with the basics is always the key. These include implementing security controls for data and services, secure internet and network connections, anti-virus, and malware tools.
  2. Preparedness:  Data breach attempts are inevitable. Too many critical factors and digital entry points and security awareness is too little. We need an adequate incident response. Regular systems audits and checks can help in timely action and corrections in the defenses.
  3. Awareness:  Cyber threatscape is ever-evolving. Hence, we need to be updated on the latest incidents, malware, and a thorough cyber awareness session is to be conducted for all employees. Cyber security is not just the responsibility of the IT department but of every employee dealing with data and information.

Financial and legal risks

  1. Advisory services:  A strong legal department or consultant also helps in gaining knowledge of the legislation in place and improving employees’ awareness.
  2. Insurance:  Insuring against revenue loss and for compensation to be paid can help companies deal with the financial ramifications of successful attacks.

Cyber resilience will ensure the good health of the company. There may come a time in the near future when customers and patrons check the cyber security policy of a company and then choose to be associated with it. Research suggests that cyber security should be made mandatory as a regulation.

Cyber Resilience For The Petrochemical Industry

Posted on by admin

We at QRC, are pioneers in Cyber risk and cyber security governance  vary from industry to industry. It is unique in its way and so is how each organization handles the risks they are exposed to. This is one of the main reasons why there is a need to execute cyber security with deep analysis. The nature of cyber security in the Petrochemical industry is extensive in nature, starting from the core source of supply from the oil pipelines through the refineries to the point of sales at gas stations. The kind of risks faced throughout this process are high-level risks that can cause the functioning of the company to collapse completely. It is also referred to as “Enterprise risk”. So how to achieve the objective of cyber resilience in such a situation…?

Read through to gain a comprehensive insight into the risks faced by the Petrochemical industry, sources of cyber threats, current industry-specific guidelines prescribed for cyber security, and best practices to achieve better cyber resilience.

Current challenges faced by the industry

A quick look into previous incidents of the data breach: a few events reported in the past:

  • 1.  May 2021, USA: It is known as the hack that took down Colonial pipeline company, the largest fuel pipeline of the US, leading to a shortage across the East coast due to a single compromised password. A ransom note demanding cryptocurrency appeared on computer screens and was spotted by employees.
  • 2.  July 2020, USA: The National security agency and the Cybersecurity and infrastructure security agency of the US alerted the world about cybercriminals hacking into critical infrastructure across the country.
  • 3.  Feb 2020, USA: A pipeline company was attacked. HMI was affected resulting in the forced shutdown of a gas-compression facility station and other upstream-downstream facilities, for two full days.
  • 4.  2017, the Middle East: The notorious Triton virus attacked the controls and security of a petrochemical company resulting in multiple shutdowns and halted operations over several months. The Triton still affects a lot of systems.
  • 5.  2019, Mexico: Pemix, Mexico’s state-owned oil company was attacked by ransomware resulting in the forced shutdown of systems across the country. The perpetrators demanded a ransom of a Bitcoin worth five million to unencrypt the systems.
  • 6.  2017, Ukraine: The Not Petya attack on a Ukrainian facility resulted in the shutdown of the country’s power grid.
  • 7.  201
  • 0, Iran: Stuxnet is used in damaging an Iranian nuclear facility. Responsibilities have risen for the energy sector’s top executives and Board members to navigate the big challenge of cyber security.

Analysis of various factors creating vulnerabilities:

Surface attacks due to the nature of systems:  Attackers take advantage of any openings that are available to them. The systems in the Petrochemical industry are such that it requires increased availability of data for better efficiency of operations and for gaining from situational awareness. This, in turn, increases the surface area of attacks and potential exposure to vulnerabilities. So, systems are available to them and attackers are opportunistic.

Attacks due to technological advancements:  The large and ever-increasing numbers of mobile phones, tablets, and all the other devices with access to operational systems for input, payments in the gas stations, and other ease of operations at various stages of production. These are all possible entry points for attackers. Other technological advancements like the Internet-of-things, metering infrastructure will keep on arriving on the scene and creating vulnerabilities for newer cybercrime. Technological advancements also mean cybercrime advancements.

Attacks due to human error in operations:  IBM research suggests that 27% of cyber-attacks in the industry are a result of human error. Thus, when it comes to tactics against data and privacy breaches, it must include employee and staff training, clear well-established practices and policies, and fixing employee roles & responsibilities. Owners should establish cyber-security roles and these employees/individuals must develop and educate other employees on policies and procedures.

Cyber-security and safety policies must integrate human elements with the control system especially in system usage, maintenance, updates, etc. The policies must also address personal devices since misconfigured devices are vulnerabilities and easy targets.

Attacks due to ease of access:  When it comes to the Oil and Natural gas industry, the physical aspect plays a major role. Networks must be segregated from the area of active operations and access has to be separate. For example, it is best practice to keep IT, operations, and security separate from the rest of the production unit. Access to the whole system should not be made available to all and sundry at a time. Even if the area of production is infiltrated or compromised, the whole system should not be exposed. Another common trap for operators is that of forgotten control systems which are at risk of attacks.

Attacks due to the nature of authority in the industry:  Despite increasing and diverse risks in the Petrochemical industry, awareness, and stakes, the majority of the management and executives still believe that they are not directly responsible for security. It is mistakenly believed that cyber safety is the responsibility of a separate department, they see it as an aspect that is separate from the main functions. Or that the threats are unavoidable due to the nature of the industry. There can also be a belief that it is not possible to counter the diverse threats, that there is not enough expertise, tools, or charters to counteract the attacks. This can lead to complacency among non-IT stakeholders, making the job of the IT team more difficult and also creating blind spots which can be exploited. Cyber-security must be regarded as a shared responsibility of all stakeholders, especially all employees in a company, from top-level executives to front-desks.

Existing guidelines and standards for cyber security:

The industry’s standard-setting bodies are- Department of Commerce’s National institute of standards and technology (NIST), the Department of Energy (DOE), and other U.S. and international standards-setting bodies. Programs such as the ISA/IEC 62443 Series of Standards on IACS Security and the DOE Cybersecurity Capability Maturity Model (C2M2) in association with the above-mentioned bodies help organizations in implementing the standards. Some of the standards are –

  • 1. ISO 270001
  • 2. API 1164
  • 3. API Standard 1164
  • 4. Department Of Energy Cybersecurity Capability Maturity Model
  • 5. International Electrotechnical Commission’s IEC 62443
  • 6. International Organization For Standardization ISO 27000
  • 7. Content unique to pipelines not covered by NIST CSF and IEC 62443 is being currently updated.

Strengthening cyber security:

  1. Segmentation of control systems architecture:  Compartmentalizing lessens the access and prevents baring the whole system to attackers. Keeping critical infrastructure and business systems on different networks is essential for minimizing risk. Additional segmentation can also be considered to protect critical assets. The key concern here is not allowing access to the whole system when one area is attacked or compromised.
  2. Continuous evaluation and enhancement:  Policies, procedures, and control systems have to be consistently and continuously evaluated and improved. Training must also be evaluated and enhanced regularly. Constant vigilance is a key to protecting against internal and employee errors. It is easier for timely detection and correction.
  3. Professional analysis of systems and their impacts:    The following factors have to be considered, namely
    1. Cost,
    2. Value,
    3. The company’s policy framework towards cyber-threat i.e is it a policy of transfer of risks or a policy of mitigation or a policy of acceptance,
    4. Investment areas,
    5. Funds allocation,
    6. Technological infrastructure and
    7. Expertise is available.

Read more about this: Cybersecurity Compliance and e-Rupee: Need for Strong Measures

The analysis must be made not only in the initial stage but companies must keep routinely analyzing, keep adapting, and building on technological advancement and complexity.

  1. Computer control systems and computer security are not tangential:  Control systems and security systems must always be considered in tandem. Consider cyber-system controls and cybersecurity in tandem. Cyber-security and cyber-resilience are best achieved when implemented across the entire system design and planning process.
  2. Control systems are considered as assets:  Systems are just as important as other tangible or intangible assets like pumps, pipelines, equipment, brand, etc. that require routine maintenance, replacement, improvements, and audit/evaluation.
  3. Being part of guilds/groups:  As of now, there is the Oil and Natural gas Information Sharing and Analysis Centre. It is an industry group of private intelligence sharing regarding cyber-threats.
  1. Awareness:  Staying alert and aware cannot be emphasized enough. There are many resources available like the website of the US Department of homeland security which actively publishes about various vulnerabilities. Owners must stay ahead and address the emerging and diverse concerns before cyber-criminals take advantage of them.
  2. Following standards:  The generally accepted practices and frameworks have to be implemented and followed meticulously. Some of them are ISA 62443, NIST 800-82, and the cyber security framework of the American Petroleum Institute.
  1. Compartmentalize and segment control system network architecture:  This lessens access and keeps business systems on a different network than critical infrastructure. Consider additional segmentation to protect critical assets and prevent hackers from accessing the whole system if they find a way into one area.

Overview of the cyber resilience principles by WEF :

Cyber resilience principles for the oil and gas infrastructure companies, as outlined by The World economic forum are as follows:

  1. Cyber resilience governance –  policies and systems must be planned and implemented beginning at the governance level, since security counts on organization-wide participation from the management to the grassroots level. Aligning all the efforts and fixing accountability is fundamental to the success of the system.
  2. Resilience by design –  Cyber-security need not be a separate department to be individually planned and implemented. It can be included as a design parameter and as part of the corporate culture. It will significantly improve the outcomes and effectiveness of the security system.
  3. Corporate responsibility for resilience –  Recognizing and accepting that diverse, frequent, and ever-advancing threats cannot be prevented and that they will continue to occur or at times escalate to a huge threat is helpful, since it enables companies to be proactive and take responsibility and initiative. It is the first step in managing risks.
  4. Holistic risk management approach –  as is the case of any risk management, cyber resilience and management require a mandate, funds, resources, and accountability. In this sector, it is important to mitigate risks to all parts of the value chain so that one weak link doesn’t bring production to a halt.
  5. Ecosystem-wide collaboration –  Weak points in defense security may lie outside an organization too. Efforts to share cyber threat information, use of best practices, and improve cybersecurity maturity across the whole sector help industry-wide stability.

Ecosystem-wide cyber resilience plans –  As mentioned earlier, recognizing that cyber-attacks will continue to occur, organizations should build resilience plans to help mitigate damage from those organizations that have succeeded. Regular cybersecurity exercises enable them to test and improve defenses – including how they will cooperate with other industry partners.

Automotive Cybersecurity : Driving Risk Management

Posted on by admin

There is almost no aspect in today’s developed world that does not have technological interference in its design. Dependence on technology is such that it is required in every aspect of our lives and automobiles are no exception. The Automobile industry is one of the first industries which brought software aspects into its design to provide state-of-the-art facilities to people. From being just a mode of transportation from one place to another, they have taken the experience of traveling to another level with the help of technological advancements. But along with the advantages of technologically savvy features comes the risks too. The need for cyber security compliance is high here as the risk associated with each and every code installed into these automobiles is also high.

When it comes to cyber risk in automobiles, it might seem like it is associated with just the vehicle but the actual threat is to the user. This kind of threat is more when the automotive vehicle is an autonomous or connected car.

So how serious are these threats, how important is cyber security for the automobile industry, and what are the quick fixes and long-term solutions to the cyber risk present in evolving automobile technology? Read through to find out…

Role of Cyber security in the automotive industry

As already mentioned, major advancements in the automobile industry have been contributions from the field of technology. According to recent research, the E/E component market in the automobile industry is expected to grow USD 469 billion in the next 10 years. This simply means that the cyber risks associated with this industry are also expected to grow. Let us consider the possible kinds of cyber threats that can arise from these advancements:

  • 1.  Risks associated with connected cars: Tools like Bluetooth and Wi-Fi are major contributors to communication devices and automobiles have adapted to equipping these features. Hackers are on the constant lookout for cloud networks when to gain access to the chain of vehicles connected to cloud networks through these tools. There are various technologies like vehicle to vehicle, vehicle to cloud, etc. for enabling this threat.
  • 2.  Risk associated with autonomous vehicles: Autonomous vehicles need sensors within for functioning and they are dependent on data networks present around them like GPS. Any attack potentially can harm their functioning and lead to accidents. Although these seem straight out of fiction, without proper cyber security they will not be safe to function.
  • 3.  Risks associated with electric vehicles: Electric vehicles need charging stations for consistent functioning. Any cyber-attacks on the charging stations or infrastructure can collapse the vehicle and lead to a power accident. This is a major concern when the cyber security of the vehicle is considered.

Types of Cyber-attacks on vehicles

Now that we are aware of what kinds of vulnerabilities exist in these automobiles, let us know further about how these vulnerabilities are used by hackers to attack:

1.  Direct physical attacks. This type of attack is not possible without physical access to a vehicle. Also, the usage of physical devices like ports or connectors is required for this kind of attack. With the help of such devices, hardware is installed during the repair or renewal process of the vehicle and later the vehicle is controlled by the hacker when the normal usage process is resumed.

2.  Indirect vulnerabilities in a physical attack: This is also a type of physical attack where a device with infected malware is installed into the physical vehicle. An example of this type of attack would be attacked using SD cards, USB devices, or music players.

3.  Threats in a wireless attack: It involves all types of attacks that involve Bluetooth, Wi-Fi, GPS or cellular mechanisms, etc. For this type of attack, no physical access is required.

4.  Attacks using sensor fooling methods: There are ways in which sensors can be taken advantage of. Although these kinds of attacks are not very prevalent, the days are not far from where we will be dealing with these attacks if proper cyber security measures are not taken.

Below are the few types of attacks widely prevalent and used by hackers:

DOS- A DOS attack can be used to harm the user of the vehicle. It does not give any external access to the hacker but it makes the internal system of the automotive system fail. Although a hacker cannot intrude into the data or the cloud if the intention of the hacker is to harm the user, a DOS attack surely solves the purpose by making the vehicle collapse through methods like disabling the brake system.

MitM attacks-If the hacker wants to steal data from the server or intrude between the automotive and its server, the MitM attack serves the purpose. Through this type of attack, the hacker can gain access to the server.

Command injection data corruption-This type of attack is very hazardous as it uses software coding as a tool to gain access into the data stored and corrupt it.

Common steps for better cyber security in automobiles

Although cybersecurity measures must be followed all throughout the life cycle of an automotive component, below are few measures that can be followed to aid in better management of risks:

  • 1.  OTA refers to Over-The-Air update. Caution must be kept with interfaces such as OTA, OBD, Ethernet, and Bluetooth, basically all outside the world.
  • 2.  Secure all gateways related to safety and must be kept isolated or separate.
  • 3.  HSM refers to Hardware Security Module. It plays a significant role in delivering security services and is a major step in cyber security measures other than software-related measures.
  • 4.  The requirements prescribed in ISO 21434 must be followed throughout the supply-chain by all the parties across.
  • 5.  Cyber security framework must be followed while developing protocol stacks like  UDS,  SOME/IP,  Flex Ray,  DoIP. These must-have firewalls as an in-built function.
  • 6.  The ECU entry points must be deleted including all the services completely as it is a vulnerability when considered for hackers.

ISO SAE/DIS 21434
The ISO/SAE DIS 21434 is a standard jointly published by the ISO and SAE with the objective of providing a framework to organizations. The ISO 21434 is the standard when it comes to compliance for automotive cybersecurity. The ISO 21434 is for automotive cyber security as to how the ISO 26262 is for functional safety for road vehicles.

Let us get to know this standard concisely:

Cybersecurity Management:  As the name suggests, this deals with the management of cyber security. It defines the aim, scope, objectives of setting the tone for cyber security through various strategies, etc.

Risk Management methods:  Risk assessment is the first step in the risk management framework. Various methods to assess existing risks are explained and an analysis is conducted on existing vulnerabilities.

Concept Phase:  This is the time when goals are redefined according to the extent of various automotive components exposed to risk. This aids in reducing the risks.

Product Development:  This stage refers to hardware, software, and system development and the cyber security framework exclusively to be followed at this stage.

Supporting Processes:  The CLAL is introduced into the activities at this stage. CLAL stands for Cybersecurity Assurance Level. CLAL in the ISO 21434 is the same as ASIL is for the ISO 26262. It is a measure which states how aggressive cybersecurity must be for a particular component.

Compliance process explained

The process of obtaining compliance for ISO 21434 consists of three steps, which are :-

  1. Assessment:  The first step in the compliance process is risk assessment. The status and scope of risk are evaluated and a guideline is provided in a framework to be followed as a format. Before prescribing the guidelines, the compatibility to the evaluated result is thoroughly analyzed.
  2. Implementation:  After assessment comes to the implementation stage. This process includes defining the processes and procedures and roles of all the people involved in the implementation of the framework. This implementation is done keeping the ISO 21434 and its requirements in focus.
  3. Operations:  The final step towards compliance is operations, which is a continuous process. It includes controlling, assessing which would lead finally to the launch of the CSMS.

A Go To Guide For Cybersecurity Technique

Posted on by admin

The dependency on data is increasing as businesses and technologies evolve and so is the threat to breach of data. The arguments on technology and software advancements have been like two sides of a coin for decades now, as the risk is proportional with the benefits.

Recent researches state that if there were to be a loss to the global economy due to cyber-attacks, it would be no less than US$6 trillion. It is always wise to prevent such a loss than bear it.

Cyber security can be managed with cyber security techniques which  can be classified into various sections and domains. Coordination between all these techniques can lead to a successful Cyber security practice within an organisation. Read through to get an idea about five of the widely used cyber security practices.

1. Critical infrastructure security:

Modern societies are highly dependent on infrastructure which is critical for its functioning. Any society needs to have these infrastructures functional and operational with complete security at all times. With the increasing dependency on software, the critical infrastructure too has become operational with software. Security and resilience of these critical infrastructures are highly important as it protects the well-being of the society.

It is not just the business organizations that directly perform these critical functions, but also numerous organizations which support the functioning of critical functions. Such organizations must ensure a contingency plan is set up for risk management.

Sectors of critical infrastructure security:

Below are some of the sectors of critical infrastructure security.

  • Energy Services
  • Dams Sector
  • Financial Services
  • Nuclear Reactors, Materials, and Waste
  • Food and Agriculture Sector
  • Water and Wastewater Systems
  • Healthcare and Public Health
  • Emergency Services
  • Transportation Systems
  • Chemical Sector
  • Communications
  • Information Technology Sector
  • Defense Industrial Base
  • Critical Manufacturing Sector
  • Government Facilities
  • Commercial Facilities

2. Application security:

Application security is a critical domain that can  be chosen by any organization that uses software and hardware tools during the development of any application. The development stage of an application is crucial and ensuring security from external threats is imperative.

Types of application security:

Let us take a look at the different types of security features used in application security:

  • Authentication: Application security uses Authorization to ensure the user is who they claim to be. The authentication is done by obtaining a username and password for identification. The user can also opt for a multi-factor authentication which includes, something you know (a password), something you have (a mobile device), and something you are (a thumbprint or facial recognition).
  • Authorization: Once the authorization is done for a user, the Application security validates the user if he/she is granted permission to use the application. A list of users needs to be provided access to the application and the same needs to be coded into the application software. Although it is the second step, the process of authorization must always precede the process of Authentication so that only authorized credentials are processed during Authentication.
  • Encryption: The motive of authentication and authorization comes into effect only with the step of encryption that is executed as this method is done to protect the visibility of sensitive data from cybercriminals. This is where cloud-based applications prove to be more than useful as it offers increased protection due to decreased data traffic.
  • Logging: The application security maintains a chronological log record in the form of a file containing all credentials who have previously accessed the data. It is a step of precaution at the time of a security breach.
  • Application security testing: Finally, a test is run for the application to make sure all the controls are in place and working smoothly.

3. Network security:

Network security protects the internal systems from unauthorized intrusion attacks with malicious intentions seeking access to systems. Network security uses restriction of access as a major tool to protect the software and its complete infrastructure from compromising data. Data traffic is alerted when noticed on an abnormal basis and flags are being used during times when caution is to be exercised.

Controls of network security

The network security uses physical, technical, and administrative controls to protect the internal systems.

Physical Control:  As the name suggests, it prevents unauthorized personnel from gaining access to physical assets like routers, cables, etc. Biometric authentication and advanced tools are used for this purpose.

Technical Control:  Technical control uses network security tools to protect access to the internal network from unauthorized personnel and to prevent unnecessary or malicious activities within the authorized personnel also.

Administrative Control:  This control administers policies and processes to monitor the behavior of personnel who have access to data.

4. Cloud security:

Cloud security is a security tool that secures data through cloud resources and software. Cloud security offers a low cost of maintenance, time and energy, and risk of breach, unlike traditional data centers. Cloud based applications has better security of access and the user is not dependent on any device or a specific location to protect the data from unauthorized access. This mere fact has proven all myths about Cloud applications to be false since it eliminates physical servers and is unlike many traditional approaches.

Challenges faced by cloud-based applications/services

Although cloud security offers increased benefits, below are few challenges faced by organizations during the transitional stage:

  • Cloud security undoubtedly means decreased ease of access, but it is critical to maintaining well-secured cloud software. A poorly secured cloud software is like a treasure to cyber stalkers seeking an attack surface.
  • It can be said that initially there is a lack of visibility and lack of exposure to its customers in Cloud software. There is full control when it comes to the layers of infrastructure but it takes time for customers to visualize their environment.
  • Traditional security tools usually find it challenging to enforce their protection policies as the environment is highly dynamic. But the environment provided by cloud security is also highly flexible thus aiding in providing timely provisions.
  • When security controls are not identified and embedded in the coding templates during the development cycle, it can pose a serious security position for the organization as the security-related changes are executed after the deployment. Such software is time-consuming to market.
  • It is critical to provide clearly defined privileges when granting permissions to users. Only trained users must be permitted to edit or delete data. It can again create security concerns at the application level.
  • Consistent data security can pose a challenge when opting for hybrid tools to manage multi-cloud environments preferred by many organizations.
  • It is suggested to make complete usage of all tools and methods and obtain compliance with accreditation programs like HIPAA and GDPR certification. Refer to our Blogpost on GDPR and its influence in enhancing data privacy.

5. Internet of things (IoT) security

The Internet of things is referred to as IoT. It usually refers to a range of security devices or systems which may be critical or non-critical like the television, printers, embedded systems, Wi-Fi routers, or appliances. These devices do not come with security and are usually exposed to a lot of vulnerability, coming with their own set of security challenges for users. It is important to protect it and put cyber security in the spotlight during its usage.

Read more about this: Cybersecurity Challenges using IoT / IoMT Health

Quick insights on security measures

Below are a few steps to follow to ensure cyber security, providing quick insight on IoT:

  1. Choose to install security applications/toolson all devices.
  2. Keep your passwords strong. Refrain using passwords that are predictable or do not keep them accessible to anybody other than authorized users.
  3. Be aware of how your information is being used by other applications. Always read the Privacy Policy before agreeing to it.
  4. Always be on the lookout for data breaches while using devices that collect data and share it with third parties. There is no need to be constantly vigilant but to do thorough research beforehand.
  5. Do not think twice to deny permissions where it is not necessary. Analyze the function of the application and grant permissions only when it is limited to its usage.
  6. Choose a trusted data service provider, which does not have any history of data breaches.
  7. Keep your device updated, check for updates on the manufacturer’s website.
  8. Keep caution when the application uses social sharing with the internet. Social sharing websites generally contain information pertaining to your details such as your live location, contact information, etc. Always remember that cybercriminals are on the lookout for his kind of information for cyber-stalking.

Challenges and Solutions to enable compliance pci

Posted on by admin

Challenges and solutions to better enable compliance with PCI SSF:

The PA DSS was introduced to provide a guideline for the development of payment applications. Although software security and resilience could mean a lot more than the 14 requirements of the PA DSS, the PA DSS has been the go-to when it comes to certification and validation for software security.

Now the PA DSS substituted by the PCI SSF. What is PCI SSF? How will this transition affect your organization?

PCI SSF – In brief

PCI SSF stands for Payment Card Industry Software Security Framework. It provides the standard guidelines to be followed by software companies while designing and developing payment software.

It comprised of two independent standards

The PCI SSS –  Secure Software Standard: This defines a set of requirements to ensure integrity and confidentiality of payment transactions, data, and the payment software.

The PCI SLC –  Secure Software Lifecycle Standard: This defines the basis and guidelines to design and develop the payment software, additionally it also lays down the best practices to maintain the payment software securely throughout the software lifecycle.

Although the PCI SSF is an independent set of payment security standards, it can be said that the PCI SSF takes many of its elements of control from the PA DSS standard.

So, what’s new?

PA DSS vs PCI SSF – The transition in detail, challenges, and solutions

Multiple reasons like constant change in technology, advancements in software development techniques, emerging trends in cyber-attacks have led to this transition from PA DSS to PCI SSF. The new standards of PCI SSF have comprehensive elements which would be suitable for both traditional and modern software methodologies. It has been designed in a way where every organization validating to this standard will have control over every aspect.

Let us take a look at the various aspects of differences, similarities, challenges, and solutions… Is this a change or a chance, read through to find out:

Changes and Challenges:

  • Change in Objective- Shifting to a comprehensive approach

The PA DSS was designed exclusively for the PCI DSS environment. It emphasizes majorly on cardholder information and sensitive authentication data. The PCI SSS standard mainly focuses on the integrity and confidentiality of the transaction data. The Secure Software Standard framework lays out core requirements and v1.1 has included applicability to terminal applications.

The PA DSS has certain software lifecycle and security requirements, security features of the software application within itself. The Secure Lifecycle standard focuses on how software development companies shall design their payment software.

The PCI SSF framework has prescribed clearly defined and comprehensive objective controls like Identifying dependencies between hardware and software compatibilities, providing provisions to secure the defaults, mandating a functionality within the software to retain the data securely as per payment industry methods. It evaluates how data is securely deleted. It demonstrates that the software must have a separate feature on how it is authenticating the users, how it provides role-based access control, whether it is tracking malicious activities and reporting the lags to the concerned team for analysis and prevention of lapses.

If PA DSS talks about password policy, several characters, expiry… PCI SSF ensures that these standards are not just given provision for but are implemented in the software and the customer is given awareness about the software, what kind of software it is, the user manual is provided for, the environment for usage, and the features supported, how compliant it is and how it is to be configured. Thus, making it a comprehensive approach.

  • Change in Applicability- Increased Applicability

The intent or applicability of the PA DSS and PCI SSF are quite similar, and we can say that it is a point of similarity between these two standards. The PA DSS standard is strictly applicable only to an application developer or payment application integration service that stores, processes, or transmits cardholder data as part of authorization or settlement.

The PCI SSF is applicable to any software developing company that develops payment software that is sold, distributed, or licensed to third parties. It is to be noted that this includes payment software that might be installed on a customer’s system and payment software deployed to customers “as a service” over the internet. However, it is not applicable if a company is developing software in-house for its usage or the usage of any one single customer.

The PCI SSF supports existing ways in PA DSS to demonstrate good application security and also increases the applicability of a variety of new payment software and development processes.

  • Change in the structure of the framework’s standard itself- Ensuring software security right from development:

There are currently no standards that provide a guarantee to the secure development process followed by the software companies developing software for payment industries. Although there are few requirements emphasized in the PA DSS standard on the best practices for software development, but the PCI SSF has implemented new standards in the SLC.

The PCI SLC incorporates threat identification, threat mitigation, and analysis of the risks involved, vulnerability detection and mitigation, avoiding security lapses as a part of its objective controls. SLC emphasizes on various aspects such as change management, data protection and how it is incorporated in the software, how to implement software in a specific environment, modes of third-party communication, how to reach out in case of updates to stakeholders.

Any organization implementing the SLC will give assurance to customers and stake holders of following best practices.

  • Change in criteria- Objective oriented, increased and improved security:

The new standard has opened the criteria for eligibility to be certified to increased payment software types. It supports broader array of payment software types and all software methodologies.

There are new requirements added for Terminal software. The PCI SSS objective talk about separate and exclusive controls for Terminal software. The functions performed by the terminal application needs to be documented. The design of the security features must be defined. All types of attacks that can happen need to be mitigated with in-built mechanism within the terminal application. Security testing needs to be performed so that the lapses are identified, and vulnerabilities are not taken advantage by the hackers. An implementation guide needs to be given on how it integrates with backend.

To achieve its objective of integrity and confidentiality on whole transaction data, the PCI SSS has removed dependency on technology. Now any company can get their technology validated to this standard.

Listing  Eligibility – A unique opportunity:

The intent of both the standards is same which is, to set a standard for any software company which develops software for the payment industry. Here the PCI SSF brings with it, a unique and one-of-a-kind eligibility. Once an organisation gets the validation and certification of PCI SLC, they can list their company in the PCI SSF’s list of “SLC qualified vendors”.

Procedural changes- The transition timeline:

  1. The PCI SSF was first published in Jan 2019.
  2. The last acceptance for new PA DSS submissions was closed on 30th June 2021.
  3. Companies which have not submitted ROV and AOV for their PA DSS certification yet, will have to opt for PCI SSF.
  4. If you are already PA DSS certified, minor changes can be submitted till 28th October 2022.
  5. When a product is already PA DSS certified i.e. It has been deployed to vendors the PA DSS will be acceptable for the pre-existing deployed versions of the already PA DSS certified applications.
  6. The PA DSS program closes on 28th Oct 2022.
  7. Any new application, software or updated new versions of the previously deployed applications, need to be compliant with PCI SSF.
  • Change in the assessment process- Internal training and security education:

The PA DSS validation process consists of : selecting a PA QSA, reviewing the payment application, determining if it is PA DSS compliant, submission of the ROV and AOV to council, issuance of the acceptance letter to vendor and listing on the website.

The assessment process of PCI SSF is streamlined. Certain case studies suggest that the new standard assessment can identify lapses such as implementation of attack detection methods, anomalous behaviour, usage of random number generator, execution level vulnerabilities like cache timing, branch prediction, etc.

During such assessment and gap analysis, the importance of security education within software development community increases. Providing training and evaluating the effectiveness of training provided, matures the processes and makes the organisational output more effective.

Chances and Solutions:

  • Conducting a deep interpretation of the PCI SSF framework:

It is of utmost importance to have a deep understanding of the new changes and to be prepared. The elements in the framework of the new standard might have an effect on the business factors, hence it is always better to take prior steps to facilitate necessary business operations. Having a copy of the PCI Council guide handy can go a long way in this transition.

  • Investigating the needs and analysing the standards

An analysis is the first step to achieving any goal. Be it a business goal or the PCI SSF standard. These standards demonstrate the best practices to be followed. Performing a comparative analysis on where the organization is currently with the standards prescribed by PCI SSF will bring you closer to achieving compliance. Once this analysis has been done, you can work on the requirements.

  • Know it in-and-out :

The PCI Security Standard Framework consists of Secure Software Standard (SSS) and Secure Software Lifecycle Program (SLC). The standards prescribed the basis of validation and listing eligibilities vary completely. Although they are part of the same framework, they are designed to achieve different aspects of the objective which is Software Security.

It is significant to know these differences as the security of the payment software being designed and developed can be easily achieved.

  • Staying abreast of the updates from PCI Council

Keeping a tab on updates must be kept as a constant activity during any transitions. A transition is the time announcements are made and staying prepared with updating policies and requirements can prevent last-minute lapses.

  • Professional expertise

The importance and benefits of professional guidance during such transitions are self-evident. We at QRC can help you in preparing for this transition phase. We conduct a thorough audit of your software development process as per the Secure SLC defined scope and requirements. Post assessment, we provide you with AoV, ROV Report. With new Secure SLC standards in play, you can reap the benefit of Secure SLC Annual Maintenance Service that ensures full compliance of the SLC on Recertification Assessment. You can avail services for risk identification, analysis, and management. We conduct impact analysis and provide end-to-end assistance from configuration and change management to establishing Quality Assurance Process. We also provide complete SSS Solution by reviewing, advising, security testing, conducting code review the payment software, training the development teams and helping in certification and listing in PCI SSC Secure Software Standard listing.