Month: January 2023

Organization Security Implementation – Systematic approach

Posted on by admin

Creating a secure organization is a complex and vital aspect for any business or organization, that requires a systematic approach. Organizations must take a step-by-step approach to build secure processes and systems with the help of appropriate people, process, and technological controls. Building a secure environment is not a one-time event but a continuous process that requires a systematic approach.

Step 1: Assess the Current Organization Risks

The first step in creating a secure organization is to assess the current state of security within the organization. Main part is to identify and assess the risks that the organization faces. As a starting point, this assessment should consider all business functions of the organizations and their corresponding dependent outsourced functions if any.

Identify the assets that need to be protected, the potential threats that could compromise those assets, and the likelihood of those threats occurring. Once the risks have been identified, organizations can then take appropriate measures to mitigate them. Once the current state of security has been identified, the organization can then develop a plan to address any identified vulnerabilities and risks.

Step 2: Implement Appropriate Controls to Mitigate the Risks

The second step is to implement controls to protect assets. These controls can be grouped into three categories: people, process, and technology.  These controls should be designed to mitigate the organization’s risks, while also considering the organization’s unique needs and requirements.

  • People controls include policies and procedures that ensure that employees are aware of their role in maintaining security and that they understand their responsibilities. Example of People Controls such as employee training and awareness programs, as well as background checks and security clearances for employees etc.,
  • Process controls include procedures and guidelines for how the organization handles sensitive information and how it responds to security incidents. Process controls include things such as security policies and procedures, incident response plans, and business continuity plans.
  • Technology controls include physical and digital security measures such as firewalls, intrusion detection systems, and encryption.

Step 3: Monitoring and Review

The third step is to monitor and review the organization’s security posture. This includes regularly review, Test and update the controls to ensure they are still effective in protecting the organization and they are functioning as intended and that they are keeping the organization protected. This includes reviewing policies and procedures to ensure that they are up-to-date and effective, regular security assessments, penetration testing, and vulnerability assessments to identify any new vulnerabilities etc.,

In addition, organizations should also establish a culture of security within the organization. This includes educating employees about the importance of security and the role they play in maintaining it. It also includes holding employees accountable for adhering to security policies and procedures.

Step 4: Continual Improvement.

The final step is to continuously improve the organization’s security posture. This includes staying informed about new threats and vulnerabilities, identifying new risks, and implementing new controls as needed.

Conclusion:

In conclusion, creating a secure organization requires a systematic approach that involves identifying risks, implementing controls, monitoring, and continuously improving the security posture. Organizations should take a step-by-step approach and should not hesitate to seek the help of experts in the field if needed. Remember that security is an ongoing process, and it’s important to be proactive and keep your organization’s security posture current.

BFSI: PCI and other Regulatory Requirements

Posted on by admin

The banking industry is undergoing a digital transformation, with more and more financial transactions taking place online and an increasing volume of sensitive financial data being handled by banks. This shift towards digital banking has brought about many benefits, such as increased convenience and accessibility for customers, but it has also introduced new challenges, particularly in terms of cyber security.

To address these challenges, the Reserve Bank of India (RBI) has recently released new guidelines for cyber security for banks operating in India. These guidelines aim to strengthen the security infrastructure of banks and protect sensitive financial information from cyber threats. Compliance with these guidelines is mandatory for all banks and failure to do so may result in penalties and fines. Some of these circulars referred below for the reference. Please note that, these circulars might be got revised later years, without intact the original requirements.

Regulator Subject Circular Number
RBI Storage of Payment System Data DPSS.CO.OD.No 2785/06.08.005/2017-18 dated April 06, 2018,
RBI Guidelines on Regulation of Payment Aggregators and Payment Gateways DPSS.CO.PD.No.1810/02.14.008/2019-20 March 17, 2020 (Annexure 2)
RBI Cyber Security Framework in Banks DBS.CO/CSITE/BC.11/33.01.001/2015-16 June 2, 2016
RBI Master Direction – Information Technology Framework for the NBFC Sector Master Direction DNBS.PPD.No.04/66.15.001/2016-17 June 08, 2017
RBI Guidelines on Information security, Electronic Banking, Technology risk management and cyber frauds DBS.CO.ITC.BC.No. 6/31.02.008/2010-11 April 29, 2011
RBI Master Direction on Digital Payment Security Controls DoS.CO.CSITE.SEC.No.1852/31.01.015/2020-21 February 18, 2021
RBI Basic Cyber Security Framework for Primary (Urban) Cooperative Banks (UCBs) DCBS.CO.PCB.Cir.No.1/18.01.000/2018-19
RBI Master Direction – Information Technology Framework for the NBFC Sector DNBS.PPD.No.04/66.15.001/2016-17 June 08, 2017
RBI Membership of Credit Information Companies (CICs) DBR.No.CID.BC.60/20.16.056/2014-15 January 15, 2015

In addition, the Indian government has also enacted Digital Personal Data Protection Bill, 2022, which lays down the framework for protection of personal data of individuals and makes it mandatory for organizations to comply with it. Banks are also under obligation to comply with the bill.

To meet most of the Security requirements and best practices mentioned in the above guidelines, as a starting point, banks may take some of the global standards/frameworks for implementation such as PCI DSS, ISO 27001 Etc., to protect sensitive customer information and ensure compliance with industry standards and regulatory requirements.

  • PCI DSS (Payment Card Industry Data Security Standards) is a set of security standards that apply to organizations that accept credit and debit card payments. Compliance with these standards is mandatory for all banks that accept card payments and failure to do so can result in significant fines and penalties.
  • ISO 27001 is an information security management standard that outlines the requirements for an information security management system (ISMS). Compliance with this standard demonstrates a commitment to protecting sensitive information and managing risk effectively.
  • In addition to these specific compliance requirements, it is also important for banks to implement good cyber security practices to protect against a wide range of potential threats. This includes activities such as regular security testing, incident response planning, and employee education and awareness programs.

Not meeting these compliances can put the bank at significant risk. Failure to comply with PCI DSS can result in significant fines and reputational damage, while a lack of an effective ISMS can lead to data breaches and loss of sensitive customer information. Inadequate cyber security practices can also lead to costly data breaches and loss of customer trust.

Role of the C-Level Management:

As a CISO or CIO of a bank, the protection of sensitive customer information and compliance with industry standards and regulatory requirements is of the utmost importance. One of the keyways to ensure this is through compliance with PCI DSS, ISO 27001 and implementing good cyber security practices.

Key message for CISOs and CIOs to consider when implementing compliance with PCI DSS, ISO 27001 and good cyber security practices include:

  • Compliance is not optional it is mandatory for maintaining the safety and security of customer data
  • By implementing these standards, you are demonstrating a commitment to protecting sensitive information and managing risk effectively
  • Regular security testing, incident response planning, and employee education and awareness programs are essential for maintaining good cyber security practices

As a CISO or CIO, it is important to take a proactive approach to compliance and implement regular security testing, incident response planning, and employee education and awareness programs to ensure that the bank’s information and assets are protected.

To achieve these compliances, the bank’s higher management should take the following additional activities:

  • Regularly conduct Risk Assessments and Gap Analysis
  • Implement Information Security Risk Management.
  • Regularly conduct penetration testing and vulnerability assessment
  • Regularly conduct security training for employees
  • Implementing a robust incident response plan
  • Regularly conduct internal and external audit.

In conclusion, compliance with PCI DSS, ISO 27001 and good cyber security practices is essential for protecting sensitive customer information and maintaining the safety and security of the bank’s infrastructure.

Scope of PCI DSS in General Banking Environment:

The Payment Card Industry Data Security Standards (PCI DSS) applies to all organizations that accept, process, store or transmit credit card information. Banks are required to comply with the PCI DSS to protect sensitive customer information and ensure the security of cardholder data.

In a bank, the major function that handles credit and debit card information is typically the card services, payment processing, Back Office etc. This services responsible for storing, transmitting, and processing card-related data.

The following areas, functions, and processes within a bank should be compliant with PCI DSS:

  1. Cardholder data environment (CDE): This includes all systems and networks that store, process, or transmit cardholder data, including servers, databases, applications, and point-of-sale terminals.
  2. Network infrastructure: This includes routers, switches, firewalls, and wireless networks that are used to connect the CDE to the rest of the bank’s systems and networks.
  3. Security controls: This includes firewalls, intrusion detection and prevention systems, and other security devices that are used to protect the CDE from unauthorized access.
  4. Access controls: This includes procedures for controlling access to the CDE, such as user authentication and authorization, and physical security measures to prevent unauthorized access to the CDE.
  5. Vulnerability management: This includes regular vulnerability scans, penetration testing, and vulnerability management to identify and remediate vulnerabilities in the CDE.
  6. Incident response: This includes incident response procedures that are in place to handle security breaches and other security incidents.
  7. Compliance and reporting: This include regular compliance testing and reporting to ensure that the bank is in compliance with the PCI DSS.

The new guidelines underscore the importance of digital transformation and the need for banks to take proactive measures to protect their customers’ information. Banks must now invest in advanced technology and security systems to safeguard the increasing volume of financial data they handle. This includes implementing multi-factor authentication, encryption, and intrusion detection systems, as well as regular security audits and assessments.

How QRC Can support Banks to meet these requirements:

  1. Being a PCI QSA Company, QRC support banks to Attain, Maintain, Retain PCI Compliances.
  2. Being a Cert-In Empanelled vendor, QRC Perform all types of Security Configuration Audits, Perform Vulnerability and Penetration testing on all bank critical assets like Networks, Servers, Applications and Other security Solutions.
  3. Having Qualified CISA Auditors, we can perform Information Systems and Cyber security assessments for the bank as per the requirement.
  4. Being a ISO Certification body, QRC Can Perform ISO 27001, ISO 27701 standards assessment and certify the banks for these compliances.
  5. QRC Can deploy proprietary GRC Platform called QRCAssist, for Managing all Compliances and effectively monitor the projects at levels within the Banks. Which also helps the banks to manage their day to day security functions and all audit data can be managed centrally.

In terms of PCI DSS Compliance QRC can support in the ways:

  1. Guiding Bank to determine the PCI DSS Scope and document the Card Data Flows.
  2. Perform readiness assessment w.r.t. PCI DSS Standard and Identify the gaps.
  3. Provide Remediation Plans for closing the Gaps
  4. Remediation Support while implementing PCI DSS Controls within the Banking environment.
  5. Conducting PCI Trainings for stakeholders
  6. Performing VA and PT and Application Security Testing
  7. Help the process owners to document required Policies, Procedures
  8. Perform PCI DSS Final Assessment and Issue the PCI DSS Certification.

The digital transformation of the banking industry is here to stay, and it is vital that banks take the necessary steps to protect their customers’ information. By complying with the RBI’s guidelines and investing in advanced security systems, banks can ensure the safety and security of their customers’ financial data and maintain their trust in the digital age.

Securing Your Data: Latest Breaches & Prevention Tips

Posted on by admin

Data breach is an incident where sensitive, confidential, or protected information is accessed, used, or disclosed without authorization. This can occur due to a variety of reasons such as hacking, phishing, malware, and other forms of cyber-attacks, as well as human error and system failures.

Data breaches can have serious consequences, including financial losses, legal penalties, and damage to an organization’s reputation. They can also lead to identity theft and other forms of fraud for individuals whose personal information is compromised.

Some notable information security breaches include:

  1. SolarWinds hack: In December 2020, it was discovered that hackers had breached the software supply chain of IT management company SolarWinds, affecting multiple government agencies and private companies. The cause of the breach is believed to be a supply chain attack in which the hackers inserted malware into a software update for the SolarWinds Orion platform.
  2. Marriott data breach: In November 2020, Marriott International announced that hackers had breached the Starwood guest reservation database, potentially exposing the personal information of millions of guests. The cause of the breach is believed to be a vulnerability in the database’s firewall.
  3. Twitter hack: In July 2020, a group of hackers took control of multiple high-profile Twitter accounts, including those of Barack Obama, Joe Biden, and Elon Musk. The cause of the hack was a phishing attack that allowed the hackers to gain access to the Twitter accounts of several employees.
  4. Zoom data leak: In July 2020, it was discovered that a database containing personal information of millions of Zoom users had been left exposed on the internet. The cause of the leak was misconfigured security settings on the database.
  5. Capital One data breach: In July 2019, a hacker was able to gain access to the personal information of over 100 million Capital One customers. The cause of the breach was a misconfigured firewall on a cloud-based server.

Possible causes of these breaches include:

  •   Supply chain attacks: As seen in the SolarWinds hack, attackers can target a company’s software supply chain to gain access to their networks.
  •   Phishing attacks: As seen in the Twitter hack, phishing attacks can be used to trick employees into giving away their login credentials.
  •   Vulnerabilities in software or hardware: As seen in the Marriott data breach, hackers can exploit vulnerabilities in software or hardware to gain access to sensitive information.
  •   Misconfigured security settings: As seen in the Zoom data leak, misconfigured security settings can leave sensitive information exposed to hackers.

To avoid similar breaches, organizations should:

  • Implement strong security measures, such as firewalls, intrusion detection and prevention systems, and encryption.
  • Regularly update and patch software and hardware to fix known vulnerabilities.
  • Train employees to recognize and avoid phishing attempts.
  • Regularly review and audit security settings to ensure that they are properly configured.
  • Conduct regular security assessments and penetration testing to identify and address vulnerabilities.
  • Monitor network and data activity to detect and respond to suspicious activity.
  • Have incident response plan in place to quickly contain and mitigate the breach.
  • Regularly backup data and have disaster recovery plan in place.

These are just a few examples of the recent information security breaches and possible ways to avoid them. It is important for organizations to stay informed of the latest threats and take proactive measures to protect their networks and data.