Month: August 2024

Draft Telecom Cybersecurity Rules Released

Posted on by admin
On August 28, 2024, the Ministry of Communications (Department of Telecommunications) announced the draft Telecommunications (Telecom Cyber Security) Rules, 2024 in the Official Gazette. The proposed rules aim to enhance the cybersecurity framework for telecommunication networks and services by outlining comprehensive guidelines on data collection, security measures, and incident reporting.
Key Objectives of the Draft Rules  : The draft rules, introduced under the Telecommunications Act, 2023, are designed to replace the outdated Prevention of Tampering of the Mobile Device Equipment Identification Number Rules, 2017, and its 2022 amendment, aligning the sector with modern cybersecurity needs.
Core Definitions  
  • Telecom Cyber Security  : Involves tools, policies, guidelines, and technologies aimed at protecting telecommunication networks and services.
  • Chief Telecommunication Security Officer (CTSO)  : A designated officer responsible for ensuring compliance with these cybersecurity rules within telecommunication entities.
  • Telecommunication Entity  : Refers to any organization involved in providing telecommunication services or managing telecommunication networks.
 
Data Collection and Security Protocols   
The draft rules empower the Central Government and authorized agencies to collect and analyze traffic data from telecommunication entities to improve cybersecurity. The data can be shared with relevant law enforcement agencies under stringent safeguards, ensuring that it is used solely for cybersecurity purposes.
Cybersecurity Obligations for Telecom Entities   
  • Prohibition of Misuse  : Entities must prevent any actions that could compromise telecom cybersecurity, including fraudulent activities and security incidents.
  • Mandatory Security Measures  : Telecommunication entities are required to implement robust cybersecurity policies, conduct regular testing, and report security incidents promptly.
  • Security Operations Centers (SOC)  : Entities must establish or collaborate on SOCs to monitor and respond to cybersecurity threats effectively.
Incident Reporting and Public Disclosure   
Telecommunication entities must report security incidents within six hours of occurrence, detailing the impact and response measures taken. The Central Government retains the right to disclose significant incidents to the public if deemed necessary.
Telecommunication Equipment and Identifier Regulations   
Manufacturers and importers of telecommunication equipment must register IMEI numbers with the Central Government before sale or import. The rules also prohibit tampering with telecommunication identifiers, with measures in place to block compromised equipment.
Public Consultation and Implementation   
The draft rules are open for public comments for 30 days from their publication date. Stakeholders are encouraged to review the proposed regulations and provide feedback to help shape the final version.
The introduction of the Telecommunications (Telecom Cyber Security) Rules, 2024, marks a critical step in fortifying India’s telecommunication networks against cyber threats. By setting clear guidelines on data handling, security measures, and incident response, the rules aim to safeguard the nation’s telecom infrastructure and ensure the integrity of communication services.
Read the full draft here : Telecommunication Cybersecurity Draft 2024

SEBI Introduces New CSCR Framework for REs

Posted on by admin
The Securities and Exchange Board of India (SEBI) has released a comprehensive circular detailing the new Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs). This framework will replace the existing SEBI cybersecurity circulars, guidelines, and advisories.
Objective and Key Features of CSCRF   
The primary goal of the CSCRF is to address the evolving landscape of cyber threats, align with industry standards, facilitate efficient audits, and ensure compliance by SEBI-regulated entities. The framework establishes standardized reporting formats for REs, enabling streamlined compliance and oversight, SEBI stated.
The CSCRF is based on international standards and incorporates five key cyber resiliency goals: anticipate, withstand, contain, recover, and evolve. These goals are adapted from the Cyber Crisis Management Plan (CCMP) developed by the Indian Computer Emergency Response Team (CERT-In), aiming to combat cyber-attacks and cyber terrorism. The framework outlines a structured approach to implementing various cybersecurity and cyber resilience measures to enhance understanding and compliance.
Classification and Graded Approach   
The CSCRF follows a graded approach, classifying REs into five categories based on their operations and thresholds, such as the number of clients, trading volumes, and assets under management. The categories are:
1. Market Infrastructure Institutions (MIIs)
2. Qualified REs
3. Mid-size REs
4. Small-size REs
5. Self-certification REs
This classification ensures that even smaller entities are equipped with adequate cybersecurity measures to achieve resilience against cyber incidents and attacks.
Cyber Capability Index for Enhanced Monitoring   
To further bolster cybersecurity efforts, the CSCRF introduces the Cyber Capability Index (CCI) for MIIs and Qualified REs. This index will enable these entities to monitor and assess their cybersecurity progress and resilience on a periodic basis, fostering a culture of continuous improvement in their cybersecurity posture.
SEBI’s new framework aims to provide a robust methodology for entities to counteract cyber threats, aligning them with global best practices and ensuring a resilient financial market ecosystem in India.
Read the full document here :  https://www.sebi.gov.in/legal/circulars/aug-2024/cybersecurity-and-cyber-resilience-framework-cscrf-for-sebi-regulated-entities-res-_85964.html

CEA Releases Draft Cybersecurity Regulations for the Power Sector

Posted on by admin
The Central Electricity Authority (CEA) has issued the draft Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2024, seeking public comments. Released on August 16, 2024, these draft regulations are available on the CEA website and are designed to bolster cybersecurity across India’s power sector.
  • Key Features of the Draft Regulations
    The draft regulations detail the cybersecurity measures required from “Responsible Entities” within the power sector to protect against cyber threats. Responsible Entities include a broad range of power sector organizations such as generating companies, captive plants, renewable energy sources, transmission and distribution licensees, load dispatch centers, energy storage systems, forecasting service providers, traders, and power exchanges, among others.
  • Public Participation Encouraged
    Stakeholders and the public are invited to review the draft and provide feedback. The deadline for submitting feedback is September 10, 2024. Public input will be considered in the finalization of the regulations.
  • Strengthening Cybersecurity in Critical Infrastructure
    This initiative emphasizes the increasing need for robust cybersecurity in critical infrastructure such as the power grid. By implementing these measures, the CEA aims to safeguard the reliability and security of the power supply against potential cyber threats, ensuring continued service to all citizens.
For more information and to access the draft regulations, check here : Draft  Cyber Security in Power Sector Regulations

Understanding WASA Audits: ABDM Compliance Simplified

Posted on by admin
In today’s digitally driven world, web applications play a pivotal role in business operations and customer interactions. However, this increased reliance on web applications also makes them prime targets for cyber threats. Conducting a Web Application Security Audit (WASA) is essential for identifying, assessing, and mitigating these risks, ensuring that web applications remain secure and reliable. This blog delves into the significance of WASA, its comprehensive process, and the benefits it offers to organizations, particularly in the context of integrating with initiatives like Ayushman Bharat Digital Mission (ABDM).
What is WASA?
A Web Application Security Audit (WASA) is a thorough examination of a web application’s security posture. The primary objective is to identify vulnerabilities that could be exploited by attackers, compromising the application’s integrity, confidentiality, and availability. By adhering to industry best practices and guidelines, such as those outlined by the Open Web Application Security Project (OWASP), a WASA provides organizations with a detailed understanding of their security weaknesses and actionable recommendations for improvement.
The Relevance of ABDM
ABDM stands for Ayushman Bharat Digital Mission, an initiative by the Government of India aimed at creating a digital health ecosystem in the country. The mission’s goal is to develop the necessary infrastructure to support the integration of digital health services, ensuring that healthcare is accessible, affordable, and of high quality for all citizens. Web applications used by healthcare providers must integrate seamlessly with the digital building blocks of ABDM and comply with its guidelines.
Milestones in ABDM Integration
  1. ABHA Number Creation and Capture & Verification  : This milestone focuses on the seamless registration of patients using the Ayushman Bharat Health Account (ABHA) number.
  2. Building Health Information Provider (HIP) Services  : This involves sharing digital records via the Personal Health Records (ABHA) app.
  3. Developing Health Information User (HIU) Services  : This milestone ensures that authorized healthcare workers can access a patient’s medical history with complete consent, providing a comprehensive view of the patient’s health.
Why You Need WASA
Conducting a WASA is crucial for organizations aiming to secure their web applications against potential threats. Here are key reasons why WASA is indispensable:
  • Security Posture Assessment  : Through thorough testing, analysis, and reporting, WASA helps determine an application’s security posture.
  • Comprehensive Reporting  : Detailed reports are provided for the technical team, alongside executive summaries for management.
  • Industry Best Practices  : The audit follows OWASP guidelines, ensuring adherence to industry best practices.
  • ABDM Integration  : Completing a WASA is essential for the exit process of ABDM integration, ensuring compliance with its stringent security requirements.
Highlights of WASA
Testing Scope  :
  • With and/or Without Credentials  : Testing scenarios include both authenticated and unauthenticated users to uncover a wide range of vulnerabilities.
Tools and Techniques  :
  • Best-of-Breed Tools  : A combination of industry-leading tools is utilized for comprehensive security assessments.
  • Manual Validation and Penetration Testing  : Expert manual testing using state-of-the-art techniques and methodologies identifies and validates vulnerabilities.
Vulnerability Targets  :
  •   Privilege Escalation  : Including lateral and vertical privilege escalation.
  •   Injection Attacks  : Such as SQL, LDAP, and URL injection.
  •   Authentication Vulnerabilities  : Covering session management and session hijacking.
  •   Cross-Site Scripting (XSS)  : Detecting and mitigating XSS vulnerabilities.
  •   Misconfigurations  : Addressing security misconfigurations in server and application settings.
  •   Vulnerable Components  : Identifying outdated or insecure components in the application stack.
  •   Unvalidated Redirects and Forwards  : Preventing unvalidated redirects and forwards.
  •   Malware Injection  : Detecting and mitigating malware injection.
  •   Buffer Overflow Vulnerabilities  : Addressing buffer overflow vulnerabilities.
  •   Logic Flaws  : Identifying business logic vulnerabilities that compromise the application’s integrity.
Testing Standards  : 
  • OWASP Top 10  : Testing against the latest OWASP Top 10 vulnerabilities to ensure coverage of the most critical security risks.
Remediation Recommendations
After the audit, detailed remediation recommendations are provided for identified vulnerabilities. These recommendations include best practices for securing applications and mitigating identified risks. The goal is to equip organizations with the knowledge and tools needed to enhance their security posture effectively.
Deliverables After WASA
Upon completion of the WASA, organizations receive a detailed report and a WASA certificate. The report outlines the milestones covered and ensures compliance with CERT-In guidelines. This certification not only validates the security of the web application but also instills confidence in stakeholders and customers regarding the organization’s commitment to cybersecurity.
In an era where cyber threats are constantly evolving, conducting a Web Application Security Audit is not just a best practice but a necessity. By identifying and addressing vulnerabilities proactively, organizations can safeguard their digital assets, ensure compliance with regulatory requirements, and build trust with their customers.
Secure your web applications today and ensure compliance with industry standards. Contact us to schedule your comprehensive Web Application Security Audit and protect your digital assets from potential threats.

Microsoft, CrowdStrike, and the Global BSOD Outage

Posted on by admin
On July 19, 2024, a seemingly routine security update from CrowdStrike, a leading cybersecurity company, triggered a global wave of Blue Screen of Death (BSOD) errors on Windows devices. This issue brought down countless systems, disrupting businesses, airlines, and even critical infrastructure. Here’s a breakdown of the event, its impact, and the solution.
 
A Flaw in the Falcon
On July 18, 2024, CrowdStrike rolled out a faulty update for its Falcon Sensor software. This update caused a critical incompatibility with Windows systems, leading to widespread BSOD crashes. CrowdStrike CEO George Kurtz acknowledged the issue in a public statement, expressing regret for the disruption and highlighting the company’s commitment to a swift resolution.
“The outage was caused by a defect found in a Falcon content update for Windows hosts. Mac and Linux hosts are not impacted. This was not a cyberattack. We understand the severity of this situation and are working tirelessly with Microsoft to provide a fix as quickly as possible,” Kurtz stated.
Systems running Falcon Sensor for Windows 7.11 and above that downloaded the updated configuration from 04:09 UTC to 05:27 UTC were susceptible to system crashes. The timeline of the event unfolded rapidly. Within hours of the update, reports of BSOD errors began pouring in from all corners of the globe. Microsoft and CrowdStrike immediately launched investigations, prioritizing a solution.
A Configuration Conundrum
The root cause of the outage stemmed from a configuration error within the Falcon Sensor update. The update unintentionally triggered a conflict with a core Windows system file, leading to system instability and crashes. While the specific technical details are complex, the issue essentially boiled down to a communication breakdown between the security software and the operating system.
Global Impact of the Outage
The impact of the Microsoft-CrowdStrike BSOD outage was far-reaching. Businesses of all sizes experienced disruptions, hindering productivity and causing financial losses. Flights were grounded as airlines’ critical systems went down. Public transportation networks, hospitals, and even government agencies were affected.
Solution
CrowdStrike and Microsoft responded swiftly. CrowdStrike quickly rolled back the faulty update and issued a patch to address the configuration error. CrowdStrike corrected the logic error by updating the content in Channel File 291. No additional changes to Channel File 291 beyond the updated logic will be deployed. Falcon is still evaluating and protecting against the abuse of named pipes. CrowdStrike identified the trigger for this issue as a Windows sensor-related content deployment and reverted those changes. The content is a channel file located in the %WINDIR%System32driversCrowdStrike directory.
– Channel file “C-00000291*.sys” with a timestamp of 2024-07-19 0527 UTC or later is the reverted (good) version.
– Channel file “C-00000291*.sys” with a timestamp of 2024-07-19 0409 UTC is the problematic version.
Lessons Learned
The Microsoft-CrowdStrike BSOD outage serves as a stark reminder of the importance of rigorous software testing and communication within the cybersecurity ecosystem. It also highlights that all OEM and third-party software-related updates should first be done in UAT/sandboxed environments and then pushed to production systems.
Conclusion
This incident underscores the critical nature of meticulous update management and the need for robust contingency plans to mitigate the impact of unexpected software failures. By learning from such events, the tech community can better safeguard against future disruptions and ensure the stability and security of global digital infrastructure.
Author :  Aditya P Sawant  | Analyst – Security

RBI Issues New Cyber Resilience Guidelines for Non-Bank PSOs

Posted on by admin
On July 30, 2024, the Reserve Bank of India (RBI) released the Reserve Bank of India (Cyber Resilience and Digital Payment Security Controls for Non-Bank PSOs) Master Directions, 2024. The new guidelines are designed to enhance the safety and security of payment systems operated by non-bank Payment System Operators (PSOs).
Key highlights of the new Directions include:
  • Applicability  :  The provisions of these Directions are mandatory for all authorized non-bank PSOs.
  • Risk Management with Unregulated Entities    : To effectively manage cyber and technology-related risks, especially those arising from partnerships with unregulated entities like payment gateways, third-party service providers, and vendors within the digital payments ecosystem, PSOs must ensure compliance with these guidelines by such entities as well. Compliance must be established through a mutually agreed policy, approved by the PSO’s Board.
  • Focus on Cybersecurity    : The Directions aim to strengthen the information security preparedness of PSOs, with a particular focus on cybersecurity. The framework outlined in the Directions emphasizes robust governance mechanisms to identify, assess, monitor, and manage risks.
  • System Resilience and Security    : The Directions mandate PSOs to adopt baseline security measures that ensure system resilience and secure digital payment transactions. PSOs are encouraged to continuously migrate to the latest security standards.
  • Existing Security Measures  :  The existing security and risk mitigation measures for card payments, Prepaid Payment Instruments (PPIs), and mobile banking remain in effect. In the event of any discrepancies between current guidelines and the new Directions, the instructions outlined in the Master Directions will take precedence.
These Directions reflect the RBI’s ongoing commitment to fortify the digital payments ecosystem, ensuring that PSOs maintain high standards of cybersecurity and risk management. Read the full release direction here :  https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=12715