Author: admin

A Go To Guide For Cybersecurity Technique

Posted on by admin

The dependency on data is increasing as businesses and technologies evolve and so is the threat to breach of data. The arguments on technology and software advancements have been like two sides of a coin for decades now, as the risk is proportional with the benefits.

Recent researches state that if there were to be a loss to the global economy due to cyber-attacks, it would be no less than US$6 trillion. It is always wise to prevent such a loss than bear it.

Cyber security can be managed with cyber security techniques which  can be classified into various sections and domains. Coordination between all these techniques can lead to a successful Cyber security practice within an organisation. Read through to get an idea about five of the widely used cyber security practices.

1. Critical infrastructure security:

Modern societies are highly dependent on infrastructure which is critical for its functioning. Any society needs to have these infrastructures functional and operational with complete security at all times. With the increasing dependency on software, the critical infrastructure too has become operational with software. Security and resilience of these critical infrastructures are highly important as it protects the well-being of the society.

It is not just the business organizations that directly perform these critical functions, but also numerous organizations which support the functioning of critical functions. Such organizations must ensure a contingency plan is set up for risk management.

Sectors of critical infrastructure security:

Below are some of the sectors of critical infrastructure security.

  • Energy Services
  • Dams Sector
  • Financial Services
  • Nuclear Reactors, Materials, and Waste
  • Food and Agriculture Sector
  • Water and Wastewater Systems
  • Healthcare and Public Health
  • Emergency Services
  • Transportation Systems
  • Chemical Sector
  • Communications
  • Information Technology Sector
  • Defense Industrial Base
  • Critical Manufacturing Sector
  • Government Facilities
  • Commercial Facilities

2. Application security:

Application security is a critical domain that can  be chosen by any organization that uses software and hardware tools during the development of any application. The development stage of an application is crucial and ensuring security from external threats is imperative.

Types of application security:

Let us take a look at the different types of security features used in application security:

  • Authentication: Application security uses Authorization to ensure the user is who they claim to be. The authentication is done by obtaining a username and password for identification. The user can also opt for a multi-factor authentication which includes, something you know (a password), something you have (a mobile device), and something you are (a thumbprint or facial recognition).
  • Authorization: Once the authorization is done for a user, the Application security validates the user if he/she is granted permission to use the application. A list of users needs to be provided access to the application and the same needs to be coded into the application software. Although it is the second step, the process of authorization must always precede the process of Authentication so that only authorized credentials are processed during Authentication.
  • Encryption: The motive of authentication and authorization comes into effect only with the step of encryption that is executed as this method is done to protect the visibility of sensitive data from cybercriminals. This is where cloud-based applications prove to be more than useful as it offers increased protection due to decreased data traffic.
  • Logging: The application security maintains a chronological log record in the form of a file containing all credentials who have previously accessed the data. It is a step of precaution at the time of a security breach.
  • Application security testing: Finally, a test is run for the application to make sure all the controls are in place and working smoothly.

3. Network security:

Network security protects the internal systems from unauthorized intrusion attacks with malicious intentions seeking access to systems. Network security uses restriction of access as a major tool to protect the software and its complete infrastructure from compromising data. Data traffic is alerted when noticed on an abnormal basis and flags are being used during times when caution is to be exercised.

Controls of network security

The network security uses physical, technical, and administrative controls to protect the internal systems.

Physical Control:  As the name suggests, it prevents unauthorized personnel from gaining access to physical assets like routers, cables, etc. Biometric authentication and advanced tools are used for this purpose.

Technical Control:  Technical control uses network security tools to protect access to the internal network from unauthorized personnel and to prevent unnecessary or malicious activities within the authorized personnel also.

Administrative Control:  This control administers policies and processes to monitor the behavior of personnel who have access to data.

4. Cloud security:

Cloud security is a security tool that secures data through cloud resources and software. Cloud security offers a low cost of maintenance, time and energy, and risk of breach, unlike traditional data centers. Cloud based applications has better security of access and the user is not dependent on any device or a specific location to protect the data from unauthorized access. This mere fact has proven all myths about Cloud applications to be false since it eliminates physical servers and is unlike many traditional approaches.

Challenges faced by cloud-based applications/services

Although cloud security offers increased benefits, below are few challenges faced by organizations during the transitional stage:

  • Cloud security undoubtedly means decreased ease of access, but it is critical to maintaining well-secured cloud software. A poorly secured cloud software is like a treasure to cyber stalkers seeking an attack surface.
  • It can be said that initially there is a lack of visibility and lack of exposure to its customers in Cloud software. There is full control when it comes to the layers of infrastructure but it takes time for customers to visualize their environment.
  • Traditional security tools usually find it challenging to enforce their protection policies as the environment is highly dynamic. But the environment provided by cloud security is also highly flexible thus aiding in providing timely provisions.
  • When security controls are not identified and embedded in the coding templates during the development cycle, it can pose a serious security position for the organization as the security-related changes are executed after the deployment. Such software is time-consuming to market.
  • It is critical to provide clearly defined privileges when granting permissions to users. Only trained users must be permitted to edit or delete data. It can again create security concerns at the application level.
  • Consistent data security can pose a challenge when opting for hybrid tools to manage multi-cloud environments preferred by many organizations.
  • It is suggested to make complete usage of all tools and methods and obtain compliance with accreditation programs like HIPAA and GDPR certification. Refer to our Blogpost on GDPR and its influence in enhancing data privacy.

5. Internet of things (IoT) security

The Internet of things is referred to as IoT. It usually refers to a range of security devices or systems which may be critical or non-critical like the television, printers, embedded systems, Wi-Fi routers, or appliances. These devices do not come with security and are usually exposed to a lot of vulnerability, coming with their own set of security challenges for users. It is important to protect it and put cyber security in the spotlight during its usage.

Read more about this: Cybersecurity Challenges using IoT / IoMT Health

Quick insights on security measures

Below are a few steps to follow to ensure cyber security, providing quick insight on IoT:

  1. Choose to install security applications/toolson all devices.
  2. Keep your passwords strong. Refrain using passwords that are predictable or do not keep them accessible to anybody other than authorized users.
  3. Be aware of how your information is being used by other applications. Always read the Privacy Policy before agreeing to it.
  4. Always be on the lookout for data breaches while using devices that collect data and share it with third parties. There is no need to be constantly vigilant but to do thorough research beforehand.
  5. Do not think twice to deny permissions where it is not necessary. Analyze the function of the application and grant permissions only when it is limited to its usage.
  6. Choose a trusted data service provider, which does not have any history of data breaches.
  7. Keep your device updated, check for updates on the manufacturer’s website.
  8. Keep caution when the application uses social sharing with the internet. Social sharing websites generally contain information pertaining to your details such as your live location, contact information, etc. Always remember that cybercriminals are on the lookout for his kind of information for cyber-stalking.

Challenges and Solutions to enable compliance pci

Posted on by admin

Challenges and solutions to better enable compliance with PCI SSF:

The PA DSS was introduced to provide a guideline for the development of payment applications. Although software security and resilience could mean a lot more than the 14 requirements of the PA DSS, the PA DSS has been the go-to when it comes to certification and validation for software security.

Now the PA DSS substituted by the PCI SSF. What is PCI SSF? How will this transition affect your organization?

PCI SSF – In brief

PCI SSF stands for Payment Card Industry Software Security Framework. It provides the standard guidelines to be followed by software companies while designing and developing payment software.

It comprised of two independent standards

The PCI SSS –  Secure Software Standard: This defines a set of requirements to ensure integrity and confidentiality of payment transactions, data, and the payment software.

The PCI SLC –  Secure Software Lifecycle Standard: This defines the basis and guidelines to design and develop the payment software, additionally it also lays down the best practices to maintain the payment software securely throughout the software lifecycle.

Although the PCI SSF is an independent set of payment security standards, it can be said that the PCI SSF takes many of its elements of control from the PA DSS standard.

So, what’s new?

PA DSS vs PCI SSF – The transition in detail, challenges, and solutions

Multiple reasons like constant change in technology, advancements in software development techniques, emerging trends in cyber-attacks have led to this transition from PA DSS to PCI SSF. The new standards of PCI SSF have comprehensive elements which would be suitable for both traditional and modern software methodologies. It has been designed in a way where every organization validating to this standard will have control over every aspect.

Let us take a look at the various aspects of differences, similarities, challenges, and solutions… Is this a change or a chance, read through to find out:

Changes and Challenges:

  • Change in Objective- Shifting to a comprehensive approach

The PA DSS was designed exclusively for the PCI DSS environment. It emphasizes majorly on cardholder information and sensitive authentication data. The PCI SSS standard mainly focuses on the integrity and confidentiality of the transaction data. The Secure Software Standard framework lays out core requirements and v1.1 has included applicability to terminal applications.

The PA DSS has certain software lifecycle and security requirements, security features of the software application within itself. The Secure Lifecycle standard focuses on how software development companies shall design their payment software.

The PCI SSF framework has prescribed clearly defined and comprehensive objective controls like Identifying dependencies between hardware and software compatibilities, providing provisions to secure the defaults, mandating a functionality within the software to retain the data securely as per payment industry methods. It evaluates how data is securely deleted. It demonstrates that the software must have a separate feature on how it is authenticating the users, how it provides role-based access control, whether it is tracking malicious activities and reporting the lags to the concerned team for analysis and prevention of lapses.

If PA DSS talks about password policy, several characters, expiry… PCI SSF ensures that these standards are not just given provision for but are implemented in the software and the customer is given awareness about the software, what kind of software it is, the user manual is provided for, the environment for usage, and the features supported, how compliant it is and how it is to be configured. Thus, making it a comprehensive approach.

  • Change in Applicability- Increased Applicability

The intent or applicability of the PA DSS and PCI SSF are quite similar, and we can say that it is a point of similarity between these two standards. The PA DSS standard is strictly applicable only to an application developer or payment application integration service that stores, processes, or transmits cardholder data as part of authorization or settlement.

The PCI SSF is applicable to any software developing company that develops payment software that is sold, distributed, or licensed to third parties. It is to be noted that this includes payment software that might be installed on a customer’s system and payment software deployed to customers “as a service” over the internet. However, it is not applicable if a company is developing software in-house for its usage or the usage of any one single customer.

The PCI SSF supports existing ways in PA DSS to demonstrate good application security and also increases the applicability of a variety of new payment software and development processes.

  • Change in the structure of the framework’s standard itself- Ensuring software security right from development:

There are currently no standards that provide a guarantee to the secure development process followed by the software companies developing software for payment industries. Although there are few requirements emphasized in the PA DSS standard on the best practices for software development, but the PCI SSF has implemented new standards in the SLC.

The PCI SLC incorporates threat identification, threat mitigation, and analysis of the risks involved, vulnerability detection and mitigation, avoiding security lapses as a part of its objective controls. SLC emphasizes on various aspects such as change management, data protection and how it is incorporated in the software, how to implement software in a specific environment, modes of third-party communication, how to reach out in case of updates to stakeholders.

Any organization implementing the SLC will give assurance to customers and stake holders of following best practices.

  • Change in criteria- Objective oriented, increased and improved security:

The new standard has opened the criteria for eligibility to be certified to increased payment software types. It supports broader array of payment software types and all software methodologies.

There are new requirements added for Terminal software. The PCI SSS objective talk about separate and exclusive controls for Terminal software. The functions performed by the terminal application needs to be documented. The design of the security features must be defined. All types of attacks that can happen need to be mitigated with in-built mechanism within the terminal application. Security testing needs to be performed so that the lapses are identified, and vulnerabilities are not taken advantage by the hackers. An implementation guide needs to be given on how it integrates with backend.

To achieve its objective of integrity and confidentiality on whole transaction data, the PCI SSS has removed dependency on technology. Now any company can get their technology validated to this standard.

Listing  Eligibility – A unique opportunity:

The intent of both the standards is same which is, to set a standard for any software company which develops software for the payment industry. Here the PCI SSF brings with it, a unique and one-of-a-kind eligibility. Once an organisation gets the validation and certification of PCI SLC, they can list their company in the PCI SSF’s list of “SLC qualified vendors”.

Procedural changes- The transition timeline:

  1. The PCI SSF was first published in Jan 2019.
  2. The last acceptance for new PA DSS submissions was closed on 30th June 2021.
  3. Companies which have not submitted ROV and AOV for their PA DSS certification yet, will have to opt for PCI SSF.
  4. If you are already PA DSS certified, minor changes can be submitted till 28th October 2022.
  5. When a product is already PA DSS certified i.e. It has been deployed to vendors the PA DSS will be acceptable for the pre-existing deployed versions of the already PA DSS certified applications.
  6. The PA DSS program closes on 28th Oct 2022.
  7. Any new application, software or updated new versions of the previously deployed applications, need to be compliant with PCI SSF.
  • Change in the assessment process- Internal training and security education:

The PA DSS validation process consists of : selecting a PA QSA, reviewing the payment application, determining if it is PA DSS compliant, submission of the ROV and AOV to council, issuance of the acceptance letter to vendor and listing on the website.

The assessment process of PCI SSF is streamlined. Certain case studies suggest that the new standard assessment can identify lapses such as implementation of attack detection methods, anomalous behaviour, usage of random number generator, execution level vulnerabilities like cache timing, branch prediction, etc.

During such assessment and gap analysis, the importance of security education within software development community increases. Providing training and evaluating the effectiveness of training provided, matures the processes and makes the organisational output more effective.

Chances and Solutions:

  • Conducting a deep interpretation of the PCI SSF framework:

It is of utmost importance to have a deep understanding of the new changes and to be prepared. The elements in the framework of the new standard might have an effect on the business factors, hence it is always better to take prior steps to facilitate necessary business operations. Having a copy of the PCI Council guide handy can go a long way in this transition.

  • Investigating the needs and analysing the standards

An analysis is the first step to achieving any goal. Be it a business goal or the PCI SSF standard. These standards demonstrate the best practices to be followed. Performing a comparative analysis on where the organization is currently with the standards prescribed by PCI SSF will bring you closer to achieving compliance. Once this analysis has been done, you can work on the requirements.

  • Know it in-and-out :

The PCI Security Standard Framework consists of Secure Software Standard (SSS) and Secure Software Lifecycle Program (SLC). The standards prescribed the basis of validation and listing eligibilities vary completely. Although they are part of the same framework, they are designed to achieve different aspects of the objective which is Software Security.

It is significant to know these differences as the security of the payment software being designed and developed can be easily achieved.

  • Staying abreast of the updates from PCI Council

Keeping a tab on updates must be kept as a constant activity during any transitions. A transition is the time announcements are made and staying prepared with updating policies and requirements can prevent last-minute lapses.

  • Professional expertise

The importance and benefits of professional guidance during such transitions are self-evident. We at QRC can help you in preparing for this transition phase. We conduct a thorough audit of your software development process as per the Secure SLC defined scope and requirements. Post assessment, we provide you with AoV, ROV Report. With new Secure SLC standards in play, you can reap the benefit of Secure SLC Annual Maintenance Service that ensures full compliance of the SLC on Recertification Assessment. You can avail services for risk identification, analysis, and management. We conduct impact analysis and provide end-to-end assistance from configuration and change management to establishing Quality Assurance Process. We also provide complete SSS Solution by reviewing, advising, security testing, conducting code review the payment software, training the development teams and helping in certification and listing in PCI SSC Secure Software Standard listing.

What is GDPR & It Influence Enhancing Data Privacy

Posted on by admin

Introduction of GDPR

The importance of the protection of private data and the business risks associated with it has increased post-GDPR. The reasons might be several, ranging from the large penalties posed for non-compliance to bringing an exclusive legal framework for data protection but it can be said that business organizations now view data protection with adequate caution.

What is GDPR?

GDPR stands for General Data Protection Regulation. It is an important legal framework for data privacy formed by the European Union. The European Commission decided to plan the data protection framework for its business organizations in 2012 and later GDPR was introduced as one of the major parts of this reform. GDPR’s applicability extends to the organizations in Europe, the organizations in all its member states across and beyond Europe.

7 Principles of GDPR

The GDPR uses 7 principles to optimize data privacy in an organization. Let us first take a look at the seven principles of GDPR:

  1. Lawfulness, fairness, and transparency- The GDPR states that processing of data must have proper reasons and the reasons can include or extend to any of the below: You have the user’s consent.
    • You need to process it for a contract.
    • It is crucial for fulfillment of any legal obligation.
    • For the protection of the vital interests of a natural person.
    • It is done in the public interest.
    • You have a legitimate interest.
  2. The data handling and reason for data processing must be transparent. The way of dealing with personal data must be fair and with the consent of the user without any withholding or misuse of data.
  3. Purpose limitation- The GDPR limits the purpose of data processing. It states that data must be collected for specified, explicit, and legitimate purposes only. The purpose for data usage must be clearly defined, communicated to relevant users, and adhered to strictly. Any purpose or need for data processing arising out of the defined scope must have updated consent.
  4. Data minimization- GDPR not only limits the purpose of the data collected but also the data itself. It restricts the amount of data collected for the specified purpose to the minimum. Collection and processing of any excess data must be avoided.
  5. Accuracy- Data collected and processed must be limited, defined to a purpose, and must be accurate. Any inaccurate data must be erased and data storage must be cleaned at regular intervals.
  6. Storage limitation- Storage of data must be specified to a fixed duration. Data retention periods must be specified and any data which is not used after a certain period must be anonymized.
  7. Integrity and confidentiality- Data stored must be protected from threats and must be confidential. Handling of confidential data must be done with complete integrity and diligence to avoid data breaches or data loss.
  8. Accountability- It is not merely enough to follow the principles prescribed by the GDPR, but also a considerable amount of accountability has been created by the need for evidence. There must be a complete documentation of all procedures followed. Adequate evidence must be produced by the organization demonstrating the compliance of the organization with the GDPR requirements.

Effects of GDPR non-compliance:

The repercussions of not being GDPR compliant depends on the severity of the data breach and how severely the organization has followed the GDPR requirements previously. It can be anything from a fine ranging from 10 million euros to four percent of the company’s annual global turnover.

For instance, an organization that has committed an infringement of rights of its data subjects or unauthorized transfer of personal data internationally, or detaining requests of subjects for access of their data will have to pay a maximum penalty of 20 million euros or four percent of worldwide turnover – whichever is greater. These kinds of losses sometimes lead to billions for big organizations.

The wholesome impact of the GDPR approach

What are the impacts of achieving  GDPR compliance  in an organization? Read through:

  • Increase in customer trust: The GDPR lays down frequent audits of data protection activities and employs a Data Protection Officer (DPO) as a mandatory requirement. Compliance with such data protection principles makes sure that necessary operational practices are in place and this increases the trust of the customers.
  • Improved data security: The access to critical data must be restricted only to necessary resources and the GDPR ensures this through its requirement of privileged identity access management. The GDPR has laid down a strong foundation for data security. It goes a step further and states that any data breach or exposure of data to unauthorized personnel must be reported within 72 hours of occurrence.
  • Cuts down maintenance costs – The GDPR lays down that any data or software or internal applications which are redundant. It requires an organization to keep all their up to date to be compliant with the GDPR requirements and this way, the costs related to storage and retention of old data is cut down.
  • Constantly evolving technology- There are multiple advantages to staying up-to-date from better management of business demands internally to offering better quality to customers externally. The GDPR pushes an organization to stay at its best and latest technology constantly, pushing it to adapt to migrating trends like cloud computing, BYOD, virtualization, etc.
  • Improved decision making- The requirements laid down by GDPR are such that the organizational data and data management will become more consistent and consolidated, which in turn makes it easier to use for automation and analysis. This decreases arbitration and improves the decision-making in the organization.

How GDPR enables optimum data privacy?

The GDPR is not merely a legal requirement, but a legislation that provides wide scope for the achievement of better data security and privacy while striking a balance between advancement in business and technology. The GDPR uses tools like pseudonymization and its seven principles to demonstrate better privacy within the organization.

Anonymization and pseudonymization of data are critical tools through which the GDPR enables optimum data security and privacy in the organization. Using the concept of  pseudonymization, data can be partially anonymized:

  • When data is collected, the user’s identity is replaced with a unique random pseudo-identity.
  • The relationship between the user’s identity and pseudo-identity is stored separately.
  • The data user can be determined with the help of the mapping data stored separately.
  • The data is regarded as pseudonymized.
  • It is crucial to keep this mapping data safely stored. On deletion of the mapping data, the data gets fully anonymized.

The GDPR enables optimization of data privacy in every step of meeting its requirements, right from understanding the purpose of data collection, defining the scope of data collection, minimizing the amount of data collected and stored, obtaining adequate consent from data users for collection, and maintenance of documentation for all the processes followed.

It is the basic requirement of the GDPR to follow lawfulness, fairness, and transparency of data irrespective of whichever process is followed. It is a continuous and evolving process to achieve the principles of the GDPR and this process enables an organization to exercise optimum privacy of personal d

Assessment process followed by QRC –

We at QRC, provide  GDPR assessment  services and can lead you through the road-map of staying GDPR compliant. Take a look at our implementation process:

  • GDPR Readiness Check Questionnaires- This is done to determine the amount of data risk present in the current situation, to check if the organization is GDPR-ready.
  • GDPR Gap Analysis – Ascertaining the position of the organization in terms of GDPR requirements and conducting a gap analysis to determine plans for reaching the standards.
  • GDPR Data Flow Audit- A data flow audit is conducted with a prepared data flow map. This is to clearly define what personal data is stored and how it is stored.
  • On-site audits- An on-site audit is conducted with a questionnaire to identify how the organization’s improved practices demonstrate readiness.

Data Protection Impact Assessment (DPIA)- All new processes introduced in time, need to undergo assessment for data protection risks associated with them and a remediation plan to mitigate those risks.

Cyber Security Firms As Certification Bodies

Posted on by admin

Year after year, several organizations report millions of dollars of loss. Recent surveys suggest that increasing vulnerabilities like data breaches, ransomware attacks are one of the leading reasons for such loss. Apart from monetary loss, the loss of reputation caused by such cyber threats is a deadlier blow for organizations to recover from.

A prime solution to these losses is opting for a Cybersecurity firm that uses their expertise like vulnerability analysis, audits to identify threats, penetration testing to protect businesses from such vulnerabilities. They also develop new technologies to guard the digital assets of organizations posed to such cyber risks. Apart from being a third-party company that provides solutions to cyber risks, can a decision to work with a cyber security firm give any value additions to the organization? Yes, it does.

Why should you look out for a cyber security firm if you want to get the ISO 27001 and the ISO 27701 certification?

Read through to find out…

Cyber security firms as  Certification bodies:

Professional expertise:  When opting for a cyber security firm as a certification body, the major advantage is the high level of expertise offered by the professionals in the team. The auditors from such an organization have a deep understanding of cyber security principles. This level of knowledge is offered exclusively for the sole purpose of making the organization compliant with the standards prescribed in the specified certification.

Advantages for various stakeholders:  The advantages of choosing a cyber security firm as a certification body do not end with the value additions provided for the chosen organization. There are several advantages to the various stakeholders of the organization. Cyber security firms not only create an impact on the data security and protection aspects but also create a wholesome impact on aspects like Risk management, governance, do and business continuity. When an organization is ISO 27701 certified by a cyber security firm, it is evident that the organization’s management has implemented all the best practices in cyber security as follow-up assessments are usually a part of the certification process.

Stay in-the-zone:  Cyber security firms offering certification services have years of experience in areas of Quality risk, Information system management, Cyber risk governance, etc. They are constantly in-the-zone and can provide updates on these aspects as and when required in the audit and certification process.

Significance of the ISO 27001 & ISO 27701 certifications

Impact on the business outcome:  International standards like the ISO 27001 and the ISO 27701 aid in improving the relationship with clients. It can even act as a tool to retain existing clients by providing opportunities to implement best practices within the organization. It provides an edge over others when compared with competitors by improving the quality of services provided.

Data breach:  Research suggest that the cost of a data breach increases 5%-6% every year. The burden of bearing the cost for a data breach can be destructive to a company’s growth. Getting ISO certified can save you from being burdened

As the accepted global benchmark for the effective management of information assets, ISO 27001 enables organizations to avoid the potentially devastating financial losses caused by data breaches. It also ensures that necessary controls are in place to protect the organization from potential threats. It is designed in a way that mandatory regulatory requirements are met for the GDPR, NIST CSF, etc.

Organization’s goodwill:  Cyber-attacks not only cause monetary loss but also cause the reputation of the organization. As the threat levels increase day by day, the risk of losing your organization’s reputation overnight is also increasing. Being ISO certified can prevent this loss.

Improvements on the internal front:  Allocation of responsibilities and a clear definition of hierarchy is crucial during the growth phase of an organization. A poorly defined hierarchy for the management of information assets can bring internal conflict and confusion. A standard like the ISO 27001 or the ISO 27701 increases productivity in the internal management of a company by clearly setting the objectives and responsibilities of risk management.

Adhering to the requirements of ISO prescribed standards also implies that the organization has effective security measures and gradually decreases the frequency of internal audits.

QRC as a certification body

QRC is a cyber security firm that offers ISO 27001 and ISO 27701 certifications as a part of its services. We are a team of passionate cybersecurity professionals providing multiple Quality, Risk, & Compliance services. We have completed over 2000 assessments with 250 clients in 25 countries with the help of our 200 man-years of experience. We truly believe in the transformative power of Quality, Risk, and Compliance Solutions. We strive to elevate customer satisfaction, engage and inspire people all around the world and increase their ability to secure business.

A brief on our methodology:

We follow a comprehensive methodology for the implementation and certification process:

Implementation Methodology

  • Developing a security policy as per the business requirement for information security.
  • Defining the scope of the ISMS, PIMS, and all aspects of people, processes, and technology are included.
  • Conducting a risk assessment.
  • Identification of risks post the risk assessment and undertaking adequate steps and changes in the management.
  • Selection of control objectives and end-to-end implementation in the organization.
  • Drawing up a statement of applicability.
  • Defining policies, procedures, MRM and awareness training, etc.

Certification Methodology

  • Preparation & Documentation
  • Stage 1 Audit
  • ISMS Implementation
  • Stage 2 Audit
  • Issuance of Certificate
  • ISMS Maintenance And Improvement
  • Annual Assessment

Additional benefits:

There are multiple value additions apart from our unique methodology, by choosing QRC to complete the ISO 27001 or ISO 27701 certification:

  • An increase in brand value, as a result, facilitates agreements with business partners where the processing of PII is mutually relevant.
  • An increase in internal competence as our processes encourage the internal management to prescribe a clearly defined set of roles and responsibilities.
  • Build a clear set of roles and responsibilities for PII controllers and PII processors holding responsibility and accountability for personal data processing.
  • Our methodology integrates easily with any certification recognized globally and supports one-stop some compliance with GDPR and other applicable privacy regulations.
  • Helps to strengthen relationships with existing customers and stakeholders, proving your seriousness of information privacy.
  • Minimize any risk of disruptions of crucial processes and financial losses in association with a breach.

PCI Awareness training and how to go about it

Posted on by admin

The Payment Card Industry Security Standards Council (PCI SSC) which was formed in the year 2004 for the sole purpose of addressing these risks associated with data security, has set a standard to be followed by organizations that deal with sensitive data or otherwise known as authentication information. The PCI DSS strives to protect sensitive data, but a recent survey suggests that most PCI DSS compliant organizations are viewing this standard as a certification process rather than as an opportunity to improve their resilience. In order to emphasize the importance of the PCI DSS standard and to gain a wholesome perspective, PCI awareness training is required in every organization.

Let us look into the “Who, Why What and How?” of PCI awareness training.

Who must take the PCI awareness training?

The PCI awareness training is aimed at the employees of any organization in the payment card industry, but it can be taken by anyone who would be interested in learning about the payment card industry or any organization which must stay compliant with the PCI DSS standard.

The  12.6  of PCI DSS standards states that it is mandatory for an organization that obtains, processes, and retains payment card data to provide annual training for its staff members.

Why does an organization need PCI awareness training?

Let us take a look at the benefits of undergoing PCI awareness training:

1. We are already aware of how being PCI certified can provide a deep understanding of compliance. A PCI awareness training provides important insights way before the organization actually undergoes the assessment and certification process.

2. Through such extended insights, the employees of the organization can gain an understanding of better operational efficiency, aiding in cost management and asset management.

3. Access to know best practices across the industry in advance.

4. Eases in driving compliance and efficiency across the business organization.

What is PCI DSS Standard 12.6?

The PCI DSS 12.6 consists of a Security Awareness Program and Employee Training Requirements. It requires the organization to set up a formal security awareness program to ensure that all the employees are aware of the significance of data security. Below are the requirements of 12.6 PCI DSS :
1) 12.6.1  – Provide data security training for the employees at least annually.
2) 12.6.1.a  – Arrange training through various modes and multiple methods like corporate mailers, web module-based training, training meetings, etc.
3) 12.6.1.b  – Ensure that all the employees attend the training arranged twice, once during onboarding and regularly on an annual basis.
4) 12.6.2  – Take confirmation and acknowledgment from all the staff members that the security policies and guidelines have been communicated and understood by them.

Additionally, the PCI DSS 12.6 also suggests that the training conducted demonstrates the below points :

1. The effect of compliance of PCI DSS and the training requirements are fulfilled annually.

2. To keep implementing better understanding amongst the employees through training to ensure card data is constantly being protected.

3. Make sure that all the staff knows the requirements, roles, and procedures as given by PCI DSS.

4. Ensure that the training provided includes awareness about the financial implications caused by data breaches.

5. Security updates received every month are being communicated in a timely manner through security mailers and tips.

6. The training material includes important documents and policies which have company-specific guidelines on cyber security.

How to implement PCI awareness training?

While implementing a PCI awareness training program, it is to be given utmost importance as it can prove to be a make or break of an organization’s network and cyber governance. The most important task is to decide on a security awareness team as the PCI council has stated that a security awareness team will be responsible for “the development, delivery, and maintenance of the security awareness program”. One quick tip while taking the first and foremost step of determining a security awareness team is to choose people from a different team with different responsibilities as that way the inputs provided will be diverse and various needs of different teams will be taken care of. Once a security awareness team is determined, roles must be determined within the team.

Below are a few important things to consider while arranging a PCI awareness training :

1. Primary emphasis must be given to internal security. When internal security is emphasized, the best practices are demonstrated in a well-defined manner, and this aids while tackling the external threats.

2. Every team in the organization must be given equal awareness about the threats, vulnerabilities present within the organization so that every employee maintains the same state of mind towards cyber risk while at work.

3. The prerequisite to a good training program is well-prepared process guidelines and process documents. Compliance with security standards, certifications, existing threat levels need to be analyzed and reported. Important reports and documents need to be easily and readily available for illustrating the importance of cyber risk within the organization to the employees.

4. The arranged training sessions must be in a timely manner as vulnerabilities are constantly evolving in nature. Planning the training sessions in regular intervals and in accordance with the organization’s important milestones is important. Timing is key when it comes to training.

5. From the very first day of training, make sure that employees take initiative from their end voluntarily to protect the data security of the organization. Cyber risk security tips and awareness must be included in the day-to-day activities of the employees.

6. Holding monthly awareness campaigns with a monthly theme is a good way to implement training without affecting day-to-day productivity. Cyber risk themes like password protection, social network security, etc. can be chosen as a monthly topic for special features.

7. Sending reminder emails with cyber security tips is also an efficient way of implementing cyber security amongst employees. Email newsletters can be sent if any new guidelines are implemented.

8. Intranet portals must be actively used to access the important reports and documents used during the annual training sessions. This way, employees will always have sufficient access to cyber security guidelines.

Cyber Security Governance: Pathway to a Cyber Risk

Posted on by admin

In an organisation which does not have an exclusive cyber security governance program, the management of an organisation must emphasise on the risk assessment primarily as any mistakes in the primary risk assessment process can increase the chances of the risk exposure due to decreased readiness to deal with the consequences. This is the reason a cyber security governance program is essential to any organisation. A cyber security governance program makes sure that there is a continuous process of risk assessment and change in policies.

Cyber Risk and the need for Cyber Security

When an organisation is exposed to certain risk, it means that it is constantly anticipating an event which poses the organisation to certain vulnerabilities and also it means that it must face the consequences or after effects of that anticipated event. Probability is the only saving grace for an organisation exposed to any risk, as it measures the chance of the anticipated event occurring and affecting the organisation. So, when there is an absence of probability, it can be said that the organisation is not exposed to the particular risk and this decreases the chances of dealing with the after effects also. This can be stated as the basis of the relationship between any risk and risk management. Cyber risk and management of cyber risk is known as cyber security governance in an organisation.

A cyber security governance program defines the objectives of cyber risk management taking into view the business objectives simultaneously. With the help of these objectives, a clearly defined plan of action is made and implemented into the processes. This way, it achieves the purpose of strategic management of risks. Information security framework is an integral part of corporate governance and cyber security governance goes hand in hand with it.

Pre-requisites for a Cyber security governance program

If you are thinking of developing a full-fledged cyber security governance program for your organisation, what are the things that must be in your check-list? There are few steps which can be a prerequisite to aid for developing a complete cyber security governance program:

  • Identify the current security posture: The first thought before developing a strategy is to determine where the organisation is in its current security position. While determining the current security posture of the organisation, its level of risk exposure and the policies to risk protection which are currently in practice, needs to be clearly defined and documented. This is crucial for understanding the nature of risks and the gaps in existing policies and processes.
  • Reviewing the basics: In an organisation, cyber security policies and standards need to be implemented at process level. Existing cyber security policies must be reviewed and updated. Policies and standards must be created in case they are not currently documented.
  • Altering the view point: The view-point in which the risk is assessed also makes a difference. Cyber security risks must be approached from an enterprise point of view. This way it is possible to clearly identify the organisation’s critical information and data that needs protection and align with the organisation’s risk appetite.
  • Being risk aware: Training is the key to be risk aware. Information security awareness training must be conducted frequently  as the nature of the organisation’s risks evolves from time to time. It is important to ensure all the resources of the organisation understand the importance of cyber security.
  • Verifying completeness: During the formation of cyber security policies, it is important to consider all the risks that an organisation is exposed to. Internal risks, external risks, risks associated with third parties, constant risks and volatile risks are to be considered.
  • Continuous improvement: This step is an integral part of cyber security governance. It is achieved with regular assessments, analysis of data and updating risk management plans.

Steps to improve cyber security & ways to ease Cyber security governance:

What are the steps to be followed by an organisation to improve its existing cyber security governance program?

  • Constant review of internal cybersecurity policies: This is a strategic step towards dynamic cybersecurity governance. The top level management of an organisation must be aligned with the cybersecurity practices and policies. Cyber security strategies and policies must be given due importance and discussed in board meetings and considered during important decision making discussions. This way, the policies are regularly updated and the status of these plans are available to important decision makers.
  • Gap analysis: It is best to continuously measure where we stand when we want to attain wholesome and secure governance. According to the results from such assessments, a process must be implemented to internally strengthen the cyber security policies in practice. Apart from being aware of the organisation’s procedure, opting to be at par with specified best practices is a smart move to attain good governance.
  • Staying up-to-date: Just as risks evolve from time to time, so do the statutory requirements. Updates regarding cyber risk and compliance must be discussed with the specific advisory opted by the organisation’s management. It is always wise to opt for exclusive advisory services when it comes to cyber risk governance.
  • Cyber security as an investment: Cyber security governance and management of cyber risk must be considered as an important factor during the budgeting. With the increasing cyber risk and growing exposure to data threats, attention and financial assistance becomes a mandate. Cyber security governance is not to be considered as an expense but investment, as it improves the business and its output in many ways dynamically.
  • Keeping business continuity in mind: When we say business continuity, the key factor is incident response. Preparing for incident response is a proactive approach to risk management but is a primary step to good governance. This way, business continuity is ensured and the importance of cybersecurity is reiterated to all stakeholders of the organisation.
  • Awareness training: Awareness training is not just for the internal resources of the organisation but also important to customers and third parties. The training must provide a set of guidelines to be followed by all stakeholders to ensure security practices and security governance is followed.
  • Read more about this: A Go To Guide For Cybersecurity Technique

Cyber Security governance- key to strong risk management

It is of utmost importance to understand the need for compliance and the significance of security as they both are completely different aspects. Both security and compliance are two challenges faced by any organisation, irrespective of its size and the kind of risk management policies adopted. A common mistake done by organisations are, viewing compliance as a tool for risk management, while it is actually just the bare minimum amongst the risk management policies that an organisation is expected to maintain. When basic guidelines are used as a strategy, the objective of cyber risk governance goes for a toss. It is important to understand that compliance is not a standard to be followed, but just a basic threshold to be adhered to.

Cyber risk governance is an aspect of risk management which is to be taken to the very core of an organisation’s business objectives and operations, to achieve a strategy. Vulnerabilities involved in cyber risk and the magnitude of loss caused by data breach improves risk awareness within the organisation. Security and Cyber risk management must be inculcated into the policies, procedures and people to develop a culture of being risk-aware and resilient at business operations.

It is evident that cyber-crime evolves as time and technology evolves. And as business grows, cyber risk also grows. If you have not given cyber security governance a thought, it is high time to bring it as a topic of discussion. Due to statutory requirements, risk management and compliance have been part of organisations since decades now. But cyber security governance is the one thing which can give you that edge over other organisations. We at QRC, are pioneers in Cyber risk and cyber security governance offering cyber security compliance certifications.

12 requirements of the PCI DSS Compliance

Posted on by admin

Electronic payments are all over the world today, owing to the convenience of time and effort it gives to the users. From small vendors to big corporates, are all offering card payments as an alternative payment method to augment their selling opportunities. Nevertheless, a user’s card information is sensitive and to process this information is attached with risk and accountability. Securing this personal data from thefts and frauds is the duty of merchants as per PCI DSS. (Payments Card Industry Data Security Standards). PCI DSS intends to reduce the risk of card fraud and increase the security controls for cardholder data.

What is PCI DSS?

Information relating to Credit cards is extremely vulnerable, as data thefts have turned predominant now. Credit card theft is the second most common type of theft and the amount of fraud by new credit card accounts saw a 48% increase from 2019.

The  PCI DSS  is a compliance standard set for data security requirements concerning the handling, storing, or transmission of cardholders’ data. Leading card brands Visa, MasterCard, American Express, Discover and JCB collaborated to form PCI SSC which is an independent council that maintains and updates PCI standards.

To whom does it apply?

PCI DSS applies globally to all big and small merchants, also the service providers who store, process, or transmit cardholder information. PCI necessitates card holder data, sensitive authentication data to be made compliant by the companies and maintained as merchants use such data. If a payment card carries the logo of any of the above-said PCI’s founding card brands, it must be protected as per PCI DSS.

Requirements of PCI DSS Compliance

PCI DSS is your roadmap to card data security compliance by fulfilling the 12 requirements listed in the standard. Following are the 12 Requirements under PCI DSS for card data securitization.

  • Step 1) Install and maintain a firewall configuration to protect cardholder data– Firewalls are the first line of defence against hackers, so have the firewall and routers configured properly. This firewall must set the rules to what kind of traffics can be allowed inside your corporate network
  • Step 2) Do not use vendor-supplied defaults for system passwords and other security parameters – Remove Vendor supplied default settings for all software, network devices, and servers. Using default settings, usernames and passwords are simple to guess putting access to the device at risk. Upgrade your settings for all devices and maintain documentation for these high-security configurations
  • Step 3) Protect stored cardholder data- Use ‘encryption key management process’ to encrypt card data and protect the encryption keys also. It requires creating a Card Holder (CHD) Flow to document how the cardholder data flows in the organization. PCI demands the use of discovery tools to locate and secure unencrypted PAN and other vulnerable data.
  • Step 4) Encrypt cardholder data transmitted across open, public networks – This step focuses on securing the data in transmission. As the hacker’s eye on the data on the transit, PCI requires encryption of data before transmission.
  • Step 5) Protect all systems against malware and regularly update anti-virus software or programs – Install anti-virus on all hardware and software devices. Make sure that the anti-virus does continuous monitoring and generates logs on a regular basis.
  • Step 6) Develop secure systems and applications – Conduct a thorough risk assessment to implement processes for deployment of technology. It is important to update and patch internet browsers, applications, databases, firewalls, POS terminals, and OS in the card flow path within a month of its release.
  • Step 7) Restrict cardholder data on a need-to-know basis – This step requires having a role-based access control (RBAC). It allows access to card holder’s data only to individuals who need it for business purposes, through keycards and passcodes.
  • Step 8) Identify and authenticate access to system components – This PCI DSS step requires, every individual user to have a separate and unique password and username. Group and shared passwords must never be used. This step helps to trace back the activity in the event of an internal data breach.
  • Step 9) Restrict physical access to cardholder data – PCI DSS directs to have electronic monitoring of entry-exit of file storage and data center locations. These video recordings must be preserved for 90 days and there needs to be a process to identify between employees and visitors.
  • Step 10) Track and monitor all access to network resources and cardholder data – This step mandates monitoring and protection of all network systems with a clear history of activities. These activity logs must be centrally monitored daily, time-synchronized, and maintained for 1 year at least.
  • Step 11) Regularly test security systems and processes – Due to the constant eyeing of cybercriminals, PCI requires merchants to have a continuous process and system testing. Create plans for vulnerability scanning and penetration testing as specified by PCI DSS.
  • Step 12) Documenting and maintaining risk assessments – This step involves creating, maintaining, and implementing a security policy for the company covering its employees, management, and third parties. The policies must be reviewed annually as well.

Consequences of Non-compliance

Theft or breach of card data badly affects the entire payments ecosystem. Here are a few consequences one may have to face for non-compliance with PCI standards.

Penalties – PCI DSS non-compliance can result in penalties from the card companies. Fines depend upon the volume of payments handled by the merchant in question. Penalties may vary from $ 50 per cardholder and peak up to a total of $100,000 per month. The bigger companies that operate with volume frequently get audited for PCI Compliance and they may decide to levy penalties in case of non-compliance.

Revenue loss and damaged reputation -Due to data breach, there can be loss of trust among customers which can lead to loss of credibility and personal fallouts. The business that is lost is the largest consequence of data breach. It is extremely hard to recover from data breaches because the losses get greater than the data itself in such scenarios and impacts organizations for years.

Legal action – Even though PCI DSS is not a legal requirement, in an event of data breach, the affecting parties can take legal action. In 2007, $40.9 M was compensated by TJX for exposing 100 million card holders’ information.

How to Make PCI Compliance Easy and Cost-Effective?

Here we are trying to burst the mythos that  PCI Compliance  can be stressful, expensive, and time-consuming. These are a few things that make sure that your budgets are not hit hard for ensuring compliance.

  1. Install patches and updates regularly to avoid technology and additional staffing costs on the security team.
  2. Train the development team on secure coding best practices. This will reduce much vulnerability from the start and reduce remediation costs.
  3. Keep up with the changing PCI standards. In case you fall short of complying with the latest standards, reassessments are required. Reassessments involve audits which are further time-consuming and expensive.
  4. Send your key personnel on Compliance training courses so that they can understand the most relevant risks that apply to your organization. This further reduces reassessment and audit costs.

QRC as a leading PCI Qualified Security Assessor Company

Being a PCI QSA, QRC helps businesses to highlight gaps in their compliance posture whether it is a SAQs Assessment or the complete  PCI DSS certification, supporting end-to-end in compliance journey with complete confidence.

As a certified PCI Qualified Security Assessor Company, QRC can certify your organization and process for PCI DSS compliance. We also offer other PCI security standards like  PCI 3DS,  PCI SSF  etc. QRC provides these services to give organizations across the globe an edge of being a completely security compliant business organization. Our security assessment services cover all aspects of the technology infrastructure (Web, API, Network, Cloud Assets, Servers)that has helped our clients to streamline data security processes and practices over the years.

Everything you need to know about ISO/IEC 27001

Posted on by admin

This article is part of our ISO 27001 risk assessment  hub page, where we bring together detailed resources on certification, implementation, controls, and compliance. If you are new to ISO/IEC 27001, this guide will help you understand what the standard is, why it matters, and how it helps organizations build a reliable Information Security Management System.

Everything you need to know about ISO/IEC 27001 Certification

ISO/IEC 27001 is an international standard for the management of information security, where ISO stands for International Organization for Standardization. ISO/IEC 27001 is the go-to rule book if you are looking to set up a strong Information Security management system for your organization.

It provides a systemized set of policies and process flows to be used by organizations. The ISMS prescribed by ISO/IEC 27001 helps organizations to protect their information system, irrespective of how big they are and which industry they belong to.

ISO/IEC 27001 Certification : Planning, Process, and Main sections

To be eligible for an ISO/IEC 27001 certificate, a company must succeed in the audit conducted by an accredited certification body. Once this certificate is obtained, it implies that the organization has satisfied all the requirements as per the ISO/IEC 27001:2013 standard.

The pre-requisite to succeeding in the external audit is to optimize or revamp the existing Information Security Management System. The standard lists six steps to create and self-evaluate:

1. Understanding the security controls required for the specific industry or organization and developing a security policy.

2. To get the developed security policy up and going by manifesting clearly defined scope across the various teams, the tasks carried out by these teams, and the technology used to complete the tasks.

3. Organizing a risk assessment.

4. Evaluating the outcome of the risk assessment and identifying the threats.

5. Selecting appropriate controls to mitigate the threats identified and implementing it with proper steps.

6. Modifying the security policy according to selected and implemented controls.

The 3 principles of Information Security Management System: –

The standard lays out 14 controls to achieve the three aspects, which it states as the basic principles to achieve for information security.

•  Confidentiality: Confidentiality is to maintain the organization’s information in private. This aspect ensures providing access to crucial information only to authorized persons.

•  Integrity: Integrity refers to giving rights to edit crucial information only to specified persons.

•  Availability: Authorized persons must have timely access to the crucial information.

ISO/IEC 27001 aims at ensuring the confidentiality, integrity, and availability of information in the organization. Risk assessment of the information, clear definition of needs of the organization, and risk mitigation are carried out step-by-step to achieve this.

The Plan-Do-Check-Act Methodology: –

The standard lays out 14 controls, which can be implemented through a 4-step methodology: Plan, Do, Check, Act. The 14 controls involve guidelines to prepare a information security plan, taking timely actions and doing to prevent data threat and checking the critical aspects at various levels.

Plan:  It provides guidelines on how to plan the information security policies, plan for implementation of well-designed ISMS, and plan of risk management within the human resource team.

Do:  It emphasizes data security within the organization.

Check:  It instructs to check the crucial aspects within the organization.

Act:  This explains the actions to be taken within the organization to prevent data incidents and threats.

14 Key Requirements of Information Security Management System: –

Let us take a look at them.

A.5: Information security policies (2 controls): This control is all about Information security policies. From defining the framework to create an ISMS to documentation of policies and also the method to review it.

A.6: Organization of information security (7 controls):  This control is about implementing the well-designed ISMS. It comprises clear assignment of duties designation-wise for smooth operation of the ISMS.

A.7: Human resource security – 6 controls:  This control defines the steps to be taken for information security during the on-boarding and off-boarding of employees in the organisation. It also involves the aspects of conducting training for awareness on information security, the nature of decisions or actions taken by the management on non-adherence and agreements regarding termination of employees.

A.8: Asset management (10 controls):  This control consists of protection of data assets. The framework to be followed for maintenance of hardware, software and databases. The extent of data integrity and safe handling of data assets are checked by auditors.

A.9: Access control (14 controls):  This control ensures the aspect of confidentiality. It is about limitation of access to specified persons and how the access privileges are managed.

A.10: Cryptography (2 controls):  This control checks the various types of encryptions used (like DES, RSA, or AES) for protection of sensitive information.

A.11: Physical and environmental security (15 controls):  This control checks the measures taken for protection of information from physical factors. All physical aspects such as security systems in the buildings, access to internal equipment, vulnerabilities involving human and natural factors are checked.

A.12: Operations security (14 controls):  This control consists of securing the data with backup and preventing the organization from data loss. It provides guidelines on how to save and store data involving data flows.

A.13: Communications security (7 controls):  This control defines the standard of network and communication services used for ensuring a good standard in data infrastructure.

A.14: System acquisition, development, and maintenance (13 controls):  This control defines the standards of security to be met while the organization acquires new information systems.

A.15: Supplier relationships (5 controls):  This control checks the aspects of the organization’s communication and interaction with any third-party. All the interactions, communication, and extent of access present with any third-party service providers, outsourced personnel and vendors are checked.

A.16: Information security incident management (7 controls):  This control lays out the best practices to be followed to prevent security incidents, handling of a threat and preventing recurrence of such situations.

A.17: Information security aspects of business continuity management (4 controls):  This control is about the aspects of how the organization should handle disruptions, steps for smooth operation of ISMS during a time of crisis.

A.18: Compliance with internal requirements, such as policies, and with external requirements, such as laws (8 controls):  This control provides a check for statutory compliance to the laws laid for the industry in which the organization is operating. It audits and reviews the effectiveness of requirements of the ISO/IEC 27001 standard.

Validity of ISO/IEC 27001:

The validity for the ISO/IEC 27001 certification is 3 years. Regular reviews and evaluation of the ISMS by the senior management of the organization must be conducted internally during this period.

Benefits of being ISO/IEC 27001 certified. Why should you choose this?

The 14 Key Requirements of the ISO/IEC 27001 provides a system of risk mitigation that is rigorous and strong. The follow-up audits, final and most crucial of the three aspects, ensures that your ISMS is constantly evolving along with the threats and the world of digital crime. Having a robust risk mitigation system like the ISO/IEC 27001 means that your organization follows all the best practices and gives an edge over every other organization.

Being ISO/IEC 27001 certified is a sign of reliability, it means you can be trusted with data security. This would be a major reason behind your customers opting you over your competitors as the world today is constantly seeking an assurance for protection of data. It will reduce the cost of sales and boost your sales. Strong risk management increases the maturity of the management as it gives a clear perception of the strengths and weaknesses of the organization. ISO/IEC 27001 suits all organizations, irrespective of the size, industry, and geographical location. Cyber security is one of the biggest challenges faced by business organizations globally.

QRC as a Certification Body for ISO/IEC 27001:

QRC provides a hassle-free solution to getting your organization ISO/IEC 27001 certified by walking you through the comprehensive process. Right from enquiry submission, effort estimation, forming a contract, various stages of audits and assessments leading to the certification and annual reviews following it. As an ISO/IEC 27001 independent certification body, QRC provides these services to give organizations across the globe an edge of being a completely security compliant business organization with streamlined information security management process.

Toyota Breach-Aftermath of Data Breach Catastrophe

Posted on by admin

A couple of months ago, Toyota, the leading manufacturer in the automobile industry, was dealing with an augmenting catastrophe. It was distressing to hear that a company with such an amplitude of resources in diverse fields was heisted of its crucial information. Over a mere period of six months, it fell victim to a series of data breaches in Australia, Thailand, Vietnam and Japan. Toyota itself affirmed the data breach on its official website on 29th March 2019. In this breach, unethical hackers exploited over 3.1 million people’s sensitive data. After a deep-dive into the scenario, the officials concluded that the violation was an outcome of unauthorized access to a server connected to the company’s network.

It was a sign of relief for everyone when the organization announced that no customer credit card information was disclosed. However, Toyota notified that personal information exposed through unauthorized access included name, birth date and employment information. In a manner, the breach did stir up with the parts supplies process, thus resulting in delays at the service brand centre. The Toyota Motor North America (TMNA) ministered the situation, and thus reassured that data breach in no manner affected the customers in the United States.

Commencing in Japan, the cyberattack was strategically organized at eight different Toyota sales subsidiaries or their affiliates, including independent Toyota and Lexus car dealerships in Tokyo. Affected units by third party hackers included Toyota Tokyo Sales Holdings, Toyota Tokyo Motor, Tokyo Toyopet, Toyota Tokyo Corolla, Nets Toyota Tokyo, Lexus Koishikawa Sales, Jamil Shoji (Lexus Nerima), and Toyota West Tokyo Corolla. Amidst all these events, Toyota took a considerable approach. Not only did they publicly apologized to the masses, but also assured their diligence about implementing end to end information security measures at dealers and entire Toyota group.

Be it Toyota data breach or other thousands of data breaches that happen every year around the globe, all of them are directly or indirectly linked to the vulnerabilities within their IT Infrastructure. So this brings us to next question  What are Vulnerabilities ?

The simplest definition states that “The quality or state of being exposed to the possibility of being attacked or harmed“. Vulnerabilities are weakness of IT infrastructure which can be oppressed by attackers granting them access to your database or take control over your system. Let’s get familiar with some of the most common vulnerabilities :

– Security Misconfiguration  – Security misconfiguration vulnerabilities could occur if a particular element within an IT environment is liable to an attack due to insecure security misconfigurations. Security misconfiguration can take place at any level of the application stack, including multiple components like app platform, web server & application server, framework, and custom code.

Example: Unintentional installation of app server admin console and failure of its deportation.

– SQL injection  – This is a code injection technique which spotlights the databases of organization. This type of attack is initiated by releasing a sophisticated and malicious SQL statement as an input to the system. Attackers use SQL injection vulnerabilities to bypass the in place installed security measures, thus achieving their cybercrime goal.

Example: UNION operator is most vividly used SQL injection technique. This facilitates the attacker to initiate the output of more than 2 SQL statement in one single code.

– Buffer overflow attack  -Every database has a transitory area of data storage within its scope which is termed as a buffer area. When an attacker gives input to program in such a manner that data limit is outreached in the buffer area, which results in exploitation of system, it is termed as buffer overflow attack

EX: Heap-based buffer overflow attack is a sophisticated attack which aims at exploiting the buffer area reserved for a program itself, thus resulting in the crashing of program.

– Remote Code Execution  – In remote code execution, the attacker shoots out commands or codes remotely into a system which is physically or geographically inaccessible. This gives liberty to the attacker to intrude remote IT infrastructure and make undesirable modifications.

EX: CVE-2018-8248 vulnerability, also known as Microsoft Excel Remote Code Execution Vulnerability, allows an attacker to run malware on the vulnerable computer.

– SMB –  Server Message Block  protocol is a connection between the client and the remote server. It facilitates a platform where the client can get access to files, printers, serial ports and other resources on a network. Over here, the attackers use the unpatched system to get access to the infrastructure in a multitude of possibilities.

Example: Eternal Blue is a common SMB vulnerability where the attacker execute arbitrary code on the victim machine, as the SMB version 1 is incapable of handling specially crafted packets from remote attackers.

– Local file inclusion  – It gives the attacker the freedom to encompass files on the server via a web browser. This kind of vulnerability comes into the picture when a web application includes a file without verifying the input which allows the attacker to manipulate the input data and rephrase it according to their own convenience.

Example: The attacker can see the content of a sensitive file by replacing contact.php with the path of confidential data. This type of LFI arises when the developer fails to implement appropriate filtering at parsing component of a language interpreter.

– Remote file exclusion  – In this vulnerability, the webserver is intruded through a script, including a remote host file. The remote host file then intrudes the system producing changes as per the attacker’s will. These types of attack generally happen at PHP running websites. In this technique, the attacker can execute code hosted on his machine and get unauthorized access within the victim machine

Example: Custom code infamous C99 is a malicious script used by the attacker for PHP based RFI vulnerability.

As every disaster has an underlying truth and a lesson within itself, this breach also taught us that every organization should be diligent about their cybersecurity controls and measures. We learnt that basic security controls are not sufficient to protect your organization from modernistic cyberattacks. Hence, additional layers of security controls are fundamentals of robust hardwired secure IT infrastructure. The organizations should execute physical, logical and administrative controls to linearize organization safety on a tenacious path. How organizations can pursue such up to date security is by obliging to global standards as such PCI DSS, PA DSS, PCI 3DS, ISMS, GDPR, SOC (1, 2 & 3) and HIPAA etc.

RBI issues new norms for digital payments

Posted on by admin

With rising cases of cyber fraud and security incidents, RBI published a Master Direction providing necessary guidelines stating the directions of security control,” Reserve Bank of India (Digital Payment Security Controls) Directions 2021”  to strengthen the nation’s digital payments architecture, improving the security, control, and  compliance  among banks, gateways, wallets, and other non-banking entities,

The efforts are to regulate security in commercial banks, small finance banks, payment banks and credit card-issuing non-banking financial companies (NBFC). The new set of norms also specifies the criteria under which regulated entities can form partnerships and interact with third-party apps and ecosystem players such as  mobile applications, payment operators and gateways.

The comprehensive guidelines aim to tackle the recent severe rise in digital outages, cyber frauds and data breaches incidents. The control guidelines consolidates multiple vital aspects of the cybersecurity space like:

  1. Governance and Management of Security Risks
  2. Other Generic Security Controls
  3. Application Security Life Cycle (ASLC)
  4. Authentication Framework
  5. Fraud Risk Management
  6. Reconciliation Mechanism
  7. Customer Protection, Awareness, and Grievance Redressal Mechanism

Apart from the General guideline, the directive consists of separate controls namely :

  1. Internet Banking Security Controls
  2. Mobile Payments Application Security Controls
  3. Card Payments Security

With NPCI’s plan to revamp the IT infrastructure across popular payment channels like UPI, IMPS, AePS etc, the latest RBI directives are considered as a crucial update to improve the security of digital payment channels and also customer convenience. The Master guideline aids in setting up a robust governance structure and implementing common minimum standards of security controls for digital payment products and services.

Adhering to the guideline, all the regulated entities (REs) need to update their secure process and policies time to time and place an online dispute resolution for resolving disputes and grievances of customers pertaining to digital payments. In view of a security incident, the financial institutions are expected to inform about the threats and attack against their digital payment product and ensure that precautionary  safeguards  are in place to avoid incidents like ” phishing, remote access, safeguard of PIN, credentials, card details” etc.

RBI has given all the regulated entities to comply within the next six months

Full document here :

Master Direction on Digital Payment Security Controls

About Us:
As a CERT-in empanelled organization    QRC Assurance and Solutions  has been a forerunner on the cybersecurity front, empanelled with CERT-in, certified to provide PCI DSS QSA, PA QSA, PCI 3DS, PCI SSF, ISO 27001, ISO 27701 Certifications along with other security compliance services. As forerunners in Cybersecurity Space, QRC supports our customers to establish, document, implement and maintain Data Security and Privacy frameworks to protect their sensitive data from all Internal / External Threats and manage the confidentiality, Integrity, availability, Security, Privacy of such information systematically.