Author: admin

3 Reasons Why ISO 27001 Certification Will Help

Posted on by admin

It isn’t too tough to open a news website or a newspaper today and miss a breaking story about data hack or a cyber attack around the world.  Matter of fact, this is what pops up right at this moment – ‘World’s leading Crytpocurrency exchange hacked’

Surprised? Many experts aren’t.

Information security is one of the most important pillars of any company and unfortunately, it is one that is given a miss way too often also. Using a specification that would secure your information system could make all the difference though – like an ISO 27001. This would be a framework of policies and procedures that would include all the legal, physical and technical controls that would be involved in your information risk management.

Having an  ISO 27001 certification  would be a very strong foundation to your information security. In fact, it could also bring about the biggest difference to your business and your employees too. How?

  • Keeps client data secure: As it should be, your employees should be protecting the data that belongs to your client. However, it is also critical to understand that your organisation holds plenty of employee information. Knowing that their data is protected at all times would make all the difference to them. They would be 100% that no data leakage or theft would be possible if a ISO 27001 certification is done. This is simply because it requires to have a centrally managed framework to keep any information secure.
  • More work, more responsibility: Let’s be honest now, everyone wants to walk up the career ladder and you can help your employees do just that by adopting ISO 27001 in your organisation. If your company were to follow a certification like this, it would only give your clients and prospects more confidence in your operations. The fact that you would commit to information security would give you a competitive edge and that positive growth in work would rub off on your employees too. Undoubtedly, an achievement of this kind would be a deal winner for your sales team during their pitches. More work, more growth, only means happier employees.
  • Job security: Having information security and processes in place helps employees control any form of data breaches. A breach of data could be catastrophic for one’s job and that risk is taken care of when you have a certification of this sort. Plus, you could lose a potential customer because of a data breach and that could have implications with jobs within the company. Also, learning the do’s and do not’s of such a certification would give your employees better experience helping them to achieve more in their career.

When you think about the advantages that are at hand by simply implementing a  ISMS certification  – it is quite obvious that employees would want it to be a part of their working environment. Would you be looking to bring that advantage to your business too?

Does Business Need PCI DSS Readiness Assessment?

Posted on by admin

Understanding the need of PCI DSS in your industry is the first step towards securing your business. The amount of risk is tremendous without it. Not too long ago, massive retail chain Target revealed that credit and debit card information of 40 million customers had been compromised in a cyber-attack. Such an attack can have disastrous impacts on the business of a huge brand like Target – let along imagine the consequences to deal with in a smaller company.

Before you even look at analysing if your business needs PCI DSS, you need to know what a standard like this does to your business. In the simplest form –

  1. It builds and maintains a secure network
  2. Keeps all the cardholder data and information safe
  3. Prepares strong access control measures all the time
  4. Analyse and review a vulnerability management program
  5. Test the networks regularly
  6. Maintain a policy towards information security.

Pre-analysis of your compliance

Now, to have this implemented, you first need to schedule an official PCI audit which would validate your company’s compliance. This is called a PCI DSS gap assessment and will uncover any security issues that may be present. Apart from this, a self-assessment questionnaire would deeply help understand if such a system would be feasible for your business too. To do this, you need to

  1. Review your existing infrastructure right from the network to the access control.
  2. Understand where your cardholder data is stored, processed or transmitted in your system.
  3. Create a baseline scope or present status for the PCI compliance.
  4. Identify the difference between the scope and the requirements

Many businesses miss out the key benefits of having such a certification. One of our clients (newly formed small-business), wanted to look at having PCI DSS gap assessment done for their business. Of course, they had compliance issues and up-scaling their present infrastructure would cost them a lot of money.

As per recommendations, a  PCI DSS Gap Assessment  was done which saved them the entire upgrade – plus implementing the changes on this gap assessment, we were able to change many controls which not only simplified their annual assessment but also reduced the costs that were attached to it.

A simple assessment can go a long way in not only creating a better structure within your business, maintaining quality but also in saving you or your client a lot of money. Moreover, being compliant gives you a huge advantage over other competitors too as well as gives your clientele a lot of confidence in your services. If you are looking for an assessment of this kind, reach out to us and we’d be happy to help.

How to Measure your Enterprise Risk Management

Posted on by admin

One of the most common questions asked in our industry is ‘How can we accurately measure your enterprise risk management effectiveness’?

Heard it too? Well, we are not surprised. It is one of the simplest questions to be asked and let us tell you, there is no simple answer. When you have so many different beams at work within and external to the company that determines the organisation’s goals – how would one plan to measure the success of  enterprise risk management? At the end of the day, does it not depend upon the decisions the company’s management takes? Would such a risk management have a meaningful difference? Here are ways you can measure its effectiveness –

  1. Follow the right metrics:  To understand the success of such a management system, you need to first note down the goals and then look at the right metrics to know if they’re being met. What could an objective be? Well, reducing performance variability to a level which aligns to the company’s reputations and the goals. An even better metric would be to update risk management capabilities continuously in the surrounding business environment. Keep a goal to achieve based to track an ‘early mover’ advantage and then look at the specific implantation to rate success.
  2. How would your business react to an unforeseen event? :  It is one of the most common misses in the industry today. We tend to look at all that is green that we forget a potential risk. In case your company was to lose its biggest revenue source – a strategic perspective applied to operation risks focuses towards the entire value chain. The organisation’s readiness to such an event needs to be checked and focussed on at all times. The success measure would be to navigate through the unexpected loss and the routes to overcome it.
  3. Is ERM integrated in your core processes? :  Unless it is integrated in your business, you’re not going to get great differences. A keen look at the company’s strategy setting, annual planning, budgeting or capital expenditure with ERM would be a must. Not only would it bring in more engagement from the right people, it would also intensify the success parameters and goals.
  4. Identify the risks at the right time:  If your ERM is focussed on noticing the possible risks at the right stage and inform the key stakeholders about it – it would be the right to be followed and implemented. The way to measure success would be to look at the steps taken to rectify or address the risk detected. Early warning systems would use data analytics, stress testing and scenario analysis to monitor risks and assess the impact on performance.
  5. Improving the shareholder value:  The most important goal for the board and rightly so too. A firm with an effective ERM should be able to acknowledge the capabilities and highlight them the right way. In case your company’s reputation grows because of the risk management – you should be able to show higher share valuations.

With these parameters, you should be able to determine if your  enterprise risk management  is effective and driven the right way. If you have been thinking of implementing such a management in your company or even check the effectiveness – we’d be happy to guide and help you achieve your goal.

 

GDPR Compliances for an Indian Companies

Posted on by admin

The European Union (EU) is known for its strict regulations when it comes to data privacy and information security. The systems need to comply with their guidelines in order to function in the EU. Recently, the EU has introduced a set of regulations for the protection of data processing and free movement of data pertinent to natural persons residing in the EU. These regulations are known as the GDPR and are it has extraterrestrial applications. Which means that any entities processing or moving the data of the EU residents need to comply with the GDPR. This has far-reaching implications for foreign entities such as Indian companies in the data processing space.

The impact of GDPR on Indian companies is profound. The Information Technology industry in India is widespread and a large number of companies find themselves in a place where they need to comply with the GDPR to conduct transactions with the EU. So let us take a look at what Indian companies need to achieve in order to work with EU residents in the data sector.

The EU explains GDPR as, “The General Data Protection Regulation 2016/679 is a regulation within the European Union and the European Economic Area that pertains to data protection and privacy for all individuals. It also identifies and addresses the export of personal data outside the EU and EEA areas.”

Here, ‘personal data’ refers to the information related to an identified or identifiable natural persons. Which means any entity with an identification, security numbers, genetic identification, or any specific form of identification is considered a natural person. So any information pertaining to a natural person who is a resident of the EU is considered personal data under the GDPR.

For any foreign entity, such as Indian companies, dealing with the personal data of the EU residents, it is imperative to ensure that their systems are compliant with the GDPR norms and the data protection requirements are in place. This means that most Indian companies need to redefine their privacy policies and bring about certain pertinent changes in their system.

Also Read –  5 ways to remain GDPR compliant in 2019

It is not only important but lawfully stipulated that companies comply with the GDPR stipulation as the penalties for non-compliance are severe in the EU law. It can prove to be an invitation to penalties up to 10,00,000 to 20,00,000 euros or 2-4% of the global turnover of the previous financial year, whichever is higher. Most EU companies insist on  GDPR compliance  as a standard contractual clause so as to ensure complete security of their data. Indian Government is also looking at updating and introducing laws to ensure stronger data protection compliances and guidelines for Indian Companies. Meanwhile, it goes without saying that any company in India which is looking at working with the EU needs to update its data protection policies in order to continue its business transactions. Currently, the trends in the GDPR compliances beg the question of how Indian companies are preparing for this switch. For this, the following questions need to be pondered upon-

  • What is the data footprint of Indian companies in EU?
  • Are Indian companies equipped and prepared to provide evidence of GDPR compliances to the stakeholders who may request them ?
  • Do Indian companies have a holistic understanding of what data is collected and how it is used and processed?
  • Is there a defined roadmap for GDPR compliances?
  • What cross border data transfer strategies are we adopting as Indian organizations?

In a recent seminar titled, GDPR: Post Implementation Review, the following points were discussed to make the compliances more relevant-

  • Global Privacy Challenges: The seminar addressed global security challenges beyond GDPR and addressed the fact that while GDPR is important, it not an answer to all problems. Given the recent developments in countries like Brazil and India, the companies recognized privacy as the new normal, and decided to work to build efficient programs to address privacy challenges.
  • Maintaining a Culture of Privacy Awareness: A key concern for most business is to maintain a culture of privacy in their organizations. Because of how some people view GDPR as a checklist to be completed rather than an ongoing responsibility, this concern was discussed at length.
  • Territorial Scope: Various companies struggle to identify the territorial scope of GDPR given that it only applies to EU residents. However, a lot of North American businesses now abide by GDPR as a company policy rather than a mandate for EU.
  • GDPR and Future Privacy Challenges: With the advent of Ai, Machine Learning and Big Data, companies have struggled to interpret the application of GDPR in the global scenario.   This discussion lead to the future challenges of GDPR that will require innovative solutions.

While this may seem like a lot of information, the right guidance can help you with these compliances. QRC solutions has a team of experts who guide and help you acquire the  GDPR certification  without much hassle.

PCI DSS Guidelines To Combat Against Card Skimming

Posted on by admin

According to The Payment Card Industry Data Security Standard (PCI DSS), businesses carrying out their transactions online are mandated to maintain certain guidelines in order to safeguard the interests and data of their users. These guidelines combat various issues such as data theft, hacking, fishing, and even card skimming.

Card skimming is the theft of credit card data by attaching external devices to card reading devices in the public and covertly stealing the card data and passwords for later use. This is a form of credit card fraud as these people monitor legitimate credit card transactions and steal the credit card information by the use of small external devices such as cameras or scanners. Usually, all of this data is stored in a plastic card’s magnetic stripe. The devices used for skimming or theft of the credit card data are known as card skimmers. These skimmers are a form of cameras or scanners which are placed over the card readers of public card machines or ATMs, and when any transaction is carried out, they record the card details and passwords in another plastic card via the magnetic stripe and clone the credit card. This way, they can use a credit card without the consent of the owner.

In order to avoid incidences of card skimming, the PCI DSS has requirements in place which give instructions on how to avoid incidences of credit card fraud.

The  Requirement 9.9  in PCI DSS standards for security against physical access, that explicitly states, “Protect devices that capture payment card data via direct physical interaction with the card from tampering and substitution.” Which implies that businesses require to ensure that their card reading devices need to be protected and monitored from tampering of any kind and special attention needs to be paid to ensure that there is no substitution of devices of any sorts.

In detail, the Section 9.9  asks businesses to make a list of all the devices they own, inspect the devices frequently, and train the security personnel to detect and be aware of suspicious behaviour. These guidelines are recommended but not mandatory. However, given the recently increased instances of criminals using skimmers to steal credit card information, it is strongly advised that businesses take PCI DSS recommendations very seriously.

Recently, there have been various instances of card skimming where criminals have been caught with hundreds of cloned credit cards and skimming devices to further their crimes. A couple of Romanian criminals was recently caught by the police with an external skimming device attached to a public ATM in New Delhi, along with a small camera and various plastic cards. They intended on recording the passwords of the credit cards as they were entered and then entering all of this information on the plastic cards that they owned. Thankfully, these criminals were arrested before they could cause any problems. PCI DSS allows a framework to businesses to ensure that they are protected from such theft and criminals who skim credit card data. These guidelines are key to secure and safe transactions without having to worry about any kind of theft or fraud.

QRC Solutions allows you to ensure the  PCI DSS compliances  in order to ensure that your business is safe against card skimmers. With the guidance of the experts, it is imperative that your business will be secured from any credit card frauds that may occur.

PCI SSC’s First Ever Security Forum In India

Posted on by admin

13th March’19, mark the date on your calendar because it’s going to be a day of networking and educational sessions at the 2019 India Forum in Delhi. The PCI Security Standards Council is going to hold its first ever India Forum in Delhi providing you access to tools and information to secure payment data. The forum and the sessions will provide deep insight into the world of payment security, thus helping you to understand the latest trends and techniques in the industry. Leaders from PCI Security Standards Council would also give their insight on the future of the industry.

QRC Solutionz is one of the leading partners to the event and would be present to understand your challenges and discuss hot topics in the industry. Our leaders would be happy to brainstorm with you on your industry concerns and understand how steps toward a safer payment space can be attained.

PCI compliance is undoubtedly, the need of the hour for every payment related company in the country today. Credit card data is such a valuable target and data being compromised can lead to huge losses.

At QRC Solutionz, we always advise our clients that achieving  PCI compliance  with an initial audit is not the roadblock – but maintaining the compliance is. More so since the changes in the ecosystem are continuous – what you may have perceived as a complaint-safe system may well differ in the next few days. This is specifically why it is of utmost importance to be updated constantly on the industry happenings.

We constantly push our goals higher so that we, along with our partners, are not just checking boxes to be compliant, but to implement and maintain effective network security – ensuring that you are always compliant.

QRC Solutionz’s diverse clientele ranges from fortune 500 companies to startups in India and the silicon valley. Our detailed approach helps our clients understand the benefit of being constantly compliant and reaching out to the next level of security understanding. There’s a big gap that is present today between the requirement and the genuine need of the industry and that is exactly what we aim to close.

So, let’s chat up and delve into the finer details of payment security and it’s processes at the 2019 India Forum. Looking forward to an interesting conversation.

Everything You Need To Know About Data Protection

Posted on by admin

India took a massive step with its own data protection act last year when the Srikrishna Committee shared its assessment and suggestions on data privacy and management. It is a great sign for the country as it solidifies the support that is envisioned for customers – especially keeping India’s digital economy in mind. This act will keep a set of privacy laws, policies and procedures in place to ensure that there is minimum encroachment in to any person’s privacy. This will include the storage, extraction or breakdown of data.

The first question that pops here is the line that is drawn on personal data – it is classified as any data that can be used to related or identify the person either from the government or from a private entity. Many people do raise questions on our fundamental rights to privacy – but take a check, that is not patently granted by the Constitution of India.

Looking at Section 43A of the Indian information technology act 2000, an organization that is in possession, dealing or handling sensitive information or personal data and is negligent in the implementation or maintenance with the pre-required security will be liable to pay for damages. Do note that there is no upper limit to the to the compensation that can be claimed in such an event – the damages can be put out to any extent.

What qualifies as personal information?

It is important to note that passwords, financial information that may contain the bank or credit card account details, health conditions, sexual orientation, history of medical records and biometric information all fall under personal information or sensitive data. If there is a breach of this data, action can be taken against the firm and they would be liable to pay damages to the person affected.

It is also vital to note that according to section 72A of the Indian information technology act, 2000, disclosure of this kind of sensitive information without consent or if is against a contractual agreement can lead to imprisonment of upto 3 years or a fine of 5 lakhs or both.

Of course, there are conditions at which these rules are relaxed. As per section 69 of the act, there is a general rule of maintenance of privacy and secrecy of the information and an exception on release of the data is necessary. These are,

  • The Sovereignty or Integrity of India,
  • The Defence of the country.
  • Security of a state.
  • Request from a foreign state
  • Public order or
  • Preventing incitement to the commission of any offence that may relate to the above or as an investigation.

In such an event, the government can deem to access or monitor the data or have it decrypted or stored in a computer resource. This data has to be divulged in interest of security and the government may require disclosure of such information. This can include national security, breach of law or fraud.

Can the Government interfere with data?

Now, under section 69 of the IT act, an authorized Government officer can be specially authorized by the Government – to intercept, monitor, decrypt, or cause to be intercepted or monitored, information that is transmitted or received or stored. The scope of section 69 of the IT act allows this for the purpose of investigation of cyber-crimes too. This allows the Government to block access to sites that it may deem dangerous too.

What is the penalty for damage to computer or computer systems under the IT Act?

As per IT Act Section 43, there would be a penalty without an upper limit for

  • Accessing or securing access to a computer or computer network.
  • Downloading or accessing data that may include information or data that is held in a removable storage medium.
  • Damage or cause of damage to a computer or a network.
  • Introduction of contaminant or virus into a computer or a network.
  • Causing disruption to a computer or network.
  • Denies or causes of denial to a person who is authorized access to a computer or a network.
  • Tampering or manipulating a computer or system would mean liability to pay damages by compensation to the affected.
  • Destroying or deleting information in a computer resource.
  • Concealing or altering data or source code used for a computer resource with the intention of causing damage.

As per section 65 of the IT act, the above actions shall be punishable with imprisonment of up to 3 years or with fine of up to Rs 2 Lakh or both.

Also, section 66 of the IT act states that if a person by any means of fraud referred to in section 43, can be punishable with imprisonment for a term of up to 3 years or a fine of Rs 5 Lakh or both.

The data protection act is without doubt one of the most required points in our digitally enabled country today. With more access to computers and networks, it is a must to be implemented today.

Why Invest In Vulnerability Assessment Penetration

Posted on by admin

When we make a checklist of all the risks that may cause turbulence to our business, we often forget the damage that can be caused by a cyber-attack! Not just that, most companies even ignore the fact that it is a constant investment too – leading to them not improving their security processes each year. The common problem that most companies have is to understand the risks that may be present. How do you do that? With a  vulnerability assessment  of your business!

A test of this kind would show the kind of weaknesses that exist in your company and how they can be exploited. These weaknesses could be because of ignorance, mistakes or just plain lack of attention.

To understand if the internet security is acceptable or stable for usage, a malicious attack is usually self generated or simulated. This is called penetration testing. Either of these methods can be used on a wired or wireless network which the program to penetrate could even be a mobile application. Of course both these testing processes would require a meaningful investment and here is why –

  • Understanding the errors in programming that maybe a possible risk towards cyber attacks.
  • Implementing these standards would secure your IT networks from attacks both internally and externally.
  • Create and implement a methodical approach towards risk management in the company.
  • Keep your entire business logic away from IT networks
  • Indentifying opportunities for ROI on IT security investments
  • Keep your business away from financial or reputational downfalls.

Why would your business be vulnerable?

Wrong programming practices would the first and sole reason and the second reason would be configurations errors of these programming practices. If you have your routers, switches or servers that are not configured right or have gaps in security – it would be extremely for a break into your internal system.

How can a vulnerability assessment help?

With a vulnerability assessment, you would be using a technical approach to find the gaps that lie in your network or software security system. This is completely a process of repeated searches for errors. Upon a single process, you would be able to see the vulnerabilities and the severity level for each of the problems. How would you explore and exploit a vulnerability in your system though?

Penetration testing to assess the damage

Penetration testing  would help you go deeper into the vulnerabilities that were highlighted. You would be sure of the vulnerability and know what damage can be caused to your application or network. Do keep in mind though that this process is very intrusive and can cause a lot of damage to your systems – hence you need to be very cautious and plan it out perfectly.

How do you choose between both?

The answer to this question is quite simple – you need both. You need to analyse the risks that are present first and then figure out the level of damage that can be done with keep such risks at hand. They both go hand in hand towards a more secure system and as per ISO 27001 you need to prevent the exploitations of any technical vulnerabilities that may lie on your system. Simply put, the need of the hour is to have both techniques on your system to ensure there are no gaps.

5 Ways To Remain gdpr Compliant In year 2019

Posted on by admin

GDPR compliance has been one of the most talked about changes over the last couple of years. Even though the deadline was in May 2018, it is obvious that investment in the compliance is a continuous process. In fact, reports even suggest that investments over the next 14 years could go up to $2.1Billion. It is also important to note the risks in case you are not compliant are quite expensive also and could be one of the reasons that many organisations are looking to implement it into their business.

So, if you are looking at getting  GDPR certification  into your business, how do you go about it? What do you have to keep in mind when you want to follow these guidelines in your company?

  • Automation Technology:  Investing in automation is key for every business today, precisely because it manages costs better, improves quality and ensures consistency throughout. With mammoth data in place for most companies, you need automation to keep track of all this data. You need to know where and how the data you have can be adapted and processed – this is where artificial intelligence comes to play. You would be able to break down data so much easier and that makes all the difference to your business at the end of the day.
  • Required privacy laws and data governance:  Before you look at implementing a compliance in your business, it is critical to understand why you have to implement it as well as the governing rules you need to follow. Creating a set processes of all that is done is the simplest way to implement every kind of compliance. Plus, keeping it as a mandate would only help.
  • Where is your data moving?  There’s a lot being said about data lineage today and that makes perfect sense when you are implementing this kind of compliance – you need to know where your data is transformed over the course and where it is stored.
  • Maintenance of data:  The main goal of GDPR certification is to ensure that any individual has control over their personal data. If your business is becoming GDPR compliant, it is important to understand what data is working towards keeping the data safe. It is vital to store the data that is absolutely important for the running of the business to keep risk away.
  • Looking at the bigger picture:  You need to constantly look at the value you are getting by being compliant to GDPR – this will reduce direct costs and create an efficient audit ecosystem. You would be able to manage & track the information that is passed on throughout the system and thus be able to track and make important business decisions.

While there would be an initial investment to being your business on board – you need to look at the bigger picture and see the return on investment at every cycle. There is no doubt that a compliance of this kind will give your business a chance to thrive.

HIPAA and Data Sharing Resharing Both For Digital

Posted on by admin

Understanding the costs that are linked with delivering great service levels in the IT industry is extremely important in the healthcare industry today. Among all aspects of the IT industry, data security probably ranks as #1 in the priority list. The simplest way to keep your data safe in the IT industry is by following  HIPAA compliance  – The Health Insurance Portability and Accountability act sets the standard for sensitive patient data protection and ensures that companies which have protected health information secure their physical network and keep all possible security measure.

Any entity that provides treatment, payment or any form of operation in healthcare have to meet this compliance as a mandate in the USA. Over the last few years, we have seen how cyber security has been the strongest point of threat for several businesses and any form of leakage or damage can be critical. It can in fact bring the entire business down permanently.

What are the right measures you can take to protect data?

The information that you possess are stored as emails, databases, library files etc and can there maybe several data access points for this. The biggest threat lies in the fact that this data is to be backed up and stored. Now, most of these companies do not protect their SaaS data with a backup or a recovery solution leaving them prone to troubles in case of a server failure or hacking or even malware. This is a huge threat – as  the data can be hacked into easily.

When you follow HIPAA compliance– you are completely sure of having this data protected by having your data backed up. Some of the most common practices to follow   in  HIPAA certification  are

  • Create policies on using and accessing workstations, electronic media as well as data access points.
  • Having a policy in place to ensure there are restrictions for transferring, deleting or adding data using any form of electronic media.
  • Ensuring there is no transferable data devices that could be used in the premises.
  • Having access control lines across the floor as well as towards the data that is present via the network.
  • Enabling unique user Ids, emergency access procedures, auto log off sessions, encryption and decryption of data.
  • Tracking those who access was granted to and random checks of the details looked at. Auditing or tracking logs on hardware as well as software platforms.

It is also mandatory to have integrity controls and measures to make sure that the data is destroyed. Having an IT disaster recovery team will ensure that any failures this kind can be rectified immediately and that patient health information is recovered accurately. Many outsourcing companies put these compliances as a mandate for all their projects as a security guideline. So, if you are in the space that looks at getting work from corridors in the healthcare industry, it makes perfect sense to have this compliance instilled in your organisation.