Category: IS audits

Trust is the bedrock of successful business relationships. It’s an element that must be nurtured well in advance of any customer engagement and remains paramount to enhance an organization’s reputation and market position. Customers are more likely to engage with companies they trust, and this trust is an asset that can take years to build but can be shattered in an instant. That’s why businesses must prioritize compliance and accountability as fundamental building blocks for trust.

Compliance involves adhering to laws and regulations, while accountability demands taking responsibility for actions and decisions. In this post, we will delve into how compliance and accountability contribute to trust-building with customers and offer guidance on achieving these goals effectively.

The Impact of Compliance and Accountability on Trust: 

Maintaining trust with customers is pivotal to long-term success, especially in the digital age where trust is formed and broken without physical interactions. Compliance and accountability are central to fostering a culture of trust within organizations. Examples of Trust Erosion due to Privacy Lapses:

1. A customer receives multiple calls from various financial institutions immediately after approaching their bank. This intrusion into their privacy raises doubts about data security.
2. Customers grow tired of their web activity being tracked and sold for relentless marketing across apps and browsers.

Digital Trust: In the era of digitization, trust has transitioned from face-to-face interactions, handshakes, and physical signatures to the digital realm. A study by ISACA underscores the importance of digital trust, with over 76% of respondents considering it extremely or very important for digital transformation. This highlights the significance of building and maintaining trust in retaining and expanding the customer base.

Compliance and Accountability:  Compliance in a business context encompasses adherence to laws, regulations, and ethical standards specific to the industry and location. It spans various areas, including legal obligations, data privacy, financial reporting, employment practices, and environmental protection. Accountability, on the other hand, signifies taking responsibility for actions and decisions by:

• Acknowledging their impact on the organization, stakeholders, and the community.
• Holding others accountable for their actions.
• Going beyond mere compliance to make ethical decisions and owning their outcomes.
• Creating a culture of transparency, integrity, and trust.

Challenges in Compliance to Digitized Regulations:

1. Exponential Data Growth: Data has grown significantly over the last decade, but poor security practices still expose organizations to data breaches.
2. Cost of Maintaining Data Privacy: Breaches can result in severe regulatory penalties. For example, companies dealing with European customer data can face fines up to 4% of Adjusted Gross Revenue or €20 Million. Similar regulations like GDPR, DPDP, HIPAA, and CCPA emphasize data protection.
3. Increasing Data Breaches and Vulnerabilities: Social engineering attacks, human errors, and external actors contribute to the rise in cyber threats.
4. IoT and Mobile Concerns: Security professionals are increasingly worried about IoT security.
5. Human Error Complexity: Everyday errors can significantly impact data privacy and security.

To enhance Customer Trust through Accountability for Compliance, you need to implement the following within the organization:

• Addressing digitization-related challenges.
• Establishing a robust governance model with well-documented roles and responsibilities.
• Developing and implementing clear policies, processes, and SOPs.
• Cultivating a culture of transparency, integrity, and ethics.
• Conducting regular training and awareness programs.
• Ensuring fairness, growth, and risk management.
• Monitoring and testing the compliance ecosystem.
• Conducting regular audits and reporting findings transparently.

Benefits of Accountability for Compliance:

• Increased Customer Confidence: Demonstrated commitment to ethical operations instils customer confidence.
• Improved Reputation: Accountability maintains a positive reputation, emphasizing transparency and honesty.
• Reduced Legal Risk: Compliance reduces the chances of legal issues and penalties.
• Better Employee Morale: Prioritizing accountability creates a culture of integrity and responsibility, boosting employee morale.

Building trust with all stakeholders, including customers, employees, third-party service providers, and regulators, is essential for an organization’s success. Trust hinges on compliance with rules and regulations, data privacy, accountability, a culture of integrity, and social responsibility. It’s a long-term process that, when approached diligently, paves the way for a thriving organization.

Check how your organization measures Trust building.  Check points with  YES/ NO/ Partially Yes

1. Do you conduct customer/ employee satisfaction surveys?
2. Do you track customer service / employee workplace issues raised ?
3. Do you monitor customer/ employee retention?
4. Do you monitor customer/ employee behaviour?
5. Do you conduct internal review of trust related practices?

In today’s increasingly interconnected and digital world, safeguarding sensitive information is of paramount importance. Whether it’s personal data, intellectual property, or financial records, ensuring information security is crucial for both individuals and organizations. While a voluntary approach to information security might seem appealing, it often falls short of the comprehensive protection required to meet the ever-evolving threats in cyberspace.

Here are some key reasons why relying solely on a voluntary approach is insufficient for information security compliance:

1. Inadequate Incentives:
   A voluntary approach relies on organizations and individuals to take the initiative to implement information security measures. However, without legal requirements or regulations, there may be little incentive to invest in robust security practices. Many organizations prioritize cost savings over security, potentially leaving their data and that of their customers at risk.
2. Varied Levels of Compliance:
   In a voluntary system, adherence to information security best practices can vary widely. While some organizations may take the issue seriously and invest in robust cybersecurity measures, others may cut corners, leading to an inconsistent and fragmented security landscape. This creates an uneven playing field, where the least secure organizations put their customers, partners, and themselves at risk.
3. Lack of Accountability:
   In a voluntary approach, there is no clear mechanism for holding organizations accountable for security breaches or data leaks. This lack of accountability can lead to a culture of negligence when it comes to safeguarding sensitive information. The absence of legal consequences for non-compliance often allows organizations to escape serious repercussions, even when they fail to protect their data adequately.
4. Rapidly Evolving Threat Landscape:
   Cyber threats are constantly evolving and becoming more sophisticated. A voluntary approach may not keep up with these changes effectively. Mandatory information security regulations, on the other hand, can be updated more swiftly to address emerging threats and vulnerabilities.
5. Consumer Trust and Reputation:
   In today’s data-driven economy, consumers are becoming increasingly aware of the importance of data protection. When organizations don’t adhere to robust security standards, it erodes trust and can damage their reputation. Customers are more likely to do business with companies that can demonstrate their commitment to data protection through compliance with recognized standards and regulations.
6. International and Industry Standards:
   Many industries and countries have established information security standards and regulations to protect their citizens and businesses. A voluntary approach may not align with these existing standards, leading to potential conflicts, confusion, and difficulties for organizations that operate internationally or across multiple sectors.

While a voluntary approach to information security compliance may have its merits, it is not a sufficient or reliable strategy to protect sensitive information adequately. To address the evolving challenges and threats in the digital age, a more comprehensive and legally mandated framework is necessary. Strong information security regulations provide a clear roadmap for organizations, ensuring that they meet essential security requirements and are held accountable when they fall short. This not only protects individuals and organizations but also fosters a more secure and trustworthy digital environment for all.

According to recent studies, organizations are shifting their approach to compliance risk management from treating it as a separate vertical to integrating it under operational risk management. This approach allows organizations to assess and measure risk based on residual risk, and focus on the most critical weaknesses. With increasing globalization and complex regulatory compliance requirements, managing compliance risk under the umbrella of operational risk has become essential. This integration also simplifies compliance testing, which can be a challenging task for many organizations.

Digital transformation : Factor-in the current and future trends

All organizations are seeking to get maximum value from their digital transformation. The Covid-19 pandemic has changed the way of business/operations, disrupting and giving opportunity to find new ways to face challenges by adopting to different business models, forcing to move to digitization, which means adoption of digital enablers like Artificial Intelligence (AI)- which includes Machine learning, Big data analytics, Robotic Process Automation (which requires Business Process Mapping to address overlapping process and creating process families), Internet of Things, Cloud/hybrid cloud, operating technology, augmented reality etc.

With a lot more efficiency coming into the system, regulators have also adopted these digital enablers. The above regulatory welcome change makes the corporates to improve and strengthen their compliance function using a more structured approach and digitization to avoid increasing penalties and fines (financial and non-financial) on non-compliance to regulations for their organizations as well as engaged 3rd parties. Although these enablers and technology are used in business growth and compliance, they usher in newer technology related risks, which must be mitigated. For example data/ information security and privacy related risks were not prominent earlier, they have become increasingly prominent in this age of digitization and have necessitated the need for Organizations to change and manage Compliance risk as newer regulations emerge from various regulators.

Data Privacy & security- another factor in the current and future trends

By year-end 2024, Gartner predicts that 75% of the world’s population will have its personal data covered under modern privacy regulations and predicts that large organizations’ average annual budget for privacy will exceed $2.5 million by 2024.

Adopting and implementing some cyber security related audit standards, using standard tools, certifications etc. have become the necessity of the day instead of just adopting these for regulatory purposes.

As an example- let us examine the context of the bank card end-to-end process. The process, if examined in depth, involves not only the Bank, but involves many 3rd party service providers such as card producers, payment gateway facilitators (which may be using cloud), settlement & reconciliation related facilitators etc. As these, 3rd parties may be in one jurisdiction or involve multiple jurisdictions, it becomes necessary to have the regulations driving this universe analyzed, audited under one umbrella- this task is extremely difficult.

Compliance requirements in the current environment moving rapidly to a digitized business environment

The technology operations (involving compliance to many regulations) require tools and audit to mitigate the risks. Organizations  use Security Operations Centre (SOC), Privilege Access Management (PAM), Network Access Management (NAM), Firewalls etc. for their IT infra and warrant the engaged technology 3rd parties to have these in place to mitigate risk and regulatory compliance. Further, using ISO framework/ NIST framework etc. strengthen the organizations to strengthen their IT infra with detailed audits for gaps and controls. Certifications of these agencies help the Organization to satisfy the regulator as well as retain their existing customer base. Additionally using tools like VAPT help organizations to assess the vulnerability and penetrations by rogue players against their IT infra defences  systems.

Data aggregation, data management, data analytics, data security etc. have assumed significant levels – although primarily one looks at these from an Operational risk perspective (which includes compliance risk), one requires to understand that above mentioned data related aspects accompany a lot of regulatory/global standards compliance requirements.

Some examples to address the above concerns on data/ information are say PCIDSS (on card data) HIPPA (for health records/ data of patients), GDPR (for personal data protections) etc. which are standards used globally.

QRC Services:

QRC Assurance and Solutions as an organization has worked extensively on addressing issues emerging from the current and future compliance requirements. Some of the audits/ tools provided by QRC Assurance and Solutions include:

– PCIDSS (Card Holder Data), HIPPA (ePHI), GDPR (PII) appropriately for Organizations to assess and address the gaps resulting from data security and privacy related at the People, Process and Technology of the organization as well as any engaged 3rd party providers.

– Conduct Audits on prescribed data security/ privacy standards by various regulators such as RBI, NABARD, IRDA, UIDAI, SEBI, SWIFT etc.

– Perform Vulnerability and Penetration Testing Scans using various techniques including Black box, Grey Box, White Box Testing.

– Perform configurations audits to assess the technology and systems related gaps.

QRC Assurance and Solutions offers QRCAssist, a centralized platform that provides effective compliance management System and Self-Assessment tool (SAT) to organizations to help them evaluate/ assess their status of Compliance vis-à-vis various standards/ regulations.

Creating a secure organization is a complex and vital aspect for any business or organization, that requires a systematic approach. Organizations must take a step-by-step approach to build secure processes and systems with the help of appropriate people, process, and technological controls. Building a secure environment is not a one-time event but a continuous process that requires a systematic approach.

Step 1: Assess the Current Organization Risks

The first step in creating a secure organization is to assess the current state of security within the organization. Main part is to identify and assess the risks that the organization faces. As a starting point, this assessment should consider all business functions of the organizations and their corresponding dependent outsourced functions if any.

Identify the assets that need to be protected, the potential threats that could compromise those assets, and the likelihood of those threats occurring. Once the risks have been identified, organizations can then take appropriate measures to mitigate them. Once the current state of security has been identified, the organization can then develop a plan to address any identified vulnerabilities and risks.

Step 2: Implement Appropriate Controls to Mitigate the Risks

The second step is to implement controls to protect assets. These controls can be grouped into three categories: people, process, and technology.  These controls should be designed to mitigate the organization’s risks, while also considering the organization’s unique needs and requirements.

• People controls include policies and procedures that ensure that employees are aware of their role in maintaining security and that they understand their responsibilities. Example of People Controls such as employee training and awareness programs, as well as background checks and security clearances for employees etc.,
• Process controls include procedures and guidelines for how the organization handles sensitive information and how it responds to security incidents. Process controls include things such as security policies and procedures, incident response plans, and business continuity plans.
• Technology controls include physical and digital security measures such as firewalls, intrusion detection systems, and encryption.

Step 3: Monitoring and Review

The third step is to monitor and review the organization’s security posture. This includes regularly review, Test and update the controls to ensure they are still effective in protecting the organization and they are functioning as intended and that they are keeping the organization protected. This includes reviewing policies and procedures to ensure that they are up-to-date and effective, regular security assessments, penetration testing, and vulnerability assessments to identify any new vulnerabilities etc.,

In addition, organizations should also establish a culture of security within the organization. This includes educating employees about the importance of security and the role they play in maintaining it. It also includes holding employees accountable for adhering to security policies and procedures.

Step 4: Continual Improvement.

The final step is to continuously improve the organization’s security posture. This includes staying informed about new threats and vulnerabilities, identifying new risks, and implementing new controls as needed.

Conclusion:

In conclusion, creating a secure organization requires a systematic approach that involves identifying risks, implementing controls, monitoring, and continuously improving the security posture. Organizations should take a step-by-step approach and should not hesitate to seek the help of experts in the field if needed. Remember that security is an ongoing process, and it’s important to be proactive and keep your organization’s security posture current.

We at QRC, are pioneers in Cyber risk and cyber security governance  vary from industry to industry. It is unique in its way and so is how each organization handles the risks they are exposed to. This is one of the main reasons why there is a need to execute cyber security with deep analysis. The nature of cyber security in the Petrochemical industry is extensive in nature, starting from the core source of supply from the oil pipelines through the refineries to the point of sales at gas stations. The kind of risks faced throughout this process are high-level risks that can cause the functioning of the company to collapse completely. It is also referred to as “Enterprise risk”. So how to achieve the objective of cyber resilience in such a situation…?

Read through to gain a comprehensive insight into the risks faced by the Petrochemical industry, sources of cyber threats, current industry-specific guidelines prescribed for cyber security, and best practices to achieve better cyber resilience.

Current challenges faced by the industry

A quick look into previous incidents of the data breach: a few events reported in the past:

• 1.  May 2021, USA: It is known as the hack that took down Colonial pipeline company, the largest fuel pipeline of the US, leading to a shortage across the East coast due to a single compromised password. A ransom note demanding cryptocurrency appeared on computer screens and was spotted by employees.
• 2.  July 2020, USA: The National security agency and the Cybersecurity and infrastructure security agency of the US alerted the world about cybercriminals hacking into critical infrastructure across the country.
• 3.  Feb 2020, USA: A pipeline company was attacked. HMI was affected resulting in the forced shutdown of a gas-compression facility station and other upstream-downstream facilities, for two full days.
• 4.  2017, the Middle East: The notorious Triton virus attacked the controls and security of a petrochemical company resulting in multiple shutdowns and halted operations over several months. The Triton still affects a lot of systems.
• 5.  2019, Mexico: Pemix, Mexico’s state-owned oil company was attacked by ransomware resulting in the forced shutdown of systems across the country. The perpetrators demanded a ransom of a Bitcoin worth five million to unencrypt the systems.
• 6.  2017, Ukraine: The Not Petya attack on a Ukrainian facility resulted in the shutdown of the country’s power grid.
• 7.  201
• 0, Iran: Stuxnet is used in damaging an Iranian nuclear facility. Responsibilities have risen for the energy sector’s top executives and Board members to navigate the big challenge of cyber security.

Analysis of various factors creating vulnerabilities:

Surface attacks due to the nature of systems:  Attackers take advantage of any openings that are available to them. The systems in the Petrochemical industry are such that it requires increased availability of data for better efficiency of operations and for gaining from situational awareness. This, in turn, increases the surface area of attacks and potential exposure to vulnerabilities. So, systems are available to them and attackers are opportunistic.

Attacks due to technological advancements:  The large and ever-increasing numbers of mobile phones, tablets, and all the other devices with access to operational systems for input, payments in the gas stations, and other ease of operations at various stages of production. These are all possible entry points for attackers. Other technological advancements like the Internet-of-things, metering infrastructure will keep on arriving on the scene and creating vulnerabilities for newer cybercrime. Technological advancements also mean cybercrime advancements.

Attacks due to human error in operations:  IBM research suggests that 27% of cyber-attacks in the industry are a result of human error. Thus, when it comes to tactics against data and privacy breaches, it must include employee and staff training, clear well-established practices and policies, and fixing employee roles & responsibilities. Owners should establish cyber-security roles and these employees/individuals must develop and educate other employees on policies and procedures.

Cyber-security and safety policies must integrate human elements with the control system especially in system usage, maintenance, updates, etc. The policies must also address personal devices since misconfigured devices are vulnerabilities and easy targets.

Attacks due to ease of access:  When it comes to the Oil and Natural gas industry, the physical aspect plays a major role. Networks must be segregated from the area of active operations and access has to be separate. For example, it is best practice to keep IT, operations, and security separate from the rest of the production unit. Access to the whole system should not be made available to all and sundry at a time. Even if the area of production is infiltrated or compromised, the whole system should not be exposed. Another common trap for operators is that of forgotten control systems which are at risk of attacks.

Attacks due to the nature of authority in the industry:  Despite increasing and diverse risks in the Petrochemical industry, awareness, and stakes, the majority of the management and executives still believe that they are not directly responsible for security. It is mistakenly believed that cyber safety is the responsibility of a separate department, they see it as an aspect that is separate from the main functions. Or that the threats are unavoidable due to the nature of the industry. There can also be a belief that it is not possible to counter the diverse threats, that there is not enough expertise, tools, or charters to counteract the attacks. This can lead to complacency among non-IT stakeholders, making the job of the IT team more difficult and also creating blind spots which can be exploited. Cyber-security must be regarded as a shared responsibility of all stakeholders, especially all employees in a company, from top-level executives to front-desks.

Existing guidelines and standards for cyber security:

The industry’s standard-setting bodies are- Department of Commerce’s National institute of standards and technology (NIST), the Department of Energy (DOE), and other U.S. and international standards-setting bodies. Programs such as the ISA/IEC 62443 Series of Standards on IACS Security and the DOE Cybersecurity Capability Maturity Model (C2M2) in association with the above-mentioned bodies help organizations in implementing the standards. Some of the standards are –

• 1. ISO 270001
• 2. API 1164
• 3. API Standard 1164
• 4. Department Of Energy Cybersecurity Capability Maturity Model
• 5. International Electrotechnical Commission’s IEC 62443
• 6. International Organization For Standardization ISO 27000
• 7. Content unique to pipelines not covered by NIST CSF and IEC 62443 is being currently updated.

Strengthening cyber security:

1. Segmentation of control systems architecture:  Compartmentalizing lessens the access and prevents baring the whole system to attackers. Keeping critical infrastructure and business systems on different networks is essential for minimizing risk. Additional segmentation can also be considered to protect critical assets. The key concern here is not allowing access to the whole system when one area is attacked or compromised.
2. Continuous evaluation and enhancement:  Policies, procedures, and control systems have to be consistently and continuously evaluated and improved. Training must also be evaluated and enhanced regularly. Constant vigilance is a key to protecting against internal and employee errors. It is easier for timely detection and correction.
3. Professional analysis of systems and their impacts:    The following factors have to be considered, namely
   1. Cost,
   2. Value,
   3. The company’s policy framework towards cyber-threat i.e is it a policy of transfer of risks or a policy of mitigation or a policy of acceptance,
   4. Investment areas,
   5. Funds allocation,
   6. Technological infrastructure and
   7. Expertise is available.

Read more about this: Cybersecurity Compliance and e-Rupee: Need for Strong Measures

The analysis must be made not only in the initial stage but companies must keep routinely analyzing, keep adapting, and building on technological advancement and complexity.

1. Computer control systems and computer security are not tangential:  Control systems and security systems must always be considered in tandem. Consider cyber-system controls and cybersecurity in tandem. Cyber-security and cyber-resilience are best achieved when implemented across the entire system design and planning process.
2. Control systems are considered as assets:  Systems are just as important as other tangible or intangible assets like pumps, pipelines, equipment, brand, etc. that require routine maintenance, replacement, improvements, and audit/evaluation.
3. Being part of guilds/groups:  As of now, there is the Oil and Natural gas Information Sharing and Analysis Centre. It is an industry group of private intelligence sharing regarding cyber-threats.

1. Awareness:  Staying alert and aware cannot be emphasized enough. There are many resources available like the website of the US Department of homeland security which actively publishes about various vulnerabilities. Owners must stay ahead and address the emerging and diverse concerns before cyber-criminals take advantage of them.
2. Following standards:  The generally accepted practices and frameworks have to be implemented and followed meticulously. Some of them are ISA 62443, NIST 800-82, and the cyber security framework of the American Petroleum Institute.

1. Compartmentalize and segment control system network architecture:  This lessens access and keeps business systems on a different network than critical infrastructure. Consider additional segmentation to protect critical assets and prevent hackers from accessing the whole system if they find a way into one area.

Overview of the cyber resilience principles by WEF :

Cyber resilience principles for the oil and gas infrastructure companies, as outlined by The World economic forum are as follows:

1. Cyber resilience governance –  policies and systems must be planned and implemented beginning at the governance level, since security counts on organization-wide participation from the management to the grassroots level. Aligning all the efforts and fixing accountability is fundamental to the success of the system.
2. Resilience by design –  Cyber-security need not be a separate department to be individually planned and implemented. It can be included as a design parameter and as part of the corporate culture. It will significantly improve the outcomes and effectiveness of the security system.
3. Corporate responsibility for resilience –  Recognizing and accepting that diverse, frequent, and ever-advancing threats cannot be prevented and that they will continue to occur or at times escalate to a huge threat is helpful, since it enables companies to be proactive and take responsibility and initiative. It is the first step in managing risks.
4. Holistic risk management approach –  as is the case of any risk management, cyber resilience and management require a mandate, funds, resources, and accountability. In this sector, it is important to mitigate risks to all parts of the value chain so that one weak link doesn’t bring production to a halt.
5. Ecosystem-wide collaboration –  Weak points in defense security may lie outside an organization too. Efforts to share cyber threat information, use of best practices, and improve cybersecurity maturity across the whole sector help industry-wide stability.

Ecosystem-wide cyber resilience plans –  As mentioned earlier, recognizing that cyber-attacks will continue to occur, organizations should build resilience plans to help mitigate damage from those organizations that have succeeded. Regular cybersecurity exercises enable them to test and improve defenses – including how they will cooperate with other industry partners.

A couple of months ago, Toyota, the leading manufacturer in the automobile industry, was dealing with an augmenting catastrophe. It was distressing to hear that a company with such an amplitude of resources in diverse fields was heisted of its crucial information. Over a mere period of six months, it fell victim to a series of data breaches in Australia, Thailand, Vietnam and Japan. Toyota itself affirmed the data breach on its official website on 29th March 2019. In this breach, unethical hackers exploited over 3.1 million people’s sensitive data. After a deep-dive into the scenario, the officials concluded that the violation was an outcome of unauthorized access to a server connected to the company’s network.

It was a sign of relief for everyone when the organization announced that no customer credit card information was disclosed. However, Toyota notified that personal information exposed through unauthorized access included name, birth date and employment information. In a manner, the breach did stir up with the parts supplies process, thus resulting in delays at the service brand centre. The Toyota Motor North America (TMNA) ministered the situation, and thus reassured that data breach in no manner affected the customers in the United States.

Commencing in Japan, the cyberattack was strategically organized at eight different Toyota sales subsidiaries or their affiliates, including independent Toyota and Lexus car dealerships in Tokyo. Affected units by third party hackers included Toyota Tokyo Sales Holdings, Toyota Tokyo Motor, Tokyo Toyopet, Toyota Tokyo Corolla, Nets Toyota Tokyo, Lexus Koishikawa Sales, Jamil Shoji (Lexus Nerima), and Toyota West Tokyo Corolla. Amidst all these events, Toyota took a considerable approach. Not only did they publicly apologized to the masses, but also assured their diligence about implementing end to end information security measures at dealers and entire Toyota group.

Be it Toyota data breach or other thousands of data breaches that happen every year around the globe, all of them are directly or indirectly linked to the vulnerabilities within their IT Infrastructure. So this brings us to next question  What are Vulnerabilities ?

The simplest definition states that “The quality or state of being exposed to the possibility of being attacked or harmed“. Vulnerabilities are weakness of IT infrastructure which can be oppressed by attackers granting them access to your database or take control over your system. Let’s get familiar with some of the most common vulnerabilities :

– Security Misconfiguration  – Security misconfiguration vulnerabilities could occur if a particular element within an IT environment is liable to an attack due to insecure security misconfigurations. Security misconfiguration can take place at any level of the application stack, including multiple components like app platform, web server & application server, framework, and custom code.

Example: Unintentional installation of app server admin console and failure of its deportation.

– SQL injection  – This is a code injection technique which spotlights the databases of organization. This type of attack is initiated by releasing a sophisticated and malicious SQL statement as an input to the system. Attackers use SQL injection vulnerabilities to bypass the in place installed security measures, thus achieving their cybercrime goal.

Example: UNION operator is most vividly used SQL injection technique. This facilitates the attacker to initiate the output of more than 2 SQL statement in one single code.

– Buffer overflow attack  -Every database has a transitory area of data storage within its scope which is termed as a buffer area. When an attacker gives input to program in such a manner that data limit is outreached in the buffer area, which results in exploitation of system, it is termed as buffer overflow attack

EX: Heap-based buffer overflow attack is a sophisticated attack which aims at exploiting the buffer area reserved for a program itself, thus resulting in the crashing of program.

– Remote Code Execution  – In remote code execution, the attacker shoots out commands or codes remotely into a system which is physically or geographically inaccessible. This gives liberty to the attacker to intrude remote IT infrastructure and make undesirable modifications.

EX: CVE-2018-8248 vulnerability, also known as Microsoft Excel Remote Code Execution Vulnerability, allows an attacker to run malware on the vulnerable computer.

– SMB –  Server Message Block  protocol is a connection between the client and the remote server. It facilitates a platform where the client can get access to files, printers, serial ports and other resources on a network. Over here, the attackers use the unpatched system to get access to the infrastructure in a multitude of possibilities.

Example: Eternal Blue is a common SMB vulnerability where the attacker execute arbitrary code on the victim machine, as the SMB version 1 is incapable of handling specially crafted packets from remote attackers.

– Local file inclusion  – It gives the attacker the freedom to encompass files on the server via a web browser. This kind of vulnerability comes into the picture when a web application includes a file without verifying the input which allows the attacker to manipulate the input data and rephrase it according to their own convenience.

Example: The attacker can see the content of a sensitive file by replacing contact.php with the path of confidential data. This type of LFI arises when the developer fails to implement appropriate filtering at parsing component of a language interpreter.

– Remote file exclusion  – In this vulnerability, the webserver is intruded through a script, including a remote host file. The remote host file then intrudes the system producing changes as per the attacker’s will. These types of attack generally happen at PHP running websites. In this technique, the attacker can execute code hosted on his machine and get unauthorized access within the victim machine

Example: Custom code infamous C99 is a malicious script used by the attacker for PHP based RFI vulnerability.

As every disaster has an underlying truth and a lesson within itself, this breach also taught us that every organization should be diligent about their cybersecurity controls and measures. We learnt that basic security controls are not sufficient to protect your organization from modernistic cyberattacks. Hence, additional layers of security controls are fundamentals of robust hardwired secure IT infrastructure. The organizations should execute physical, logical and administrative controls to linearize organization safety on a tenacious path. How organizations can pursue such up to date security is by obliging to global standards as such PCI DSS, PA DSS, PCI 3DS, ISMS, GDPR, SOC (1, 2 & 3) and HIPAA etc.

COVID-19 pandemic has largely affected the way industries used to operate. A major portion of the industry has moved on to hassle adoption to remote working. These changing and emerging trends in operations and information systems have made it critical for management and stakeholders to understand new organizational challenges and have collaborative solutions to defend against the growing cyber threatscape. The pandemic has gifted attackers and even nation-state groups in leveraging the situation for targeted campaigns.

As an organization, it is important to adopt resilience and prioritize cyber preparedness along with the key mission-critical activities. Cybersecurity Risk can be overwhelming, considering the potential of disaster. Threat actors are always seeking new doors and move in to plunder your most valuable asset, your Data

The rush to digital adoption in these uncertain times for organizations that have relied on legacy technology is currently facing an unprecedented issue when it comes to cybersecurity risk management.

1. How to determine the newly evolved cybersecurity posture.
2. How to efficiently direct their resources to mitigate the risks posed by the gaps.

Managing these form a key portion of an effective cyber risk management program, evidently essential during this pandemic time in an increasingly digital world.

1. Deep Dive In Your Current Cybersecurity Posture And Identify Your Security Gaps with the “new normal”
   Organizations need to analyze their critical infrastructure as to how their security posture has changed. Especially critical services sectors need to fast pace on this aspect and the leadership needs to identify the new change since any failure in identifying the new blind spots will lead to potential losses.

   Identifying your current posture is especially the most difficult part of the information security management process. The leadership with a clear understanding of the impacts of security risk and willingness to expose even their failures in implementing a secure digital transformation initiative are of immense value.

   Organizations can refer to voluntary frameworks like the  NIST Cybersecurity Framework.  These frameworks will aid the CISOs in understanding where they stand by assessing the compliance and security controls defined by these frameworks. The leadership should focus on building a cyber risk strategy by identifying risks across multiple aspects of the technology and operation, while planning along with the organization’s objective.

2. Mitigate the Security Gaps by Improving the current Process
   Identifying the current gaps is one part of the process, after that the team should focus on closing the gaps disclosed in the most efficient way possible. Mitigation of these gaps does involve a lot of fuss and activity namely the email chains, the Q& A session with multiple teams, and the spreadsheets.

   In these scenarios, the leadership should step in and communicate the stepwise approach and optimize the entire workflow by using audit-ready templates and automation. Prioritizing risks effectively and efficiently by the best-known practices must be the forte as they aid in combating the known threats in multiple areas of business continuity and security. CISOs and CIOs need to standardize processes that can be implemented rapidly.

   Prioritizing the mitigation process and implementing resilient systems will help in understanding accurate data and making informed decisions for cyber risk management activities.

3. Facilitate Adoption of New Technologies and Effective Processes, promoting Culture ChangeEven in dire today’s situations, the pandemic has thrown an opportunity for a massive paradigm shift in working culture which would have taken longer to adopt under normal circumstances. But switching to new technologies isn’t just sufficient for managing the cyber risk efficiently. As an organization,the management will need to focus on translating the cyber risk in terms of business in this era of digitization.

   Roles like Digital Risk officers can serve for assessing the risks related to new products and services in the truly digital age along with focusing on the areas of cyber risk and compliance management aligned with the business goals. The organizations should seize this opportunity in creating a clear, concise, and actionable cybersecurity program and support their efforts to build cyber resilience.

   Following the three-step process,  organizations can align their cybersecurity goals and fix their cybersecurity posture to avoid a fallout during an unforeseen security incident. With a clear understanding of the requirements and use of modern solutions, organizations can measure the impact of cybersecurity compliance and  risk management. The leadership should focus on building a culture of cybersecurity resilience and productivity.