Karthik Swarnam

Microsoft/CrowdStrike outage: Cyber resilience and risk management perspective in India. The recent global IT outage caused by a faulty CrowdStrike update highlights critical lessons for cyber resilience and risk management in India. As our digital infrastructure rapidly expands, this incident serves as a stark reminder of our vulnerabilities: 1. Single points of failure: Over-reliance on a single vendor or system can have cascading effects across industries. Indian organizations need to diversify their cybersecurity solutions and have robust contingency plans. 2. Incident response readiness: The 6-hour reporting deadline mandated by CERT-In seems challenging in light of such widespread outages. We must balance rapid reporting with thorough analysis. 3. Supply chain risks: The interconnected nature of global IT systems means disruptions can quickly impact critical sectors. Indian businesses must map their digital supply chains and assess upstream/downstream risks. 4. Backup and recovery: Organizations need tried-and-tested backup systems and manual workarounds for critical operations during IT failures. 5. Cybersecurity investments: As the average cost of data breaches in India reached ₹17.5 crores in 2022, robust cybersecurity measures are no longer optional but essential. The National Cyber Security Strategy 2020 provides a framework, but implementation at organizational levels is crucial. As we push towards Digital India, let's ensure our cyber resilience keeps pace. What steps is your organization taking to enhance cyber resilience? Share your thoughts below. #CyberResilience #RiskManagement #DigitalIndia #CyberSecurity Citations: [1] https://lnkd.in/eB-knCCi [2] https://lnkd.in/eAcNN4tA [3] https://lnkd.in/eXqrTAkM [4] https://lnkd.in/eyCKmnzu [5] https://lnkd.in/ecgrqGP8

104

14 Comments

Organizational Cybersecurity Hinges on End-User Satisfaction: The critical role end-user experience plays in organizational security By Amitabh Sinha, CEO and Co-Founder of Workspot In an era of sophisticated cyber-attacks, security leaders are feeling the pressure to […] The post Organizational Cybersecurity Hinges on End-User Satisfaction appeared first on Cyber Defense Magazine. https://lnkd.in/ggFT5zv4

2

In the digital age, cyber resilience is essential for any organization's survival. Discover how Barracuda’s CIO report extends a helping hand to companies of every size, guiding them through the complexities of cybersecurity to emerge stronger, smarter, and more resilient. http://cuda.co/cioreport #CIOreport

2

Current state of MITRE ATT&CK: the essential tool to support the Intrusion Kill Chain Prevention Strategy.: Rick Howard discusses MITRE ATT&CK with Frank Duff, Amy Robertson, and Rick Doten #cyber #cybersecurity #cybersecurityjobs #innovation #management #informationsecurity #technology #cyberjobs

1

The National Institute of Standards and Technology (NIST) recently released its first major update of the popular and well-respected Cybersecurity Framework (CSF). 🔐 🖥 NIST CSF 2.0 broadens its reach, sharpens its focus on governance and supply chain risks, and introduces new tools to enhance your #cybersecurity strategy. Stay ahead of threats with #TeamCAI here: https://lnkd.in/gwS_tgKs

10

1 Comment

A follow up to my previous post regarding the adoption of Rule Amendments to Regulation S-P: Requirements: Incident Response Program ⏰ - Program must be reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information Procedures must include an assessment process related to the nature and scope of an incident, and steps to contain and control such incidents. Establish, maintain, and enforce written policies and procedures requiring the oversight of service providers including due diligence and monitoring. Customer Notification Requirement 📨 - Notify, as soon as practicable but no later than 30 days after becoming aware of unauthorized access, the affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. Notice details must include an overview of the incident, breached data, and how individuals can protect themselves. Additional Rule Amendments ❗ - Rule expanded to cover both nonpublic personal information collected about a covered institutions customers AND nonpublic personal information that a covered institution receives from other financial institutions. The SEC Fact Sheet is linked below.

5

"While recognizing there are inherent risks, we take proactive measures to help strengthen our security protocols and continually improve. Our Secure by Design pledge, SOC 2 attestations, and HITRUST recertification for symplr solutions underscore our dedication to preventing and protecting against future threats by safeguarding sensitive data, recognizing that healthcare systems cannot afford disruptions.” #cybersecurity #privacy #compliance #HIT #security #healthcare #healthcareoperations #hitrust #securebydesign FBI Cyber Division Cybersecurity and Infrastructure Security Agency

16

A summary of requirements from Reg S-P but also good all around practical guidance of how broker dealers ,or any entity, should be preparing for a cyber event and protecting customer information. Planning is critical to resiliency.

37

Protecting India's Critical Infrastructure from Cyberattacks A recent study by cybersecurity firm Sectrio revealed a troubling trend: attacks on critical infrastructure are becoming more sophisticated and targeted. The report analyzed over 300 major attacks and identified a shift in strategy by cybercriminal groups. In 2022, attacks seemed random. However, 2023 saw a rise in Advanced Persistent Threat (APT) groups focusing their efforts on specific sectors, particularly the power grid. The power sector was a prime target, with attacks documented in several countries including India. These attacks targeted various aspects of power companies' operations, including: - Digital pre-paid meters - Remote management systems for wind farms - Stealing customer data (PII) - Direct attacks on the power grid itself Legacy systems that haven't been updated pose a significant security challenge. These unmapped systems create vulnerabilities that attackers can exploit, potentially impacting the reliability of the power grid. The study emphasizes that India is among the most attacked countries in the region. These attacks target various sectors, including utilities, defense, and research institutions. The takeaway? Cybersecurity measures for critical infrastructure need to be prioritized. Upgrading outdated systems, implementing robust defenses, and staying vigilant against evolving threats are crucial to safeguarding essential services. #CriticalInfrastructureSecurity #CybersecurityThreats #APT #Cyberattacks #PowerGridSecurity #IndustrialControlSystems

3

Not to be missed. Executive leadership and board members act fast and register. Cyber-attacks are growing in complexity, frequency and sophistication, thereby requiring better strategy for enhancing cyber security & data privacy. Secure your seat now.

11

In a recent roundtable hosted by Congressman Mark Green, Ivanti CEO Jeff Abbott discussed the evolving landscape of national security with cybersecurity leaders, including Cybersecurity and Infrastructure Security Agency Director Jen Easterly. Their conversation highlighted critical challenges and opportunities, such as expanding the cyber workforce, streamlining government regulations, and integrating security at the design stage of software development. Read all of the key takeaways and strategic insights from this important discussion. #SecureByDesign

1