Data security is most important requirement to the customers or user. If the organisation wants to run a business successfully, they need to give surety of data protection as it gives customers the assurance that their data is being collected, processed, and transferred through secure mechanism. Data is most critical and important for businesses of all sizes, from a small start-up to a global conglomerate and so is data privacy.

Data is information processed by a computer system and stored in a system known as server. This information may be in the form of text, image, documents, audio clips, software programs, patents, financial information, secret information, health data, personal information or other types of data.

Every organisation collect data with different mediums either by old traditional method or by modern digital methods. Be it hospitals, banks, companies, government departments etc data is everywhere. Processed data is known as information.

Sometimes a set of data can formulate a sensitive information, so Data privacy is a mechanism to maintain our privacy online, because information is a highly value asset and sought-after commodity by malicious users and cyber criminals. As an end user it is very essential to know what is happening with our online information, what can be done with the data or who all can have access to it. Users often give their consent and allow companies to track and store their data can have disastrous results, so one should have a say in the matter.

Normally organisation focus on the risks originated hackers and cyber criminals, however this is much more than this. Protecting your data privacy is as significant as managing your data security.

Firstly, and fore mostly, Data Privacy is an arm of data security and its motive is to safeguard the data from unauthorized access. Data privacy aims to the proper handling of information based on its significance-

• Regulatory requirements and data privacy laws
• Consent of the data owner
• Privacy Notice
• About the public expectation of privacy.

Main objective of Data privacy is to safeguard the users’ data as per the regulations and users’ rights. Main factors to consider are:

• How to collect and share the data legally
• Whether to data can be shared with the third parties and identification of the third parties with whom data can be shared.
• Adhering to the regulatory compliance and laws limits such as-HIPPA (Health Insurance Portability and Accountability Act), GDPR (The General Data Protection Regulation), GLBA (The Gramm-Leach-Bliley Act), CCPA (The California Consumer Privacy Act), ECPA (Electronic Communications Privacy Act 1986),Personal Information Protection and Electronic Data Act (PIPEDA) and so on. Different countries have different data protection regulations and all these regulations have their own set of rules and legislation pertaining to a specific area, purpose, and type of companies or individuals.

In a nutshell this means protection of critical user information primarily PII (personally identifiable information) of an individual:

PII consists of: – 

• Full Name,
• Address,
• Contact details,
• Date of birth,
• Social Security Number
• Bank Account Number
• Driving License Number
• Some more personal information such as an-
• • IP address,
  • Profile photo,
  • Social media post,
  • Financial Information
  • Medical Information
  • Location
  • And many based on regulatory compliance.

Importance of Data Privacy and Data Security for Business

 Data privacy and security helps in protection of customer’s data privacy.

It helps reduction of the number of information security incidents like data breaches that an organization can suffer.

• It is helpful in maintaining, improving and retaining brand value of the business.
• It is helpful in safeguarding the business from hefty penalties for violating the rules. Regulators impose huge penalties in case of data breach which could be few thousand dollars or a big part of revenue generated, and it’s different for various types of data breach incidents.
• Data sharing will be limited and identification of third party would be done on prior basis according to the risk level of data.
• It saves the organisations from the theft of data by hacker or cyber criminals, that can cause enormous monetary losses
• Data privacy limits the access of customer’s critical data and hence safeguarding the right of customers to be free from uninvited surveillance
• This helps the organisations to keep track of their data breach records and organisations can learn lesson in order to avoid future recurrence.
• Now a days most of the business run on customer’s critical data safeguarding the privacy expectations should be priority of the organisation.
• It helps the organisations from loss of revenue.
• It is also provided competitive advantages to business.
• Last but not the least it is helpful in adherence to the strict policies of how PII is collected, accessed, protected, and erased.
• Data security and privacy controls are helpful in enhancing company’s reputation and built customer trust.

Importance of Data Privacy for Users

• It provides assurance from unauthorised access of data.
• It will keep customers personal, health and financial information safe.
• It generates a trust value for the customer.
• It provides a legal right to the end user or customer to challenge the company in case of any data breach.
• Data can only be collected by receiving consent from the users.
• Companies which collect the data provides data security guarantee to the end user.

Tips and Tricks to help protect your personal data

Data privacy is such an important issue, nowadays many government organizations and companies spend a good part of their revenue each year to help protect their data—which could include your PII (Personally identifiable information)—from exposure. As an end user may not be able to implement high end security solutions to safeguard their personal data, however there are inexpensive ways whichyou can take to help protect your data. Below are a few suggestions:

• Use strong passwords for your online accounts also avoid having same password for multiple accounts. Change password on regular basis.
• Chane the default password for your home network devices, especially Wi-Fi device. A weak password is easy to guess and any unauthorized person can connect to your network with malicious intent.
• Avoid clicking on any random link received via mail or message, these can have malicious links which will give access of your device to cyber-criminal who could eavesdrop your network traffic including personal data.
• Don’t ever share your personal details like bank account number, credit card detail, social security number, Aadhar card number etc over call.
• Avoid writing your personal details like phone number and address at public platform unless necessary. This could sometimes be very dangerous if accessed by any cyber criminal.
• Avoid sharing too much personal information on social media platform.
• Always use security setting on social media accounts, which you can always secure your accounts by changing in Privacy settings. Always keep your social media count in most private mode in order to avoid disclosure of personal information.
• Use VPN (Virtual Private Network) for online activities, however avoid the freeware for financial transactions.
• Share your personal details over the websites which are using encryption.
• Carefully shred all the personal document, receipts, bank statements and your courier packaging as well before discarding.
• Use genuine software on your system.
• Install antivirus and anti malware.
• Always keep firewall on.

Data Protection regulations and laws of different countries are developed and designed in order to maintain the data privacy of the citizens of that particular country. There are many countries where data privacy is already in place, however there are countries where there are no such laws. Having a framework for data privacy and security will definitely safeguard the critical information. A set of defined roles and responsibilities, network security controls like firewalls, secure configurations, Intrusion detection and prevention systems, monitoring, logging the activities, having proper procedures and processes in place of conducting any activity like access provision, de-provisioning, change management, patch management, backup management, privilege access management, physical security management etc certainly provide a more secure environment to data and information systems. Expectation and responsibilities of third-party service providers also plays critical role in data security. Technical controls should be according to the organisations risk appetite and relevant regulations.

Although cyber criminals are inventing new techniques to intrude into the networks but using encryption techniques will help the data in non-readable formats.

 Data is the most precious asset for both organisation and customer, a vigilant consumer and an organisation with adequate resources, diligent employees, regular monitoring, proper governance, periodic reviews can safeguard their information assets and maintain data privacy and security.

#Keywords,-Data security, data privacy, encryption, Cybercriminals, hackers, GDPR,HIPPA,GLBA , CCPA , ECPA ,PIPEDA, password protection, network security, patch management,

]]> http://www.cyberlaws.org/how-organisations-can-ensure-cyber-security-during-remote-working/ Sat, 03 Apr 2021 16:12:16 +0000 http://www.cyberlaws.org/?p=667 HOW ORGANISATIONS CAN ENSURE CYBER SECURITY DURING REMOTE WORKING

Global pandemic has entirely changed the work culture of the organisation, while over 75 percentage  of the private sector employees are working from home and rest of the employees are working remotely at least once a week  percent of global employees work remotely at least once per week and willing to work from home more often if their job permits.

Presently, most of the organisations including start-ups ever are offering the option to work from home because of the serious health threats to the employees and to ensure the business continuity.Top managements and business leaders from all sorts of companies including the start-ups are recognising the benefits of permitting remote work for their companies

Previously, most of the organisation’s weren’t set up to work remotely, and most of the time prefers working on office premises only,but, the COVID-19 pandemic and resulting lockdown of many countries mean that many companies and their employees are now mostly full-time working from home (WFH).

Keeping business continuity in focus organisations allowed remote working, however the cyber security and information security has become a serious concern. One side work from home option has reduced commuting time for employees, more liberty for workers and even increased productivity, on the other side there are cyber security risks and challenges that come with allowing their employees to work from home or from any remote location.

What are the Risks of Work from Home/Remote Work?

Data security and cyber security is paramount, while work from home. Organisations need to have secure communication channels to access their Information systems hosted on premises, some organisations mainly start-ups may face operational risks such as not being able to support a huge number of simultaneous remote connections to their infrastructure and IT services. This could be troublesome for employees that need access to internal resources for business support and may even place additional burden on IT teams if they’re not properly prepared.

While this is a business disruption risk, and can cause unnecessary stress for an IT department that’s already overworked and overburdened trying to fix the issue on-the-go. Which could lead to the risk k of not properly implementing access, authorization and authentication policies which may result in employees accessing resources that they shouldn’t.

In order to reduce the risk of unapproved remote access to organisation’s Information Technology infrastructure, IT teams and information/ cyber security teams shall make it explicit which applications, services and VPN clients are supported by the organization IT infrastructure. Any unauthorised attempt to access internal Information Technology infrastructure with illegitimate and unknown tools should be treated as a cyber risk and blocked immediately.

Since many companies have a well-defined and strict IT and Information security policy for centrally managing and deploying software. Security patch updates to endpoints, gradual rollout procedures should be designed for deploying those updates. Delivering them all at once to remote devices connected with secured VPN technology, could create bandwidth traffic jam and affect inbound and outbound traffic. Data backups of individual laptops could be a tough task if backup servers are hosted inside the premises. Last but not least, enabling disk encryption for all endpoints should be a priority as it minimizes the risk of having sensitive data accessed or compromised due to unauthorised access or device theft.

Cyber Security Guidelines for Work from Home?

1. Having a Teleworking/Work from Home Policy

First and foremost, thing -Define “Remote,” “Work from Home” or “Teleworking” policy is a must if your organisation or start-up is allowing employees to work from home or locations outside of the office premise. This policy shall establish a set of procedures and guidelines that employees must follow in order to work from home. will reduce the inherent risks of working remotely since the organisation and employees are explicitly aware of the WFH responsibilities and its consequences.

Teleworking/ remote working policy shall include:

• Employee responsibilities
• Procedure of reporting of information security incident.
• Approval process from remote connections
• Workspace security mandates.
• System configuration/ hardening steps
• Use of encryption for data stored and in transit and Ensure encryption is used for all data that is stored and in transit
• Mandate use of a secured channel such as VPN for remote workers

2. Information security training’s to Top management and employees.

Conduct periodic monthly or quarterly training sessions to keep your employees and top management aware and educated on cyber security and information security risks and their responsibilities when it comes to organisation’s information security program and working from home.

Basic cyber security drills shall be conducted on regular basis and organisation’s information security awareness program shall be updated accordingly. Employees shall be aware of phishing attacks, spam mails as well as securing home Wi-Fi network.

Each and every employee shall be aware about the risk of using public Wi-Fi for organisation’s system. Employees should be aware whom to contact in case of any cyber security incidents.

Top management is more prone to cyber security attacks. They shall be adequately trained.

Organisation shall assess the Information Security awareness status of the employees and top management on timely basis.

3. Use of advance technology and tools for Data Protection

A well-defined policy in place will help employees know what they need to do and how to do it, but providing them with the right technology tools will also reduce the risks of working remotely. Depending on the organisations and the role of their employees, the technology could vary. Below are the few examples of some tools helpful in data protection during remote working:

• Enable built-in Firewalls: Firewalls are the defence for information security risks. Now a days every Operating Systems has inbuilt firewall which can prevent malicious inbound or outbound requests
• Enable built-in Encryption: Systems data will be encrypted by using built in encryption techniques, this is helpful in case the drive is lost or stolen. However, the passkeys shall be remembered by the IT administrator.
• Use Virtual Private Network (VPN): VPN provides a secured tunnel to the data travelling to the servers and make it difficult to crack for malicious users or hackers. Organisation shall only accept traffic coming through VPNs and employees shall always use VPN for connection to office network specially when they are in a shared network at home or outside
• Use of Password Managers:This will help employees to store their passwords and generate secure password.This reduces the risk of using the same password for all services and applications by employees.

4. Enablement of two-factor authentication

Use of two factor authentications to critical information assets is a must, since it provides a surety that the data request is coming from a genuine source. This method reduces the risk of phishing and malware attacks.

5. Monitor your third-party vendors and service providers

Many a times organisations outsource few services for them. In this case the vendors shall be regularly monitored as the Suppliers information security policy. Assess your vendors cyber security program on regular basis because a vendor can also be sometimes acting a risk for organisations information security

6. Use of access control

Organisation shall implement an access control policy in order to reduce the data breach or data leaks. Least privileged shall be given while granting permission to any user. Access should be based on the role of employees in the organisation, and these accesses shall be monitored on timely basis

7. Enforcement of strong passwords on Applications, servers and employee devices

Organisation shall ensure that strong password policy is enforced on employee devices applications and servers,

8. Use of web security protection

Last but not the least organizations should deploy security solution like antivirus, anti-phishing, anti-malware security solutions employee endpoints and technologies capable of preventing network vulnerabilities from exploitation. There are many solutions available in the market nowadays.

Only deploying these solutions is not sufficient, it shall be updated and monitored regularly and necessary actions shall be taken on it. Organisation shall deploy the solutions which can accurately detect the phishing attempts and any known malware attacks.

Work from home or remote working has given a golden opportunity to hackers and cyber criminals as well as it is a challenge for organisations IT Team and information security team. Managing Cyber Security during remote working is really tedious job for the organisations, however use of proper technology and monitoring can certainly mange this work. Organisations shall take cyber security as a risk and shall appropriately invest in safeguarding their Information assets. A vigilant and aware team can save organisation from cyber attacks and hence from financial, reputation and business operational loss.

# Keyword: Information security, cyber security, data protection, VPN, training and awareness VPN, strong password, business continuity, access control, remote working, work from home, cyber security risk.

During the current era, both big companies and small start-ups, are using Information Technology for ease of doing business, however it makes them vulnerable for Cyber-attacks. So, it becomes necessary for them to use Cyber security professionals e.g. CISO (Chief Information Security Officer) in order to protect information assets. ,It goes without saying  that information security activities in any organization consume more resources than ever before. Cyber criminals (Hackers) are becoming better all the time, and staying ahead of them is getting tougher. However, it’s not just more zero-day attacks by sophisticated criminals; competitors, growth of the organization, elevated infrastructure complexity and new compliance requirements also desire more cyber defence staff, adequate time and right technology to avoid becoming a victim of a cybersecurity breach.

In earlier days security was primarily focused on physical access to facilities and resources, or adding layers of logical controls to protect business application and data. However, security concerns of the present era don’t fit into this old traditional way anymore. Security concerns impact every aspect of an organization’s operations and should be an integral driver of strategic planning, along with all decision for future expansions.

Since cyberattacks have become smarter and more sophisticated at exploiting vulnerabilities, with the availability of many open-source tools it is easier for hackers to launch new attacks every other day. For the organizations and start-ups cyber security shall be a proactive program rather than a reactive which is to be launched at the time of cyber-attack. Thus, information security is an integral part of organizational strategic growth. It is just as important as goodwill, financial turnovers and product quality.

What is Chief Information Security Officer(CISO) and Virtual Chief Information Security Officer(V-CISO) ?

Top management team should be aware of the impact of lack of information security on their organization’s profitability and durability. A shortage of information security in the organization could result in heavy fines for non-compliance, punitive rulings after finding liability or negligence, or a loss of customers and partners after a confidence-shattering breach. There is a big risk of underestimating information security and it is too big to ignore.

In order to address the growing awareness of information security’s importance to strategic planning, many larger organizations and start-ups include a Chief Information Security Officer (CISO) at the executive level. Chief Information Security Officer is the executive who is responsible of Information security and cyber security compliance in the organization.

Many a times companies cannot afford the cost of having own CISO because of the huge salary range. There are situations where the organizations including start-ups need a CISO , but the budget doesn’t allow for a full-time person in that position.

However, there is a cost effective alternative. Organizations specially start-ups that lack the budget for a full time CISO can opt for an outsourced solution: The Virtual CISO, or V-CISO.

A Virtual-CISO is a information and cyber security expert who uses the expertise  of his/her years of industry experience to help organizations and start-ups  by developing and managing the implementation of the organization’s information security program in order to attain various government and non-government compliances. At a high level, V-CISOs help to build the organization’s security strategy, implementation and its management as well.

Organization’s internal security staff may work and report to V-CISO in order to strengthen the information security and cyber security framework and make it more impactful. In addition to this, the V-CISO is usually expected to be able to present the organization’s state of information security to an organization’s board, management team, auditors, or regulators.

Benefits of having a V-CISO

A V-CISO is generally a cybersecurity professional who works part-time basis offering information security services to multiple organizations at a time, working for several throughout any year. This gives organizations a flexibility to hire part-time CISO on requirement basis.

The V-CISO fills several needs through different types of services, including:

• Information Security and Cybersecurity guidance to management executives in order to adhere compliance guidelines
• Information Security architecture guidance
• Incident management including response
• Governance plans
• Cyber Security readiness assessment
• Compliance alignment recommendations (for ISO 27001,RBI Guidelines for banks ,NBFC, HIPAA, GDPR, PCI-DSS, CCPA and may more)
• Remediation prioritization
• Business Continuity Planning and Disaster Recovery Plans and DR drills.
• Identification of scope and objective for the information security compliance
• Risk management (risk identification and treatment)
• Vendor risk management
• Coordination of audits by regulators or customers

Why you organization need a Virtual CISO?

If your organization needs more information security compliance -related guidance at the management level, consider whether a V-CISO would be a good potential option. If you are a a start-up and your budget won’t support a CISO, you might need a V-CISO .If any of the below mentioned scenarios  are similar to  your situation, your organization might need a Virtual -CISO.

• If you are start-up and are really unaware whether you’re vulnerable to cyber security breaches: If your organization hasn’t yet assessed its information security risk, you might need a V-CISO to initiate and support that process.
• Your organization has been breached and no one from your team was able to detect the attack: Post-breach investigations and recommendations often lead to organizational leadership remodelling. One of those remodelling includes information security member of the executive suite. If this is the case, you might need a V-CISO.
• If you are a start-up dealing with critical customer data: In this case if you don’t want to hire a full time CISO, you need to have a V-CISO in order to safeguard your information assets and avoid high penalties because of non-compliance of various regulations
• Important or major changes have occurred that could impact security: If your organization is having mergers or acquisition, security risk should be assessed. Any significant outside influences, such as a global pandemic or natural disaster, which could impact business continuity as well all information security. If your organization doesn’t have anyone who can guide during these times and ensure security is not compromised you might need a V-CISO.
• If your organization wanted to share the workload for the existing CISO: Changes to the organization scope or environment, including new regulatory compliance requirements, may increase the demands of a CISO beyond their current capability. If your existing CISO requires helping hand, you might need a V-CISO.

There could be multiple reasons to have a V-CISO for your organization. An experienced V-CISO will provide valuable guidance and customised solutions as per your organizational needs. As well as it will save you from the burden of paying salary of a full-time CISO.

How to find a right V-CISO?

If you are struggling in your day-to-day information security requirements V-CISO would be a beneficial to your organization, and decided to have one. The very next step is how find the right one. A good amount or research and investigation can help you. Online reviews and existing customers feedback can help you to find a good fit, knowledgeable V-CISO for your organization.

The general process for engaging a V-CISO generally flows like this:

• Set up an initial consultation meeting (commonly one hour at no charge)
• The V-CISO delivers a proposal of scope of work including high-level information security readiness, proposed services and costs
• You may accept or reject the proposal, and then moves forward

• If you decide to engage a V-CISO, then negotiate an agreement that meets your requirements. If you need periodic gap and risk assessment and remediate report, make sure that is explicitly mentioned in the agreement deliverables.
• An agreement with a V-CISO can be set up for a hourly, monthly or quarterly basis . Make sure that you are getting the services you are paying for.
• A V-CISO can be an affordable and flexible approach to adding extensive information security experience and wisdom to your management team. If a V-CISO is a good fit, it can help your organization to identify and safeguard the weak links which could lead to aggressive cyberattacks.

#Key words- CISO,Virtual CISO, VCISO,vCISO, ISO 27001,GDPR,RBI, cyber security, information security, compliance, hackers, cyberattacks.

cyber security dos and don’ts during covid 19. Cyber Security has been a matter of concern for the organisations from a long time and on top of it Covid-19 brought lot of challenges to attain the same.

The COVID-19 situation has compelled organisations and individuals to take up security measures like social distancing and remote working. Governments and civil administration are bringing up new ways to ensure that their citizens would remain hopeful and stable. New economic plans, relief packages have been announced by the government. While the world is focused on the health and economic threats created by COVID-19, cyber criminals all around the world without a doubt are taking advantage on this crisis.

There is a huge spike in phishing attacks, ransomware attacks and malware attacks as attackers are using COVID-19 to lure employees and customers by impersonating government agencies, brands or any other important entity.Such attacks are aiming to infect more personal computers and phones. Attackers are targeting businesses as well as individuals by downloading ransomware disguised as legitimate applications.

Managing Cyber Security has become more challenging in the Work from Home scenario. Following are the Do’s and Don’t for employees and individuals.

DO’s

CYBERSECURITY DOS DURING COVI19

1. Use hard-to-guess passwords or passphrases. A password should have a minimum of 8 characters using uppercase letters, lowercase letters, numbers and special characters.
2. Create an acronym. An acronym is easy for you to remember but hard for anhacker attacker to guess. For example, pick a phrase that is meaningful to you, such as “My dad’s birthday is 12 December, 1975.” Using that phrase as your guide, you might use Mdbi12/Dec,75 for your password.
3. DO change your password in a regular interval, within every 30 days. This will make difficult for the hacker to use your cracked password.
4. DO use different passwords for different accounts. If one password gets compromised, your other accounts are still safe.
5. DO pay attention to the mails you receive, phishing traps in email and watch for tell-tale signs of a scam. DON’T open mail or attachments from an untrusted source. Whenever you receive a suspicious email, the best thing to do is to delete the message, and report it to your manager and Chief Information Security Officer (CISO)/designated security representative.
6. DO change your default username and password of your Wi-Fi router, remember that wireless is inherently insecure. Avoid using public Wi-Fi hotspots. Use your organisation provided virtual private network software to protect the data and the device.
7. Always keep your system updates, install the updates pushed by your organisation
8. DO keep your passwords or passphrases confidential. Never share your passwords with others or write them down. You are responsible for all activities associated with your credentials.
9. DO place confidential paper at proper places at home and destruct it properly prior to putting in dustbin.
10. DO destroy information properly eg. by shreddinga, when it is no longer needed.
11. Always backup your critical data to the drives and location provided by your IT Team
12. Never turn off antivirus system installed on your PC and keep it updated.
13. DO avoid printing confidential information outside personal printers. Always be aware of your surroundings when printing, copying, faxing or discussing sensitive information
14. DO keep your work devices are either shut down or locked—including any mobile phones you use to check email or make work phone calls.
15. DO report all cyber incidents and suspicious activity to your reporting manager and CISO/designated security representative.

DON’Ts

CYBERSECURITY DONTS DURING COVI19

1. DON’T leave sensitive information lying around the home if you live with roommates and young children.
2. DON’T leave important printouts or portable media containing private information on your desk. Keep them in a safe place drawer to reduce the risk of unauthorized disclosure
3. DON’T use your official laptops and desktops for personal work. Avoid accessing social networking sites via official systems.
4. DON’T share any private or sensitive information, such as bank details, credit card numbers, passwords or other private information, on public sites, including social media sites, and DON’T send it through email unless authorized to do so. Always use privacy settings on social media sites to restrict access to your personal information. In a nutshell avoid sharing too much personal information on social media.
5. DON’T click on illegitimate links from an unknown or untrusted source. Cyber criminals often use them to trick you into visiting malicious sites and downloading malware that can be used to steal data and damage networks.
6. DON’T use your private email address to send work-related emails and vice versa. Not only does it look unprofessional, but also expose your official email to unauthorized users many a times.
7. DON’T share your confidential information to unauthorized person over call and mail. Voice Phishing is a very easy way for an unauthorized person to call and pretend to be an employee or business partner.
8. DON’T respond to emails and phone calls requesting confidential data.
9. DON’T avoid patch installation warning on your systems.
10. DON’T install unauthorized software on your work computer, use only software authorized by your Information Technology department. Malicious applications often pose as legitimate software.
11. DON’T plug in portable devices without permission from your Information Technology department. These devices may contain malicious code just waiting to launch as soon as you plug them into a computer.
12. DO lock your computer by using (Windows + L)and mobile phone when not in use. This protects data from unauthorized access and use.
13. DON’T leave devices unattended. Keep all devices, such as laptops and cell phones physically secured. If your official device is lost or stolen, report it immediately to your manager and ISO/designated security representative.
14. DON’T leave wireless or Bluetooth services on laptop and mobiles turned on when not in use. Use password for Bluetooth and wireless connections. Use these services only in a safe environment.
15. DON’T use vulnerable video conferencing software

Cyber Security is a mutual responsibility of the organisation and its employees. Each and every individual play a crucial role in safeguarding organisations critical information assets. Current pandemic situation of course has increased the cyber security risk for the organisation, however proper technology measures and security awareness among employees shall certainly help to overcome these issue.

Keywords: COVID-19, pandemic, cyber security, DO’S and DON’TS, password security, Wi-Fi security, hacking, malware, phishing, patch management, antivirus.

#Tags: #COVID, #Workfromhome, #WFH, #compliance, #informationsecurity

Relevant Links

Cyber Security during COVID 19

Cyber Security Challenges by Fin tech

cyber Security Challenges Fintech. This era of digitization and digitization, where every segment of businesses is using technology to provide services to customers, banking and financial industry has transformed their services by financial technology- FinTech.

Fin Tech were providing their services in the form of e-wallets, online and mobile payment systems (Paytm,PayPal, Apple Pay), virtual buying of stocks, etc. But the recent times did bring a bunch of new disruptors that will displace traditional e-commerce providers.Such new FinTechstart-ups are offering more efficient services, seamless customer’s experience, and free person-to-person payments.

FinTechs business can increase profitability and enhance a company’s performance while helping them improve customer service. FinTech also provide an opportunity for companies to expand their portfolio online while solving industry issues such as credit card processing, money transfers, or processing a loan.

But everything is not so smooth with Fintech business. There are few cyber security challenges and risk associated with Fintech business, which every FintechStatups shall be aware of.

WHAT IS FIN TECH?

Fin Tech is the abbreviation used for Financial Technology which aims to compete with traditional method of finance. There are many financial institutions consider this term as backend of their business and sometimes regular banking apps are included in this term.

Fintech business includes mobile payments, money transfers, loans, crowd funding, asset management and many other things.

In simple words-FinTechis the implementation of modern technology in traditional financial services and in the management of financial aspects in various companies and business. Anything from the financial mobile apps and new software installed, processing the money transactions and calculating business models.

Risk in Financial Sector:

Even, in general ,every individual and organisation ,  are worried about information and cyber security , conditions in financial sector is more critical  and fin tech business take the issues more seriously. Some of the recent studies shows that banks are investing a large amount of their funds in designing and implementing security to safeguard themselves from cybercriminals

Few more areas of concern includes cloud based technologies, mobile updates and system upgrades. These findings show that cyber security is the most important risk which the Fin Tech companies are facing.

CYBERCRIME AND CYBER SECURITY IN FINTECH LANDSCAPE

As FinTech start-ups and companies continue to disrupt the global financial landscape, a peculiar feature and perhaps their biggest advantage is that they are not held back or burdened by law, regulations, or existing systems. Also, they are more aggressive, more agile, and more willing to explore and make risky choices. But this total dependence on technology and adventurous attitude to aid financial services delivery may also be their greatest weaknesses.

 

FINTECH FIRMS ARE FACING CYBER SECURITY CHALLENGES  IN FOLLOWING AREAS

Application Security

Fin Tech firms mainly relies on applications that can access users’ financial profiles to perform a variety of real-time transactions. Applications are used by multiple persons and, are an increasingly common attack vector, and vulnerable code can be exploited as an entryway into financial networks.

FinTech firms and Banking companies need to ensure that a secure application security strategy such as a virtual private network is in place to protect user data. This should include a web application firewall enabled with current threat intelligence to identify and mitigate known and unknown threats, as well as to detect and patch vulnerabilities

Network and Cloud Security

Like other organisations, many FinTech firms also utilize cloud services to provide consistent, salable performance with lower upfront costs, rather than the traditional network. However the cloud infrastructure shall be secured differently than a data center or traditional network. Banks and FinTech firms must ensure that the same security standards they apply to their networks are applied in the cloud.

Along with detection and prevention, this security must also be dynamically salable and adaptable to ensure that is can grow seamlessly alongside cloud use. Additionally, in order to secure financial data, FinTech firms need to implement aloud access security, along with internal segmentation to improve data visibility while integrating industry security standards.

Inadequate Threat Intelligence

Threat Intelligence is another challenge for Fin Tech firms, an integrated defense needs to be enabled with automated threat intelligence to become a holistic system. As Fin Tech firms and banks enter partnerships, it will be impossible for IT teams to gather and assess all of this threat intelligence promptly manually. Automation, artificial intelligence and Machine learning will be integral to this process.

Cyber criminals are already leveraging automation to make attacks more persistent and effective. Likewise, artificial intelligence, machine learning and automation integrated into network security tools enable the detection and prevention of attacks in real-time, allowing organizations to keep pace with cyber-criminals.

LACK OF ESTABLISHMENT OF BETTER SECURITY PROTOCOLS

This is one of the most significant issues that Fin Tech start-ups firms face is selecting best security mechanism, like security protocols to enhance encryption data. Inadequate security protocols, data is easily exposed, leaving companies vulnerable to attacks.

Tunneling protocols used in VPNs are effective at encrypting Fin Tech data. Some of the best-known tunneling protocols include:

• Internet Protocol
• Point-to-Point Tunneling Protocol.
• Layer Two Tunneling Protocol.
• Internet Key Exchange version 2.
• Secure Socket Tunneling Protocol.

These tunneling protocols provide different levels of protection and provide security in different ways. Fin Tech should research and become more familiar with the different types of protocols and how to use them within a virtual private network – this is especially true in a financial environment where cyber threats are imminent and ongoing

ADDRESSING VULNERABILITIES IN INFORMATION TECHNOLOGY SYSTEMS

Integration of multiple systems and technologies leads to multiple cyber vulnerabilities. When two systems that are not designed at the same time by the same developers often pose compatibility issues and challenges in security, given the limitations in technology. Technology Engineers face issues while integrating two different systems, sometimes engineers working on different systems doesn’t even know how the other system works and vice versa, which makes identification of vulnerabilities more difficult.

Cyber criminals like hackers exploit these vulnerabilities to gain access to the system.

Many cyber criminals gain access to applications and networks because of improper configuration during installation. There are other techniques that are often used like spear-phishing, where humans mistakenly open spam emails and download malicious attachments or enter confidential information into fake websites to which they are redirected. So this is important for all Fin tech Startups to  raise awareness of cyber criminal risks and educate the newly banked on digital and financial literacy to teach them best practices to ensure security when engaging in financial transactions online.

LACK OF COMPLIANCE REGULATIONS RELATED TO CYBER SECURITY

Rapid growth in happening fast in Fin Tech firms. Fin Tech start-ups are flexible enough to change and adapt to evolve alongside consumer demands, rapidly.They are flexible and quick partly because there are not the same regulatory rules as traditional financial services for them. However, there are no regulations are controlling the way start-ups conduct their business. This is making the Fin Tech firms vulnerable because, they can sacrifice cyber security in order to capture the market as fast as possible.

Fin Tech Companies are collecting and storing personal information, so they needs to safeguard customer data. Further the challenge of is the way they protect this data. Many of Fin Tech firms have adopted bank-level security measures and fine-tuned them for their digital platforms.

Use of secure applications , regular vulnerability assessments on networks and applications , patching the applications on time, using Secure socket Layer(SSL) encryption while transferring the data is the must for enhancing cyber security. Fintech can opt for ISO 27001:2013 (ISMS) for overall cyber security.

There is need of some strong regulation, which would inspire start-ups to invest some of that venture capital money into their security.  As the Fin Tech industry grows, so will their defense against breaches.

Related Articles

CYBER SECURITY CHALLENGES FACED BY FINTECH START-UPS

Cyber Security during COVID 19, The Most difficult time in this era, our generations witnessed, no one could imagine that this time could ever come and we have to face total Lockdown. We know that this type of situation has  occurred in the past, but this situation with the Internet in existence is all of the first of its kind.

Has anybody imagined, if the internet would not have been invented, then how would the whole world behave?

So the most important tool is the invention of INTERNET and if the internet was born then some hackers would also have been born

There comes Cyber Security Domain.

COVID 19 Pandemic came with side effects

• Hampered the Business Continuity of many organization, we all know once business continuity is reset, this sometimes costs organizations 
• Think about Power Plants, Industrial plants, and such large setups which can not take the weight of starting up and shutting down again & again, It Costs for every hour.
• Setup cost to make workforce start working from home, giving them secure devices, high speed internet, we know work from home Networks are Not Secure – they could be a easy entry point 
• Situations where organizations were at the verge of upgrading, what happened to broken systems.
• Systems which were not designed to take loads & cyber secure, what happened to those.
• Some of the basic basic hacking attempts have taken place in our lives have come out vigorously, should be noted that whenever there is a disruption in society these attacks will come out commonly.

These below threats will be very common

• Payment Wallets –  You will be receiving many Freudian calls, asking you to check messages in which an encrypted url will be seen, as soon as you click on the link fishing attacks starts
• Online ordering system – There are fraudulent websites on which people order online and will use their credit card details on the pages, and then transactions take place.
• Phishing emails – Most number reports coming up since the lockdown. An Attempt to obtain information like usernames, Passwords and other details using emails is actually called as Phishing emails. This type of attempt has been increased due to unrest in governance.
• Malicious App – Whenever you use mobile apps, we sometimes get a message to click on a promotional banner, which might be a message to instal new app.. Now one knows what these apps are capable to get your data and breach our mobile data. These attacks are more common these days.
• Network Endpoints Attacks – There are malware’s on the internet which always keep finding the endpoints which are easily vulnerable and they get infected and penetrate into the system and then live inside the system as a host and wait for their master command further on to start damaging in one form or another.
• Targeting Healthcare Systems at the time of covid – The most important is the healthcare system, this covid19 is a pandemic, most  of the people are dependent upon healthcare services and in these times healthcare systems are most common to get attacked.

Cyber Security teams should take the most common steps as mentioned below:

• Online awareness workshop – Most important is increasing awareness in employees working from home. 
• Backup of all Digital Assets – Digital Assets monitoring tools are becoming very common these days, Organizations should keep regular backups for all digits assets.
• Endpoint Scanning – More and more endpoints increase because people are forced to work from home, hence they are using mobile, ipads, laptops etc in unsecured zones. Hence regular endpoint scanning is necessary.
• Creating Groups, for risks  – Immediate Risk mitigation teams should be made, who would be taking care of cyber attacks.
• Excessive use of Tools for monitoring – organizations should start using monitoring tools where you can get reports like Risk Observation, Endpoint Breach, DOS Attack report, Performance & Load Analysis etc.

Lessons from Covid 19 pandemic in reference to cyber security.

• Emergency response  teams should get More Active 
• Immediately activating multi tyre authentication 
• System Performance & Load monitoring, in case situations like sudden traffic rise.
• Cloud Security Preferences 

Summary

This pandemic is the first of its kind, which we have faced in this digital era. COVID 19 will be a perfect case study for future pandemics, the world will be now more prepared for these disasters.Some of the factors like how the digital industry behaves, all of a sudden change, immediate load and performance issues, systems scalability, penetration test, cyber attacks etc. Systems which fell or broke easily in this would be a great learning or case study for future.

Relevant Links

INFORMATION SECURITY-KNOW WHAT COMPLIANCE YOUR ORGANIZATION NEED

Cyber Security Consultants 

startups are easy targets. Startup world is filled with examples of data theft and how a beautiful idea just came down thrashing. Startups have a very narrow financial funnel and Startups are weaker targets, in case of any cyber attacks they are unable to handle legal implications and die. Most important is Planning, cybersecurity threats in today’s times can not be ignored. Startups are more vulnerable and this will increase day by day.

• Startups are Easy target or more easily vulnerable  – Large organizations already have procedures or have good infra & spending power to mitigate these threats, but small companies or startups are not so lucky. Cyber crime is increasing day by day and these startup’s are easy targets for them. Basic concern is protecting customer data. It’s all about protecting your digital assets, one of the ways is to use tools for Vulnerable Management.

• Tarnish Reputation  – Basically startups have to be more vigilant  about their reputation, only a single incident in news can tarnish their reputation. Startups business are like planes taking off from the runway, it’s very important to be very vigilant while taking off. Once startups have enough customer base or good investments, then it’s easy to handle.

• Dependency upon Third Party API’s – Most of the startups initially take support of third party API’s due to the fact that it’s impossible to develop API from scratch or the business model is not financially viable hence, third party API’s are the only source, using API means dependency and data exchange and we never know how this is taking place. Recommendation is that some legal documentation should be done before going for this arrangements.

• Less Spending upon IT Infra & Technology  – It’s very important that you select the best IT infra and technology solutions, we are living  in an advanced era, although there are many IT infra solutions available these days which offer services on the basis of bandwidth usage, this actually means Pay as you use. Ie: AWS , Google Storage’s etc These tools have actually made life easier because we are getting the same quality which larger setups are getting and are actually paying on the basis of usage, these advantages were actually not available even a few years back.

• Testing & Performance  – Most of the startups ignore this process called “Testing & Performance”. Although it’s a very important department, in case there is a financial crunch, startups can go for freelancers available at low cost and high quality.

• Lack of Legal know how – We all know startups are betting on new ideas or playing on new technology which might disrupt the market, and it’s not possible that a legal journey would be so simple for the company, hence just starting on mere ideas is not the only important. Analyzing the legal aspect would be a very wise decision. It’s recommended to hire a Cyber laws expert before going forward, this will not only help the company get a second opinion.

• Startups are Less Likely to fight back – Most of the startups have very small small financial backbone or narrow funnel for finances, In incidents like data thefts or legal notices, many startups haven’t even planned these financial aspects or we can say they have not planned for this situations, these incidents actually lose focus on the actual technology which they are working and leave the focus on what the actual idea was resulting in shutting down of startups or moving in wrong direction.

• Less due diligence  – Duedelegence for the idea is very important, a startup team should spend more and more time on this, Managing their resources, Technology aspects, research, IPR, demographic, usage, bandwidth, People, taste etc.   There are the most important aspects in understanding businesses. It’s also important to understand the Cyber Laws, although the world is becoming borderless, the internet has no boundaries, but these cyber laws would be acting as borders for different communities. Hence it’s very important for IT startups to design their  software in a way that is easily configurable according to the change in laws. Scalability not only refers to the tech infra, but also refers to how immediately you change your policies and how easily it is configurable in your software.

Recommendation

Get your Idea Patented 

The Most important aspect of an idea is to get that registered, you again need some attorney and get to read some local or national laws just going to get your idea registered. Although it’s difficult and time consuming but people have come up with innovative ideas to get it mark in the history that they thought for the idea first and small small efforts they did in this direction could save them from losing their idea. 

Cyber Risk Analysis 

Cyber Risk Analysis is the best due diligence which you can start initially, this report will basically touch endpoints where cyber risks are involved. Moreover this gives more insights before taking steps.

Before going for full scalability, have a cyber laws lawyer on your panel.

It’s very important, startups need to have cyber security & Legal advisors on their panel, this will help them analyse local laws and understand the legal implications before taking any steps. This will help companies to do due diligence before going further. 

Keep a cyber security plan always ready in case of emergency response.

In case of data breach or cyberattacks, always be ready with Plan B and try to minimize the risk to customers data, because that will be the only way to safeguard, once this risk is mitigated all other risks seem secondary and will automatically be secured. 

Always be in touch with the regulators or authorities regarding any thefts which you think would be in advance addressed to policy makers.

If you think your product is new and is somewhat governance is needed with public authorities or regulators, always get connected via events with the regulators of industry. You never know  whom you need to connect at the time of crisis.

 Before releasing any version of your product always keep your Terms & conditions, and disclaimer updated and enforced.

The most important part is the disclaimer policy, most of the court cases have fought and won or loose on the basis of Terms & Conditions of usage and Disclaimer. It is strongly recommended that always keep your Policies Updates and keep it reviewed with your legal consultant every time. 

Be proactive in addressing issues with your users. 

Let’s assume, your system is attacked in past months, and you want users to change their passwords asap, don’t hesitate to this announcement, It’s a responsible step, we have seen any automobile companies recalling cars for some defective part, it’s similar to that, you are becoming responsible company trying to save your customers and their data.

Hence by becoming a proactive founder dont let your Startups become  Easy target and vulnerable. SAVE YOUR STARTUP

Related Articles :

CYBER SECURITY CHALLENGES FACED BY FINTECH START-UPS

WHY BUSINESS CONTINUITY MANAGEMENT IS SO IMPORTANT FOR IT SERVICE PROVIDERS

Whenever there is disruption in business, it can cost money, damage in reputation or sometimes customer loss. Insurance companies does not cover all costs and cannot replace customers that defect to the competition. A business continuity plan is must for any IT service provider for sustaining such catastrophic conditions.

Business Continuity process identifies the likelihood and impact of the risks on the business and then produces a contingency plan to deal with any kind of eventualities, like IT system failure, terrorism, natural calamities like earthquake and flood, unavailability of staff etc.

Business Continuity is one of the most critical aspect of any business.

WHAT IS BUSINESS CONTINUITY MANAGEMENT (BCM)?

Business continuity management (BCM) is a framework for identifying an organization’s risk, its exposure to external and internal threats pertaining to service availability and hence formulating a plan to mitigate the risk. Business Continuity Management involves development of plan to prevent any disaster and assist in recovery in case of crisis. The motive of Business Continuity management is to develop and implement ability to effectively respond to threats such as data breaches or natural disasters and protect the business interests of the organization. BCM includes crisis management, disaster recovery, business recovery, incident management, emergency management and contingency planning.

What Is Business Continuity Planning (BCP)?

Business continuity planning (BCP) is the step by step process of creating a robust preventive system and a mechanism of quick recovery from the potential risks to a company. BCP ensures that personnel and assets are protected, and are able to function quickly in the event of a disaster. Business Continuity Planning is conceived in advance and involves input from key stakeholders and personnel.

Business continuity Planning is the assessment of both internal and external risks and its impact on the business and then implementing preventive, detective and corrective  measures.

BCP involves defining any and all risks that can affect the organisation’s objectives and operations, making it an important part of the organization’s risk management strategy

Basic areas in which Business Continuity Planning needs to be considered:

• IT Service Continuity
• Disaster Recovery (DR)
• Pandemic Planning:
• Life-Safety
• People Continuity

HOW TO DEVELOP BUSINESS CONTINUITY PLAN?

Development of business Continuity plan includes following steps:

STEP 1 First of all, perform need analysis and define strategy objectives and an implementation framework should be created

STEP 2 Next, business value of organisational applications should be identified and RTO (Recovery Time Objectives) and RPO (Recovery Point Objectives) through data risk should be determined

STEP 3 Next, match technologies for safeguarding data, including backup, disaster recovery, vaulting, snapshot and replication, based upon business value

STEP 4 Next, infrastructure and personnel plans, including organizational and communications processes should be defined. A business continuity team should be formulated and business continuity plan should be complied to manage a business disruption.

STEP 5 Next, required technologies should be implemented and training and awareness to critical personnel as to which business processes are impacted

STEP 6 Table Top exercise and BCP drills of the documented plan should be conducted, in different scenario. Outcomes should be documented.

STEP 7 Next, Measure and validate test results relative to the plan overall objectives

STEP 8 Further, required enhancements that have been prioritized as a result of continuous testing and evaluation should be implemented

STEP 9 Next, continuously review, enhance and improve the business continuity plan with respect to organizational changes, fluctuating business conditions and the addition of new technologies

STEP 10 Finally, remember to repeat the entire process continuously.

BUSINESS CONTINUITY PLAN CONTAINS:

• Purpose and scope of BCP
• Initial data, including important contact information of all important stakeholders, located at the beginning of the plan
• Change management procedures
• Business Impact Analysis(BIA) and Risk Assessment(RA)
• How to use the business continuity plan, including guidelines as to when the BCP will be initiated
• Business Continuity Policy
• Emergency response and management
• Step-by-step procedures for Data Recovery
• Checklists and data flow diagrams
• Review ,test and update schedule for BCP

WHY BUSINESS CONTINUITY MANAGEMENT IS IMPORTANT FOR IT SERVICE PROVIDERS

Since most of our businesses are digitizes and IT is playing an important role everywhere like ERP, CRM, databases etc. So it’s mandatory for the IT service providers to consider Business continuity in order to keep business up and running in case of disaster. Features of BCP:

• Business Continuity Planning helps to identify all the critical processes and assets of the organisation and all the risk associated with them.
• Business Continuity planning is helpful in continuing the operations case of disasters like fire, cyber-attacks, natural calamities, civil unrest etc.
• Business Continuity Planning prepares the organisation for any kind of disruption and thus minimise the effect of a disruption on an organisation.
• It reduces the risk of financial loss in the organisation.
• This helps the organisation to meet legal and statutory requirements.
• RTO and RPO enables recovery of critical systems within an agreed timeframe.

• This helps in retaining organisation’s brand and image and give employees, clients and suppliers confidence in the organisation’s services.
• Frequent BCP drills help the organisation to react and re-establish the services quickly in case of disaster.
• BCP involves documentation of all the activities which should be performed in case of disruption and a well-tested & document process help to revive the business easily.
• BCP provides an advantage of working from remote location in case of disaster, thus no interruption in operations.
• A well planned BCP helps reducing downtime in case of disruption.
• Taking backups is an integral part of BCP, so organisations can recover data without much loss and can resume their business.

Business Continuity and disaster Recovery cannot be achieved by a single employee or person, it’s a team effort. A single person or an untrained staff cannot deal with disastrous situations. And, like most of the team activities, it requires practice and adequate competence in order to perform effectively in adverse situations like disaster. A proper planning is required.

Proper planning means that a thorough assessment and relevant controls shall be implemented and tested. A proper planning will tell who shall do what and how it shall be performed provides a set of well tested instructions in case of contingency.

If the stakeholders are not informed and not practiced in their roles, they cannot perform well.In that regard, business continuity planning is a sign of inclusion and commitment for a company to have a real plan.