At CISO Platform 100 and Decision Summit 2018 , we had a panel discussion on the topic How to measure your breach response readiness, including industry stalwarts like
Panelists:
- A Shiju Rawther (TransUnion CIBIL Ltd)
- Maya R Nair ( Idea Cellular Limited )
- Jayant Gupta ( Hindustan Petroleum Corporation Limited )
- Vijay Kumar Verma ( Reliance Jio )
- Debojit Maitra ( Aditya birla Retail Ltd )
- Venkata Satish Guttula ( Rediff.com India Ltd )
- Sayyad Salim (Bajaj Finance Ltd.) [moderator]
Key Learning: "How to Measure Your Breach Response Readiness"
- Frameworks/Models for measuring breach response readiness: NIST Cybersecurity framework was discussed in brief with its 5 major components as below.
- Identification to manage cyber security risks through developing an organizational understanding in terms of asset identification, like data, switches, firewalls, user ids and their access.
- Protection of critical assets to ensure delivery of critical infrastructure and services through implementing proper safeguards.
- Detection and continuous monitoring in order to identify threats
- Response activities, processes and procedures to take actions against cybersecurity incidents and minimize the time duration between incident and its recovery
- Recovery planning and procedures with improvements through incorporating lessons learned into future activities. Proper communication between internal and external parties is also a key aspect of recovery against breaches.
- Assessing organization's breach response readiness
- Assessing through impact of breach response in financial terms and availability of services
- Criticality of assets that an organization possess needs to be taken into consideration:
- Confidentiality of assets holding critical data
- Cruciality of assets available for service so as to prevent financial losses
- After identifying criticality of assets, matrix of financial losses may prove to be helpful for the organization
- Proper forensics needs to be in place for as many systems those have been affected and compromised
- Risks faced under Cyber Insurance
- Cyber insurance can be helpful, where organization doesn't have to worry about 100% financial losses in case of ransomware.
- Though Early days in India, underwriting of terms & policies becomes a critical issue to be re-looked in cyber insurance
- Estimated premiums need to be audited through well defined processes in place supported with a proper legal, forensics, sedimentary team in an organization
Would you like to share your key learning ? Sign Up and write a blog ! It's free
Comments