Presentation made to the Board and senior management of 8 NBFC with asset base of more than Rs 500 Crore on 24th March and 4th April 2018

1. Cyber Security Awareness for Board
4th April 2018
Nanda Mohan Shenoy D
CAIIB,DBM-Part I,, NSE Certified Market Professional Level-1 ,
P G Diploma in IRPM, PG Diploma in EDP and Computer Management, DIM,
LA ISO 9001,LA ISO 27001 NISM empanelled CPE Trainer
1
Director

2. Agenda
• Overview
• Recent Cyber Attacks
• Types of Cyber Attacks
• Current Environment
• RBI Guidelines
• Protection Strategies
• Cyber Liability Insurance
• Question & Answers
2

3. Etymology
3

4. India’s Rank in GCI (195 Countries)
23
4

5. GCI Parameters
5

6. GCI Report
6

7. Cyber Regulation Landscape
• Information Technology Rules &
Regulations
7

8. Data Protection Framework-India
• Committee of Experts under the
Chairmanship of Justice B N
Srikrishna, Former Judge,
Supreme Court of India, to identify
key data protection issues in India
and recommend methods of
addressing them.
• Released for Public Comments on
27th Nov 2017 (243 pages)
• Last date for public comments was
31st Dec 2017
8

9. Why Sudden focus
9

10. Agenda
• Overview
• Recent Cyber Attacks
• Types of Cyber Attacks
• Current Environment
• RBI Guidelines
• Protection Strategies
• Cyber Liability Insurance
• Question & Answers
10

11. Ransomware- Statistics
• A company is hit with ransomware
every 40 seconds
• 6 in 10 malware payloads were
ransomware in Q1 2017.
• There were 4.3x new ransomware
variants in Q1 2017 than in Q1
2016
• 15% or more of businesses in the
top 10 industry sectors have been
attacked.
• 1 in 4 businesses hit with
ransomware have 1,000
employees or more
• 71% of companies targeted by
ransomware attacks have been
infected
Source: https://blog.barkly.com/ransonware-statistics-2017
11

12. Kerala and Wannacry
12

13. Incident-2
13

14. Incident -3
14

15. Data Breach
15
Fish Tank Attack on a Casino
in USA

16. Financial Impact
16

17. Cyber Crime
State & UT
Metropolitan Cities > 2 Mio Population
17
CY FY
2017 (H1) 27,482 NA
2016 50,362 16,468
2015 49,455 13,083
2014 44,679 9,500

18. Emergence of Cyber Threat
• Mobile Applications
• Third party beyond boundaries
• Email
– Research by IBM reveals that 59% of
ransomware attacks originate with phishing
emails and a remarkable 91% of all malware
is delivered by email
18

19. Agenda
• Overview
• Recent Cyber Attacks
• Types of Cyber Attacks
• Current Environment
• RBI Guidelines
• Protection Strategies
• Cyber Liability Insurance
• Question & Answers
19

20. Types
20

21. BEC Scams
21

22. Website Defacement
22

23. Reporting Responsibility
• Wannacry attack
is a Cyber Security
Incident
• Mandatory
Reporting as per
Sec 70 B
– shall be
punishable with
imprisonment
for a term which
may extend to
one year or with
fine which may
extend to one
lakh rupees or
with both
23
Imprisonment Fines

24. What is wrong with this website?
24

25. Darkweb
25

26. New Technology
26

27. Agenda
• Overview
• Recent Cyber Attacks
• Types of Cyber Attacks
• Current Environment
• RBI Guidelines
• Protection Strategies
• Cyber Liability Insurance
• Question & Answers
27

28. Current Environment
• Internet Facing applications need stricter control and monitoring
Type of Application Intranet Internet-UI Internet-Web service Mobile App only
Application Licensed 28 35 12 5
28

29. Agenda
• Overview
• Recent Cyber Attacks
• Types of Cyber Attacks
• Current Environment
• RBI Guidelines
• Protection Strategies
• Cyber Liability Insurance
• Question & Answers
29

30. 3 Information Security & Cyber Security
3.2 Cyber Security-Need for Board approved Cyber
Security Policy
3.3 Vulnerability Management
3.4 Cyber security preparedness indicators
3.5 Cyber Crisis Management Plan
3.6 Sharing of information on cyber-security incidents
with RBI
3.7 Cyber-security awareness among stakeholders /
Top Management / Board
30
RBI Guidelines

31. TOC – Cyber Security Policy
• Governance
• Legal requirements
• Cyber Security Risk management
• Vulnerability Management
• Cyber Crisis Management Plan
• Cyber Security Preparedness indicators
• Skilled Personnel
• Cyber Security Awareness
• Security Operations centre
• Cyber Liability Insurance
31

32. Sharing of Information
32
Sharing of information on cyber-security incidents with RBI

33. Agenda
• Overview
• Recent Cyber Attacks
• Types of Cyber Attacks
• Current Environment
• RBI Guidelines
• Protection Strategies
• Cyber Liability Insurance
• Question & Answers
33

34. Protection - Baseline
Sr
No
Most Common Issues Preparedness
1 Timely Application of OS/RDBMS Patches
2 Out of Support OS/RDBMS/Components
used
3 VAPT of Internet Facing
Applications/Application
4 E mail – IPF/DKIM/DMARC implementation
34

35. How much is too much?
35

36. Trend
36

37. Brand Protection

38. Protection Strategy
Unconventional Thinking required for
protection
• Technology
–Deception Technologies
–IPF,DKIM,DMARC
• Human Control
• Cyber Drills
38

39. Agenda
• Overview
• Recent Cyber Attacks
• Types of Cyber Attacks
• Current Environment
• RBI Guidelines
• Protection Strategies
• Cyber Liability Insurance
• Question & Answers
39

40. Transfer of Risk
• Most of the Cyber Risks can be
transferred through Liability Insurance
• Bajaj Allianz has launched a policy for
Individuals as well recently
40

41. Companies Offering Cyber Liability
Srl
No
Insurance Company
Name
Product Name UIN
1 Bajaj Allainz BAJAJ ALLIANZ CYBER PROTECT
PREMIUM -DIGITAL BUSINESS
AND DATA PROTECTION
INSURANCE
BAL-LI-P15-11-
V01-15-16
2 HDFC ERGO HDFC ERGO CYBER
SECURITY INSURANCE
POLICY
IRDAN125P0005-
VO1-2011-12
4 Tata AIG CyberRisk Protector Insurance IRDAN108P0
003V0120
1314
5 Universal Sompo* Cyber Security Insurance USG-LI-P13-
103-V01-
12-13
41

42. Types of Losses Insured
42
Third
Party
First
Party
Services/
Expense
s
Exclusions
Similar to Own Damage
and Third Party Damage
in Motor Insurance

43. Final Thoughts
43

44. nmds@bestfitsolutions.in, 09820409261
nநன்றி
ध यवाद
44