Ganesan Ramani

Cybersecurity agencies are warning of a growing fraud technique involving OTP forwarding through malicious APK files hosted outside the country, posing serious risks to mobile banking and digital payment users. 
In this attack, victims are tricked into downloading an Android application from unofficial links shared via SMS, WhatsApp, email, or fake customer-support calls.
For more news: https://lnkd.in/g-DgjpXv

The era of “tick-box” security audits is officially over.

If you are a CISO or Head of Audit in India, the new CERT-In “Comprehensive Cyber Security Audit Policy Guidelines” (Version 1.0) has just shifted the ground beneath our feet.

It’s no longer just about getting a certificate. It’s about consequences. We analyzed the 69-page directive. Here are the 5 massive shifts you need to know right now:
1. Basic VAPT is Dead: Reliance on limited lists like “OWASP Top 10” is explicitly discouraged. Your scope must now include AI, Supply Chain (SBOM), and Cloud controls.
2. New Scoring Mandate: You can’t just use CVSS anymore. It is now mandatory to use EPSS (Exploit Prediction Scoring System) to measure the probability of an attack alongside severity.
3. No More “Pay-for-Pass”: The guidelines strictly ban contingent fees. Auditor payments can no longer be linked to favourable outcomes or closure reports.
4. You Own the Inventory: The auditor cannot build your asset list for you. The “Auditee” is now explicitly responsible for maintaining the inventory and ensuring patches are applied.
5. Deter & Punish: There is a new penalty matrix. “Substandard services” or “Adverse reports” can now land organizations on a watch list.

The bottom line: Compliance just got harder, but it also got smarter. Is your current audit partner ready for Version 1.0? We have aligned our entire methodology with these new guidelines, from EPSS scoring to AI-ready scopes.

Read full insight on: https://lnkd.in/dfwJygSh

#CyberSecurity #CISO #CERTIn #Infosec #Audit #Compliance #IndiaBusiness #VAPT

Dear Members,
The Institute of Chartered Accountants of India has received an advisory from the Indian Cyber Crime Coordination Centre (I4C), Ministry of Home Affairs, regarding a surge in ransomware incidents targeting Chartered Accountant firms and consulting organizations through vulnerabilities in Network Attached Storage (NAS) devices.

Such attacks may lead to encryption of organizational data, theft of sensitive client information, and extortion demands, which may significantly impact professional operations and client confidentiality.

Members and firms are advised to take note of the advisory and review the recommended cybersecurity measures, including restricting internet exposure of NAS devices, enabling multi-factor authentication, applying timely security updates, maintaining secure backups, and strengthening monitoring mechanisms.

The advisory received from Indian Cyber Crime Coordination Centre (I4C), Ministry of Home Affairs is enclosed herewith for your information and necessary action.

Members are requested to remain vigilant and ensure adequate cybersecurity safeguards within their firms and professional systems.

See my previous Post a Day before at:-
https://lnkd.in/dDhWKdGt

The Institute of Chartered Accountants of India (ICAI)

CERT-In (Indian Computer Emergency Response Team)
• National nodal agency for cyber incident prevention, response, and coordination under the Ministry of Electronics and Information Technology (MeitY).
• Mandatory breach reporting:
Organisations must report cybersecurity incidents within a limited time frame and retain records/logs for compliance.
• 2025 Updates:
• Annual 3rd-party cybersecurity audits have been mandated for public and private organisations.
• Strengthened authentication requirements (e.g., MFA) and audit guidelines for security practitioners.

TATA Motors’ Data Breach

Around 70TB of sensitive information and infrastructure exposed across hundreds of buckets.

Cause: plaintext IAM keys exposed on a public facing website

TFA:
https://lnkd.in/gbFPVHJt

HN:
https://lnkd.in/gqgk79jA

One of the most under-appreciated responsibilities of regulated boards is cyber security. The Securities and Exchange Board of India (SEBI) Chairman is absolutely right to call this out. If you sit on the board of a regulated entity, you are not just approving strategy and signing off accounts. You are being entrusted with customer data, investor records, confidential deal pipelines, and the reputation of your firm. Lose that data and you lose trust. When trust goes, value follows.

I go through this pain at least twice an year with my firms and unfortunately people only realise when the blood drains from your face when your CISO/CEO calls you at 3am. This is why I keep banging on it but who listens to the old man on the board.

The corporate graveyard has too many headstones marked “breach”. Equifax lost over 140 million customer records in 2017 and paid billions in fines, settlements and remediation. Target lost 40 million credit card numbers and its leadership team was forced out. In India too, we have seen high profile breaches. The 2020 BigBasket leak exposed data of over 20 million users. The 2022 Air India incident compromised the personal data of 4.5 million passengers. Ransomware has hit Indian pharma and financial services firms, freezing operations and shaking investor confidence. This is not an IT problem. This is a board problem, and by extension, a fiduciary problem.

A cyber breach is not just about firewalls and passwords. It is about culture, governance and preparedness. The firms that survive are those whose boards treat cyber security as seriously as capital allocation. Regulators will demand it, investors will expect it and customers will judge it.

In today’s digital economy, your moat is not only your business model. It is also the confidence that the information you hold is safe. Fail that test and the market will fail you.

Dr. Bhaskar Dasgupta
Chairman, Caravella Asset Management
Regulated by the IFSCA, GIFT City

𝐋𝐞𝐚𝐝𝐞𝐫𝐬𝐡𝐢𝐩 𝐒𝐩𝐨𝐭𝐥𝐢𝐠𝐡𝐭 : 𝐀𝐦𝐢𝐭 𝐁𝐡𝐚𝐫𝐠𝐚𝐯𝐚

Amit Bhargava, CISA, CEH has been appointed as Chief Information Security Officer (CISO) at TATA AIG General Insurance Company Limited, strengthening the organization’s cybersecurity leadership amid accelerating digital transformation in the insurance sector.

In this role, Amit will lead cybersecurity strategy, risk management, and digital resilience initiatives, ensuring the protection of critical systems, customer data, and digital platforms. His focus will be on strengthening cyber resilience, embedding security within digital innovation, and enabling secure business growth in an increasingly digital-first environment.

Amit brings extensive experience in information security across banking and financial services. Prior to joining Tata AIG, he held key leadership roles at Axis Bank, Yes Bank, OakNorth, AU Small Finance Bank, and Union Bank, where he led enterprise security programs and advanced cyber defense frameworks.

With deep expertise in threat management, cyber risk governance, and security operations, Amit Bhargava is expected to play a pivotal role in reinforcing Tata AIG’s commitment to digital trust and secure financial services.

#CISO #CyberSecurity #Leadership #DigitalTrust #CyberResilience #InformationSecurity #EnterpriseSecurity #FinancialServices #RiskManagement #SecurityLeadership #DigitalTransformation #CXO #LeadershipAppointments

Vivek Bhattacharya | Kaumudi Vaidya | Gayatri Chavan | Snehashish Chakkravarty | Archana Jaiswar |Ritesh Alim |Bimalendu Adhikari |Pravin kumar pujari |Harini Nadar|SKILL AI| Rahela Khadde|Krishnapriya K Pradeep