New Paradigm of IT Risk: Where Do You Stand?
•Download as PPTX, PDF•
0 likes•296 views
The document discusses new paradigms in IT risk management at the National Stock Exchange of India. It notes that the exchange processes close to one billion transactions daily across India and relies on high-bandwidth infrastructure. However, digital business trends like data breaches, cyber attacks, and threats from mobile and cloud technologies are increasing IT risk. The document advocates adopting an end-to-end approach to IT security across governance, operations, identity and access management to safeguard information from origin to destination. It emphasizes strategic alignment of security with business needs to enable security as a differentiator.
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Similar to New Paradigm of IT Risk: Where Do You Stand?
Similar to New Paradigm of IT Risk: Where Do You Stand? (20)
More from Rahul Neel Mani
More from Rahul Neel Mani (20)
Recently uploaded
Recently uploaded (20)
New Paradigm of IT Risk: Where Do You Stand?
- 1. New paradigm of IT Risk – Where do you stand? Narayan Neelakantan Associate Vice-President Head IT Risk and Compliance & CISO National Stock Exchange Of India The Views expressed in this presentation are those of the presenter and do not necessarily reflect the views of National Stock Exchange
- 2. NSE at a Glance • NSE is the nerve center of the Indian Economy • NSE is the largest exchange in the world in terms of equity trade volumes • Today’s operational requirements of Exchange • Real Time Online trading • Availability of Information • Full Transparency • Nation Wide Reach • Guaranteed Settlement Cycles • IT enabled
- 3. Reliability Challenge NSE Today • Nationwide Reach via High Resiliency High Bandwidth and Secure Backbone Infrastructure • 6,000+ connections (Both Terrestrial and Satellite) • 1,500+ Locations • 1,000+ Members • 2,20,000+ Terminals • Processing close to One Billion transactions every day • COLO – Colocation for High Frequency Trading
- 4. Digital business trends *Source: www.wearesocial.sg
- 5. • Average cost of a data breach has reached whopping $3.79 million • In the past five years, data breaches have cost companies & individuals nearly $150 billion • 34.2% of user computers were subjected to at least one web attack over last year. • More than 30% of attacks to organizations last year were driven by internal employees • 1510+ DDoS attacks reported on Akamai routed networks alone, in Q3 2015 • India stands first in a list of countries where DDoS originates and cybercriminals can get DDoS attacks on hire for Rs. 300 for a three-minute assault. • More than 4 Financial Institutions faced DDoS in last 6 months in India. IT Risk Trends
- 6. Increased Attack Surface Network/Storage/Database Application Weakness User Privilege
- 7. Top Fast Growing Threats MOBILEWARESPEAR PHISHING INTERNET OF THINGS SECURITY RANSOMWARE CLOUD SECURITY HACKTIVISM
- 8. New Paradigm Requires Differential Approach
- 9. Business Value Of Risk *Source: The Gartner Strategic Risk Evaluation Approach for Digital Business Organizations must shift focus from Technology to Business Information Governance
- 10. Strategic Risk Evaluation Approach *Source: The Gartner Strategic Risk Evaluation Approach for Digital Business
- 11. • Security needs to possess an end-to-end property, else security breaches are possible at the interfaces • Baseline security controls for entire ecosystem • More stringent controls and countermeasures for business critical systems • Safeguarding information from point of origin to point of destination in a communication system. End-To-End IT Security
- 12. End-To-End IT Security Governance Risk & Compliance IT Policies & Metrics Support to Security IT Audits Regulatory Compliance Audits Third Party Risk Assessments Business Continuity Management Training & Awareness Systems Security Threat Modeling Security Architecture Social Engineering Vulnerability Assessment & Mgmt Penetration Tests Secure SDLC Identity & Access Management Access Management Life Cycle Entitlement Reviews IDM Platform Implementation Privilege Identity Management Security Operations Cyber Security Command Center Data Protection IDS/IPS/Firewall Monitoring Anomaly Detection Security Intelligence Forensics Cloud Security Business Assessment Architecture Design Security Testing & Validation Assessing Compliance Requirements
- 13. • Strategic alignment with business • Security as a business enabler and differentiator • IT GRC and cyber security must work in unison • End to End Security • Integrated Situational Awareness Summary
- 14. QUESTIONS?
Editor's Notes
- I come from
- Scope of IT Infra dependence considering critical infra
- This dependence is Global phenomenon. Some global digital fact file
- IOT, Probability of risk materializing increases significantly if the actor is a nation state. E.g. Nation state vs run of the mill hacker. hackers, password crackers, information leakers, internal attacks, and naive users are likely to continue to be a fact of life, while business evolution will force further exposure IT managers face continuous, onerous cycles of development and maintenance. IT security solutions will need to be continually updated, in ever faster cycles, to remain effective: they will need more frequent patches, upgrades, support, and perhaps replacement to provide the same amount of value tomorrow. Breaches have moved from bank accounts to data. 1510+ DDoS attacks were reported on Akamai routed networks alone, in a quarter, where more than half were ranging between 400 Mbps and 5 Gbps
- There is a real need, thus, to bring together policy, management and implementation considerations that could influence effectiveness assurances w.r.t business. Actionable Risk inputs
- In providing an E2E solution for IT security and user access control, we should recognize the need to integrate and provide for a number of core capabilities in IT security solutions, including: tamperproof cryptographic credentials; authentication; authorization; centralized user administration; control delegation; access control; session control; no single point of control; least privilege; data confidentiality; data integrity; non-repudiation; spoof prevention; and immediate suspension as well as immediate revocation of credentials.
- In providing an E2E solution for IT security and user access control, we should recognize the need to integrate and provide for a number of core capabilities in IT security solutions, including: tamperproof cryptographic credentials; authentication; authorization; centralized user administration; control delegation; access control; session control; no single point of control; least privilege; data confidentiality; data integrity; non-repudiation; spoof prevention; and immediate suspension as well as immediate revocation of credentials.