Indian stock markets given ten day deadline to file infosec report, secure board signoff

Indian IT shops have been handed another extraordinarily short deadline within which to perform significant infosec work. This time the source of the edict is the Securities and Exchange Board of India, which on May 20 published a modified version of the "Cyber Security and Cyber Resilience framework" that applies to market …

[Paul Crawford]

Can the Indian government respond in any meaningful way to its citizens in 10 days?

[Headley_Grange]

Shirley...?

Surely any organization that takes security seriously will have already done most of the donkey work already and the only rushed aspect will be to convene the board and put the relevant information in front of them for them to approve.

Won't they??

[Pascal Monett]

Re: Shirley...?

There is a world of difference between securing a network and documenting it, and another world of difference between documenting it and writing a government-mandated report.

I take it you haven't written any government reports. I have written a few (unfortunately), and it is not something I enjoy doing in the slightest.

[Headley_Grange]

Re: Shirley...?

If you don't document what you do then it might as well be considered not done. How many of us have ended up in world of pain because stuff was being done, but not documented, so it either needed checking or, and often easier, doing again just to confirm that it had been done.

I agree about government reporting (I've done it but in UK and US, not India), but if the article is correct then that's not what's needed.

"All MIIs are directed to communicate the status of the implementation of the provisions of this circular to SEBI within 10 days from the date of this circular."

If they've taken any of this seriously since 2015 (when the original requirements were published) then they only have to say that, in line with their current Cyber Security and Cyber Resilience Framework Policies and Procedures they are auditing their estate in light of the new requirements and will update the P&Ps and relevant audit/test/HR/reporting/risk/etc. plans to include the new requirements. Then they attach their plan and schedule to finish these updates and an outline/draft plan with assumptions (they haven't finished the audit yet) to meet the new framework requirements.

For a large company this is still a fair bit of work but if they take cyber security and resilience seriously and make it part of their everyday work they ought to be able to produce something that will demonstrate they are on top of it. Of course, if they've done fuck all since 2015 then they can still report on this. The report will be a lot of management speak for "we've done fuck all" and the plan and schedule might be a bit vague and run out a few years, but they could still meet the letter of the "communicate the status....".

[Anonymous Coward]

Indian IT

What could possibly go wrong.

[Pascal Monett]

And if it doesn't happen in 10 days ?

What if the companies simply don't respond in the allotted time span ?

Is there any hint of a fine anywhere ?

On the other hand, they could respond with a basic report and mention "See Appendix . . ." for all precisions, the appendices being sent 30 days later.

This whole attitude smacks of useless pressure from administrative busybodies who grant themselves a lot more importance than they have.

Businesses don't want to be hacked. Most of them do want to be secure, and a fair proportion of them actually put money on the table for that. The thought behind this new rule may be commendable, but granting a 90-day delay (given that businesses are already on a 60-day delay for something else) wouldn't kill the donkey.

[Mike 137]

Criticality?

"Among the modifications, equipment rated "critical" and therefore subject to regular security review and testing has been expanded to any internet-facing application, and any system that stores personally identifiable information. Anything that interacts with other critical systems for operations or maintenance is now also classified as critical."

Was the businesswise relatively unimportant server on which some bod ('for convenience') at Equifax saved a clear test list of the access credentials for numerous other functionally important servers 'critical'?

Making blanket rules based on lists is a sure fire way to miss the elephants in the office, as such rules always either have insufficient coverage or they get so complicated and detailed that they can't be maintained (or indeed in some cases even implemented). Also, as is commonly the case for PCI DSS, such rules can result in everything not on the list being left wide open because attention is focused primarily on 'compliance' with the rules.

What's really needed for adequate security is constant attention to and monitoring of the actualities of each individual organisation's infrastructure in the context of its purposes and risks. That requires knowledgeable, dedicated personnel - and that requires sufficient resourcing. As ISO/IEC 27001 states, top management are responsible for information security, at least insofar as they must provide the authority and finance for the job to be done properly.

Leaving security to the IT department to manage out of its local budget is a sure path to failure, as is following the letter of externally generated rules at the expense of keeping in touch with what's actually happening.

[vtcodger]

How fun

I think maybe if you are an Indian IT worker, grabbing a begging bowl and setting off to wander the countryside is probably beginning to look like an attractive alternative future. Better perhaps than living in constant fear of what short-deadline task the government is going to impose on you next.