Zakaria Mohammed

🔴🟠🟢 𝐈𝐦𝐩𝐨𝐫𝐭𝐚𝐧𝐭 𝐟𝐫𝐞𝐞 𝐫𝐢𝐬𝐤 𝐚𝐬𝐬𝐞𝐬𝐬𝐦𝐞𝐧𝐭 𝐬𝐢𝐭𝐞𝐬 🔸 ISO 27005 ISO standard for assessing security risks. The appendix contains very valuable information. Link: https://lnkd.in/dYAFefJz Note: This is the only source that requires a cost to download the framework. 🔸 NIST 800-30 A federal standard for risk assessment and is a basic reference used by many professionals. Link: https://lnkd.in/dG6y64SX 🔸 CIS RAM - Risk Assessment Method CIS offers practical and workable resources, with many ready-made templates. Link: https://lnkd.in/dsANM4mb 🔸 FAIR Institute A framework that is specifically used to estimate risks in a quantitative manner. Link: https://lnkd.in/dmakViCH 🔸 HIPAA Risk Analysis Directed to healthcare professionals and is considered a mandatory reading for compliance with HIPAA standards. Link: https://lnkd.in/dCY_S7Uc 🔸 ISACA Guidance on Risk Assessments ISACA provides comprehensive guidance on risk assessment developed by experts in the field. Link: https://lnkd.in/deWH3cfu 🔸 PCI DSS Guidance on Risk Assessment A guide dedicated to risk assessment from the perspective of the popular PCI DSS standard. Link: https://lnkd.in/duKdWsjg 🔸 Health IT Security Risk Assessment Tool Free government tools and forms for risk assessment in health information technology. Link: https://lnkd.in/dshHew2q 🔸 Cloud Security Alliance Octagon Model An essential cloud risk assessment resource for any cloud computing professional. Link: https://lnkd.in/dGX-deeC 🔸 AWS, GCP, and Azure Risk Assessment Guidelines AWS: https://lnkd.in/dZA-hSAF GCP: https://lnkd.in/dZhBdsFu Azure: https://lnkd.in/djq3jY48 Guidance provided by leading cloud computing platforms for risk assessment. 🔸 fullCircle GRC Risk Register A risk log management tool with definitions and practical examples. Link: https://lnkd.in/dJRNnHyp Thank you ‪Mohammed AlSubayt, CRISC for sharing. #riskassessment #cybersecurity #riskmanagement

١٢٩

١١ تعليق

🚨 CERT-In Releases Technical Guidelines on SBOM, QBOM, CBOM, AIBOM & HBOM The Indian Computer Emergency Response Team (CERT-In) has released Version 2.0 of its technical guidelines on the Software Bill of Materials (SBOM), now significantly expanded to cover five critical domains: 1. SBOM – A detailed list of all software components, including third-party elements, used in a software product. It helps identify and mitigate vulnerabilities within the codebase. 2. QBOM – Focuses on components related to quantum computing and quantum-safe cryptography. It inventories quantum algorithms and security frameworks, aiding organizations in preparing for and adopting post-quantum cryptographic (PQC) solutions. 3. CBOM – An inventory of all cryptographic assets such as algorithms, encryption keys, and security protocols used within an organization. It helps in ensuring transparency and up-to-date security measures. 4. AIBOM – A comprehensive list of all components used in the development, training, and deployment of AI models, including hardware (e.g., GPUs), software frameworks, and datasets. AIBOMs are becoming essential for ensuring security, transparency, compliance, and risk management in AI systems. All organizations involved in AI-driven development and services are advised to include AIBOM requirements in all AI-related procurements and solutions. 5. HBOM – A list of all physical components, such as servers, networking gear, and storage devices that make up a hardware system. It helps in tracking, auditing, and managing hardware-related risks. These guidelines are especially relevant for government bodies, public sector units, essential services organizations, and entities involved in software exports and software services. It is aimed at: 1. Software Consumers – Organizations that purchase and use software to support operations. 2. Software Developers – Entities that build and maintain custom software solutions. 3. System Integrators / Software Resellers – Organizations that distribute software products and provide related services. By adopting these guidelines, organizations can bolster security, accelerate incident response, identify and patch vulnerabilities more efficiently, mitigate supply chain risks, ensure regulatory compliance, and enhance overall operational resilience. This is an essential step in building more secure, transparent, and future-ready digital ecosystems. 👉 Link to the full guidelines is in the comments. #ai #india #aigovernance #cybersecurity [This post is for educational purposes only and does not constitute legal advice. The views expressed herein are personal and not reflective of any institution or company. Likes or interactions with this content do not imply endorsements.]

١٧

١ تعليق واحد

🚨 Is NIST Cybersecurity Framework (CSF) Gaining Momentum in the GCC ?🌍🔐 Cybersecurity is no longer just an IT concern — it’s a boardroom priority. Across the GCC, organizations are increasingly adopting the NIST CSF to align with international best practices while meeting local regulatory demands. Here’s why NIST CSF could be making waves in the region: ✅ Globally recognized and business-aligned ✅ Flexible enough for startups and large enterprises alike ✅ Easily mapped to local standards like NCA ECC, DESC, and SAMA ✅ Supports national cybersecurity strategies across UAE, KSA, and beyond ✅ Facilitates risk-based, outcomes-driven security programs ✅ Widely supported by security vendors and audit firms In a region rapidly accelerating digital transformation, NIST CSF is proving to be a solid foundation for resilience, compliance, and trust. Is your organization leveraging NIST CSF yet? Let’s talk cyber maturity, risk alignment, and building trust in a connected world. 💬👇 #Cybersecurity #NISTCSF #GCC #DigitalTransformation #RiskManagement #CISO #Compliance #NCA #SAMA #DESC #CyberResilience #Governance #MiddleEast #GRC #MiddleEastCyber

٣٩

٤ تعليق

The "Comprehensive Cyber Security Audit Policy Guidelines" issued by CERT-In (Version 1.0, dated 25.07.2025) serves as an authoritative framework for conducting cyber security audits in India. 🔐 Purpose To provide a structured, standardized, and enforceable process for conducting cyber security audits across organizations in both public and private sectors, ensuring consistency, quality, and regulatory compliance. 🏛️ Issued By Indian Computer Emergency Response Team (CERT-In), Ministry of Electronics and Information Technology, Government of India, under powers granted by the IT Act, 2000 (Section 70B). 🎯 Key Objectives 1. Standardization of audit processes and reporting. 2. Clarity in roles and expectations of auditors and auditees. 3. Continuous improvement in security posture through systematic findings and remediation. 👥 Applicability CERT-In empaneled auditors. Auditee organizations (both public and private) seeking security assurance and regulatory compliance. 📋 Scope of Audits Covers a wide range of audits including: Compliance & risk assessments Penetration testing & vulnerability assessments Network & application security audits Cloud, AI, IoT, blockchain, ICS/OT, and mobile app audits SBOM, QBOM, AIBOM evaluations Red team exercises, forensic readiness, physical & wireless security 🧭 Audit Principles Auditors must ensure: Independence & objectivity Confidentiality & integrity Professional competence & due care Transparent, evidence-based reporting 🏗️ Frameworks & Standards Use of: ISO/IEC, OSSTMM3, OWASP (ASVS, MSTG), CSA CCM, and CERT-In guidelines Avoid reliance on limited lists like OWASP Top 10 or SANS 25 alone CVSS & EPSS scoring mandatory for vulnerabilities 🎯 Responsibilities Auditee: Owns and manages cybersecurity; responsible for defining scope, remediation, and risk handling. Auditor: Evaluates systems impartially; must follow strict data handling and competency protocols. 📜 Audit Execution Annual mandatory audit (minimum) Formal agreements, NDAs, and clearly defined scopes Secure handling of data, test approvals, and ethical practices are mandatory CERT-In must be updated within 5 days of audit completion ✅ Quality Control & Selection Auditor selection should be based on CERT-In’s published snapshot data (skills, tools, history) Clear contractual terms with escalation clauses, retention rules, and compliance verification Feedback and complaint mechanisms are encouraged for quality improvement

٤٩

٤ تعليق

𝐒𝐄𝐁𝐈 𝐓𝐢𝐠𝐡𝐭𝐞𝐧𝐬 𝐭𝐡𝐞 𝐑𝐞𝐢𝐠𝐧𝐬 𝐨𝐧 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 & 𝐂𝐲𝐛𝐞𝐫 𝐑𝐞𝐬𝐢𝐥𝐢𝐞𝐧𝐜𝐞 𝐅𝐫𝐚𝐦𝐞𝐰𝐨𝐫𝐤 (𝐂𝐒𝐂𝐑𝐅)- SEBI’s latest circular (dated August 28, 2025) is a clear signal that the time for delays on CSCRF compliance is over. 𝐊𝐞𝐲 𝐓𝐚𝐤𝐞𝐚𝐰𝐚𝐲𝐬 𝐟𝐨𝐫 𝐒𝐄𝐁𝐈-𝐑𝐞𝐠𝐮𝐥𝐚𝐭𝐞𝐝 𝐄𝐧𝐭𝐢𝐭𝐢𝐞𝐬 (𝐑𝐄𝐬) 𝟏. 𝐀𝐩𝐩𝐥𝐢𝐜𝐚𝐛𝐢𝐥𝐢𝐭𝐲 𝐨𝐟 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 & 𝐂𝐲𝐛𝐞𝐫 𝐑𝐞𝐬𝐢𝐥𝐢𝐞𝐧𝐜𝐞 𝐅𝐫𝐚𝐦𝐞𝐰𝐨𝐫𝐤 (𝐂𝐒𝐂𝐑𝐅) CSCRF applies to all SEBI-regulated entities (REs) – AIFs, Stock Brokers, Depositories, Custodians, Mutual Funds, Credit Rating Agencies, Portfolio Managers, Merchant Bankers, etc. If an RE is also regulated by another regulator (e.g., RBI), then: Principle of Exclusivity: SEBI’s scope applies to systems exclusively used for SEBI activities. Principle of Equivalence: If REs comply with their primary regulator’s cybersecurity framework (e.g., RBI), then SEBI will accept it as equivalent compliance. 𝟐. 𝐓𝐞𝐜𝐡𝐧𝐢𝐜𝐚𝐥 𝐂𝐥𝐚𝐫𝐢𝐟𝐢𝐜𝐚𝐭𝐢𝐨𝐧𝐬 Critical Systems: Includes all systems (on-prem & cloud) that affect core business, store/transmit regulatory data, client-facing apps, internet-facing systems, and systems on the same network segment. Zero Trust: REs must adopt zero-trust, segmentation, no single point of failure – with IT Committee approval. Mobile App Security: Guidelines are recommendatory (not mandatory). Cyber Incident Reporting: Follow approved Cyber Crisis Management Plan (CCMP) for public disclosure & communication. Security Solutions: Use threat simulation, VAPT, decoy systems – recommended, not mandatory. VAPT & Cyber Audit Reports: Submit only summaries (not detailed vulnerabilities) unless asked. ISO 27001 Certification: Recommended, not mandatory, for qualified REs. Market-SOC Onboarding: Small & self-certified REs must join NSE/BSE Market-SOC unless they maintain their own SOC. Business Continuity: Recovery Time Objective (RTO) = 2 hours, Recovery Point Objective (RPO) = 15 mins for critical systems. 𝐂𝐥𝐚𝐫𝐢𝐟𝐢𝐜𝐚𝐭𝐢𝐨𝐧𝐬 𝐟𝐨𝐫 𝐒𝐄𝐁𝐈-𝐑𝐞𝐠𝐮𝐥𝐚𝐭𝐞𝐝 𝐄𝐧𝐭𝐢𝐭𝐢𝐞𝐬 Overlap with RBI/IRDA Guidelines – If already compliant with RBI/IRDA cyber framework, SEBI accepts equivalence. Audit Reporting – Only summaries to SEBI unless specifically asked for details. ISO 27001 – Strongly encouraged, but not compulsory. Market-SOC – Mandatory for small/self-certified REs without their own SOC. Incident Recovery – REs must ensure 2-hour recovery for critical systems, as per IOSCO guidance. Supply Chain Risk – Assess third-party risks with IT Committee oversight. Cloud Compliance – SEBI’s cloud adoption framework applies; REs must ensure compliance with Annexure-J of CSCRF.

٣٥

٢ تعليق

🔐 India’s CERT-In Releases SBOM Guidelines – Is Your Organization Ready? The Indian Computer Emergency Response Team (CERT-In) has released comprehensive guidelines on Software Bill of Materials (SBOM) to enhance software supply chain security and transparency. These guidelines emphasize the need for: - Comprehensive SBOM generation - Ingestion and storage of SBOMs - Mapping software components to IT assets - Vulnerability identification and remediation - Integration across DevSecOps and ITSM environments At Eracent, we are proud to align closely with these directives: 🔎 SBOM Ingestion & Normalization – Our platform ingests SBOMs in multiple formats (CycloneDX, SPDX, etc.) and normalizes the data for correlation and analysis. 🔗 Asset Mapping & Enrichment – We link SBOM components to live assets across your environment for real-time visibility. ⚠️ Vulnerability Management – Identify and assess risks with CVE matching, exploitability scoring, and remediation workflows. 🛡️ Security & Compliance – Support for secure development, third-party risk management, and regulatory compliance (including ISO, NIST, and now CERT-In). Eracent helps you move from SBOM generation to actionable insights—ensuring you are not just compliant but truly secure. 📥 Want to see how we can help your organization meet CERT-In’s SBOM requirements? Let’s talk. #Eracent #SBOM #CyberSecurity #CERTIn #SoftwareSupplyChain #DevSecOps #ITAM #VulnerabilityManagement #India #SecurityCompliance #SoftwareSecurity

٨

Cybersecurity 101: Continuous Auditing Automation: Adaptive Assurance in a Changing Risk Landscape India's Digital Adoption grows exponentially. We have multiple regulators & their robust security control requirements published - RBI, ReBIT, CERT-IN, NPCI, NETC, UIDAI & SEBI. A periodical audit will not suffice for the scale & the speed of change in the Produdct delivery. "Continuous Audit Automation" is a thought where the preventive controls can be embedded in deployment automations, detective controls can be put in place for identifying any run-time drift, real-time visibility.  This will reduce the load of your team during audit & Engineering on the fixes required in real time. Here's an opportunity to discuss about this topic with Information Security Auditors on empowering the audit with automation at ISACA Chennai Chapter(Official) during #ISACA Chennai Conference 2025 (#ICC2025). Date     : 13th September 2025 Time    : 09:30 am - 10:20 am  Track    : A05 Location: Hyatt Regency, Anna Salai, Chennai #cybersecurity101 #audit #auditautomation #ISACA #conference

٧٧

٧ تعليق

🚨 ₹4.58 Crore Fraud by Bank Employee – A Wake-Up Call for Internal Controls, Cybersecurity & Ethical AI in Finance A shocking case has emerged from Kota, Rajasthan, where a former ICICI Bank relationship manager, Sakshi Gupta, allegedly defrauded 41 customers over three years, siphoning off ₹4.58 crore from Fixed Deposit accounts—only to lose it all in the stock market. How Did This Happen? Between 2020-2023, the employee exploited systemic weaknesses by: 📍Unauthorized Access – Accessed 110+ customer accounts using her position. 🧮Bypassed Security – Changed linked mobile numbers to block OTP alerts, replacing them with family members' numbers. 🧮 Silent Withdrawals – Used the ‘User FD’ system to withdraw funds without triggering alarms. 🧮OTP Manipulation – Built a method to intercept OTPs without raising suspicion. Despite her scheme, all stolen funds were lost in high-risk stock market bets, proving that greed has no happy ending. 📍Key Failures & Lessons for Professionals 📌Internal Audit Gaps – How did unauthorized transactions go undetected for three years? This highlights critical lapses in real-time monitoring and branch-level oversight. 📌 Cybersecurity Weaknesses – Fraudsters exploit weak authentication controls. Banks must strengthen multi-factor authentication (MFA) and AI-driven anomaly detection. 📌Ethical AI & Automation – Could AI-powered fraud detection have flagged suspicious transactions earlier? Predictive analytics must be part of internal audits. 📌Risk Culture – Employees handling sensitive data must undergo rigorous ethics training. Compliance isn’t just about policies—it’s about ingrained accountability. The Aftermath ✏️ ICICI Bank filed an FIR, settled customer claims, and suspended the employee. ✏️Police arrested the accused on May 31, 2025, after a detailed probe. Moving Forward: A Call to Action ✏️ For Banks – Strengthen internal controls, AI-driven audits, and real-time transaction monitoring. ✏️ For Auditors & Risk Professionals – Evolve compliance frameworks to detect insider threats faster. ✏️ For Customers – Monitor accounts regularly and enable transaction alerts. ✏️For FinTech & Cybersecurity Experts – Build fraud-resistant systems with behavioral biometrics and adaptive authentication. This case isn’t just about fraud—it’s a warning for the financial sector. Trust is fragile, and integrity must be non-negotiable. Let’s work towards a secure, transparent, and ethical financial ecosystem. #InternalAudit #Cybersecurity #AIinFinance #BankFraud #RiskManagement #EthicalBanking #Compliance #FraudDetection #FinTech #StockMarketRisks Would love to hear your thoughts—how can banks and auditors prevent such breaches in the future? 💬👇

٥٣

٣ تعليق

ISO/IEC 42005 2025 Information technology Artificial intelligence AI system impact assessment What is ISO/IEC 42005? ISO/IEC 42005 provides guidance for organisations conducting AI system impact assessments. These assessments focus on understanding how AI systems — and their foreseeable applications — may affect individuals, groups, or society at large. The standard supports transparency, accountability and trust in AI by helping organisations identify, evaluate and document potential impacts throughout the AI system lifecycle. Why is ISO/IEC 42005 important? AI technologies are rapidly reshaping industries, economies and daily life — offering immense benefits, but also raising ethical, social and environmental concerns. ISO/IEC 42005 plays a crucial role in ensuring these impacts are responsibly addressed. By guiding organisations through structured impact assessments, it enables them to align AI development with values such as fairness, safety, and human-centred design. It also supports broader governance and risk management practices, reinforcing trust and societal acceptance of AI systems. Benefits • Strengthens stakeholder trust through transparent impact documentation • Supports responsible innovation by addressing social and ethical risks • Enhances alignment with governance, risk and compliance frameworks • Improves internal decision-making and accountability across the AI lifecycle • Encourages consistency and clarity in AI-related impact reporting Introduction 1 Scope 2 Normative references 3 Terms and definitions 4 Abbreviated terms 5 Developing and implementing an AI system impact assessment process 5.1 General 5.2 Documenting the process 5.3 Integration with other organizational management processes 5.4 Timing of AI system impact assessment 5.5 Scope of the AI system impact assessment 5.6 Allocating responsibilities 5.7 Establishing thresholds for sensitive uses, restricted uses and impact scales 5.8 Performing the AI system impact assessment 5.9 Analysing the results of the AI system impact assessment 5.10 Recording and reporting 5.11 Approval process 5.12 Monitoring and review 6 Documenting the AI system impact assessment 6.1 General 6.2 Scope of the AI system impact assessment 6.3 AI system information 6.4 Data information and quality 6.5 Algorithm and model information 6.6 Deployment environment 6.7 Relevant interested parties 6.8 Actual and reasonably foreseeable impacts 6.9 Measures to address harms and benefits Annex A Guidance for use with ISO/IEC 42001 Annex B Guidance for use with ISO/IEC 23894 B.1 General B.2 Differences between risk management and AI system impact assessment B.3 Risk management principles related to AI system impact assessment Annex C Harms and benefits taxonomy Annex D Aligning AI system impact assessment with other assessments Link: https://lnkd.in/geGEdhMw?

١٦

١ تعليق واحد

From Chernobyl to Cybersecurity! How “Safety Culture” Became the North Star for OT Security ======================================= The Wake-Up Call - April 1986 A late-night safety test simulating a total power outage at Reactor 4 went off-script. Operators overrode protections, a design flaw kicked in, and a runaway power surge ruptured the core. The resulting steam explosion and graphite fire ejected ~5 % of the reactor’s radioactive inventory into the atmosphere. Chernobyl is one of only two events ever rated Level 7 (major accident) on the International Nuclear Event Scale, the other is Fukushima 2011. Safety culture moved safety from a technical checkbox to an overriding mindset: every decision, design, operations, or incident response must prioritize human life and the environment. 💡Takeaways: - Design for failure: Assume control layers will break or be breached. - Test like it’s live: Exercise cyber-safety scenarios with the same rigor as process-safety drills. - Measure what matters: Track safety-relevant cyber KPIs Such gaps can turn even minor incident into operational shutdowns, equipment damage, personnel injuries, and environmental harm. #Bradleyrollins #SafetyCulture #OTSecurity #IndustrialCyber #RiskManagement

٢٧

٢ تعليق

#Relief for SEBI Regulated Entities: CSCRF Compliance Deadline Extended 📆 Good news for all SEBI-regulated entities! SEBI has officially extended the compliance deadline for the Cybersecurity and Cyber Resilience Framework (CSCRF) by three months, now set for June 30, 2025. This extension comes in response to multiple requests from regulated entities to ensure smoother implementation and adherence to cybersecurity measures. However, it’s important to note that this extension does not apply to: ✅ Market Infrastructure Institutions (MIIs) ✅ KYC Registration Agencies (KRAs) ✅ Qualified Registrars to an Issue and Share Transfer Agents (QRTAs) For all other regulated entities, 🕰️ this additional time provides an opportunity to strengthen cybersecurity measures and ensure full compliance with SEBI’s CSCRF guidelines. 🔹 Next Steps: Ensure your organization is on track with the updated compliance timeline. Let’s use this time effectively to enhance cyber resilience across the financial ecosystem. Newtons Apple has been helping REs since 2019 to stay ahead of the curve by being compliant. Have you booked your call yet - https://lnkd.in/duEnJ4na For the official SEBI circular, visit [www.sebi.gov.in]. #CyberSecurity #SEBI #CSCRF #RegulatoryCompliance #FinTech #RiskManagement #Governance

٢٤

٢ تعليق

🚨 New CERT-In Guidelines: Annual Cybersecurity Audits Now Mandatory 🚨 The Indian Computer Emergency Response Team (CERT-In) has rolled out mandatory annual third-party cybersecurity audits for all organizations—public and private. Key Highlights: 🔹 Annual Audit – At least once a year, risk-based & domain-specific. 🔹 Triggers for Extra Audits – Major tech migrations or configuration changes. 🔹 Scope – Risk & vulnerability assessments, penetration testing, network audits, source code review. 🔹 Access Controls – “Least privilege” enforcement. 🔹 Remote Access – Tunnelling, encryption, logging & mandatory MFA. 🔹 Auditors – Only CERT-In empanelled firms (200+ listed) can conduct these audits. https://lnkd.in/d9uQpUWX

٥٧

٤ تعليق