Santhosh Govindhan

🚨 CERT-In Releases Technical Guidelines on SBOM, QBOM, CBOM, AIBOM & HBOM The Indian Computer Emergency Response Team (CERT-In) has released Version 2.0 of its technical guidelines on the Software Bill of Materials (SBOM), now significantly expanded to cover five critical domains: 1. SBOM – A detailed list of all software components, including third-party elements, used in a software product. It helps identify and mitigate vulnerabilities within the codebase. 2. QBOM – Focuses on components related to quantum computing and quantum-safe cryptography. It inventories quantum algorithms and security frameworks, aiding organizations in preparing for and adopting post-quantum cryptographic (PQC) solutions. 3. CBOM – An inventory of all cryptographic assets such as algorithms, encryption keys, and security protocols used within an organization. It helps in ensuring transparency and up-to-date security measures. 4. AIBOM – A comprehensive list of all components used in the development, training, and deployment of AI models, including hardware (e.g., GPUs), software frameworks, and datasets. AIBOMs are becoming essential for ensuring security, transparency, compliance, and risk management in AI systems. All organizations involved in AI-driven development and services are advised to include AIBOM requirements in all AI-related procurements and solutions. 5. HBOM – A list of all physical components, such as servers, networking gear, and storage devices that make up a hardware system. It helps in tracking, auditing, and managing hardware-related risks. These guidelines are especially relevant for government bodies, public sector units, essential services organizations, and entities involved in software exports and software services. It is aimed at: 1. Software Consumers – Organizations that purchase and use software to support operations. 2. Software Developers – Entities that build and maintain custom software solutions. 3. System Integrators / Software Resellers – Organizations that distribute software products and provide related services. By adopting these guidelines, organizations can bolster security, accelerate incident response, identify and patch vulnerabilities more efficiently, mitigate supply chain risks, ensure regulatory compliance, and enhance overall operational resilience. This is an essential step in building more secure, transparent, and future-ready digital ecosystems. 👉 Link to the full guidelines is in the comments. #ai #india #aigovernance #cybersecurity [This post is for educational purposes only and does not constitute legal advice. The views expressed herein are personal and not reflective of any institution or company. Likes or interactions with this content do not imply endorsements.]

17

1 Comment

🔗 Why Integrated Cybersecurity Controls Matter in Multi-Compliance Organizations In today’s digital landscape, compliance is no longer a checklist — it’s a convergence. Organizations operating under multiple frameworks like PCI DSS, ISO 27001, SOX, GDPR, and RBI Cybersecurity quickly realize that managing siloed controls leads to duplication, inefficiency, and audit fatigue. That’s where Integrated Cybersecurity Control Mapping becomes essential. By aligning security, governance, and compliance under a unified control register, we can: ✅ Eliminate redundancy — One control can often satisfy multiple standards. ✅ Ensure consistency — A single source of truth for evidence, ownership, and maturity. ✅ Simplify audits — Unified evidence reduces audit turnaround and friction. ✅ Increase visibility — Maturity heatmaps and dashboards highlight weak spots across frameworks. ✅ Enhance resilience — Continuous monitoring and risk-based prioritization keep all regulatory expectations aligned. In our recent exercise, we built a FinTech-grade unified control register mapping PCI DSS v4.0 + ISO 27001:2022 + SOX + RBI Cybersecurity Framework, creating one view of 100+ detailed, audit-ready controls — each with ownership, maturity scoring, and evidence linkage. Integrated control governance isn’t just about passing audits — It’s about building sustainable cyber resilience across compliance universes. #CyberSecurity #Compliance #PCI #ISO27001 #RBI #SOX #FinTech #Governance #RiskManagement #InformationSecurity #Resilience

7

2 Comments

🚨 ₹4.58 Crore Fraud by Bank Employee – A Wake-Up Call for Internal Controls, Cybersecurity & Ethical AI in Finance A shocking case has emerged from Kota, Rajasthan, where a former ICICI Bank relationship manager, Sakshi Gupta, allegedly defrauded 41 customers over three years, siphoning off ₹4.58 crore from Fixed Deposit accounts—only to lose it all in the stock market. How Did This Happen? Between 2020-2023, the employee exploited systemic weaknesses by: 📍Unauthorized Access – Accessed 110+ customer accounts using her position. 🧮Bypassed Security – Changed linked mobile numbers to block OTP alerts, replacing them with family members' numbers. 🧮 Silent Withdrawals – Used the ‘User FD’ system to withdraw funds without triggering alarms. 🧮OTP Manipulation – Built a method to intercept OTPs without raising suspicion. Despite her scheme, all stolen funds were lost in high-risk stock market bets, proving that greed has no happy ending. 📍Key Failures & Lessons for Professionals 📌Internal Audit Gaps – How did unauthorized transactions go undetected for three years? This highlights critical lapses in real-time monitoring and branch-level oversight. 📌 Cybersecurity Weaknesses – Fraudsters exploit weak authentication controls. Banks must strengthen multi-factor authentication (MFA) and AI-driven anomaly detection. 📌Ethical AI & Automation – Could AI-powered fraud detection have flagged suspicious transactions earlier? Predictive analytics must be part of internal audits. 📌Risk Culture – Employees handling sensitive data must undergo rigorous ethics training. Compliance isn’t just about policies—it’s about ingrained accountability. The Aftermath ✏️ ICICI Bank filed an FIR, settled customer claims, and suspended the employee. ✏️Police arrested the accused on May 31, 2025, after a detailed probe. Moving Forward: A Call to Action ✏️ For Banks – Strengthen internal controls, AI-driven audits, and real-time transaction monitoring. ✏️ For Auditors & Risk Professionals – Evolve compliance frameworks to detect insider threats faster. ✏️ For Customers – Monitor accounts regularly and enable transaction alerts. ✏️For FinTech & Cybersecurity Experts – Build fraud-resistant systems with behavioral biometrics and adaptive authentication. This case isn’t just about fraud—it’s a warning for the financial sector. Trust is fragile, and integrity must be non-negotiable. Let’s work towards a secure, transparent, and ethical financial ecosystem. #InternalAudit #Cybersecurity #AIinFinance #BankFraud #RiskManagement #EthicalBanking #Compliance #FraudDetection #FinTech #StockMarketRisks Would love to hear your thoughts—how can banks and auditors prevent such breaches in the future? 💬👇

53

3 Comments

Lets talk about When Microsoft Blocked Nayara Energy: A Wake-Up Call for India's Digital Sovereignty Imagine showing up to work and suddenly losing access to Outlook, Teams, and your cloud files — even though you’ve paid for them! That’s exactly what happened to Nayara Energy recently when Microsoft suspended their services. The reason? Nayara, partly Russian-owned, was affected by EU sanctions, and Microsoft decided to enforce it globally — impacting their India operations. Why This Matters? Heavy reliance on foreign tech platforms leaves critical sectors vulnerable. Energy, defense, and essential services can be disrupted without warning. Legal grey areas emerge when foreign rules override domestic operations. The Key Lesson -> Sovereign Cloud This incident highlights the urgent need for India to invest in sovereign cloud infrastructure — locally controlled, legally compliant, and independent from foreign oversight. Ensures critical operations aren’t disrupted by external geopolitical or corporate decisions Keeps data within national jurisdiction, strengthening security and compliance Reduces dependence on global providers for mission-critical services Takeaways for Businesses & Leaders -Diversify your digital tools — avoid reliance on a single vendor. -Explore sovereign cloud options for critical systems. -Prepare for sudden disruptions — build digital resilience. Microsoft restored access after court intervention, but the episode is a stark reminder: critical operations require both digital and strategic independence. For leaders: How prepared is your organization if a key provider goes dark tomorrow? #DigitalSovereignty #SovereignCloud #NayaraEnergy #Microsoft #CloudComputing #BusinessContinuity #TechStrategy #India #CyberResilience

5

2 Comments

🚨 Critical IDOR vulnerability discovered - exposing taxpayer data through simple PAN number manipulation in web requests 🔓 Shockingly simple exploit - researchers could access unrelated individuals' sensitive information by just swapping PAN numbers 📊 Massive data exposure risk - full names, addresses, emails, phone numbers, Aadhaar details, and bank account information all vulnerable ⚠️ Low technical barrier - attack possible with basic tools like Postman or Burp Suite, requiring minimal expertise 💡 Classic security oversight - demonstrates how fundamental web security flaws can have severe real-world consequences #CyberSecurity #DataBreach #IDOR #WebSecurity #DataPrivacy #InfoSec #SecurityVulnerability #TaxData #CyberThreats #SecurityAwareness #DataProtection #krpoints Link in the first comment below.

9

1 Comment

🔥🔥IAM Learning Series 📖📖📖🙇‍♂️🙇‍♂️🙇‍♂️ 💥 Myth Buster Alert! 💥 Many believe static access is enough for companies — but that’s a myth! 🚫 Static access = outdated permissions & higher risk. ✅ Dynamic access = context-aware, time-bound, and secure. It’s not “overkilling” — it’s evolving access for modern threats 🔐 #MythBuster #CyberSecurity #IAM #AccessControl #ZeroTrust #DynamicAccess #IdentitySecurity #JITAccess #ZeroTrust #AccessManagement #cybersecurity #cyberawareness

5

My client was paying Rs 8.75 lakh ($10,500) a year for an enterprise security tool. But every time they opened the dashboard, they felt blank. Too many alerts. Too much noise. No idea what to act on. So they did what most teams do. They stopped opening it. That's when they missed it. One of their systems had a PowerShell script installed on it. That script was trying to make an outbound connection to a server controlled by an attacker. The goal: download files from it onto their machine. The firewall blocked it. This time. But nobody knew it happened. The alert was sitting in that dashboard nobody was opening. No investigation. No follow-up. Nobody asked where the script came from, who installed it, or whether it had run before. A firewall blocking a connection is not a win. It's a warning. It means something already got in. It means something tried to call home. It means the next attempt might find a different path. Paying for enterprise tools doesn't protect you. Someone watching what those tools find does.

57

20 Comments

Speed is not the goal of a SOC. Confidence is⏱️. Most SOCs are optimized for fast escalation. Alert fires → Ticket opens → Case escalates → Customer notified. Looks efficient on dashboards. Feels chaotic in real life. Because speed without confidence creates: 🔸 False urgency 🔸 Analyst burnout 🔸 Over-escalation 🔸 “Just in case” incidents A mature SOC is designed to answer one question before acting: 👉 Are we confident enough to be right? That confidence doesn’t come from: ❌ More alerts ❌ More playbooks ❌ More pressure It comes from: ✅ Context before escalation ✅ Time-boxed investigation ✅ Clear severity criteria ✅ Permission to say “not yet” Great SOCs don’t rush decisions. They control the pace of response. Fast response is impressive. A confident response is effective. Does your SOC reward speed — or sound judgment💬?

4

Most organisations misunderstand data breaches under the DPDP Act. They think a breach only means hacking. DPDP thinks very differently. Under India’s DPDP Act: A breach is not just a cyber attack Human error, misconfiguration, delayed response — all matter What regulators evaluate is how you responded, not just what happened Here’s the uncomfortable truth: Silence or delay after an incident increases regulatory risk more than the incident itself. Every breach is an incident. But not every incident is a breach. Yet every incident must be handled with discipline. This is exactly what I explain in Episode 15 of my DPDP Act Practical Series — focusing on: • Incident vs breach • DPDP’s definition of personal data breach • Common real-world causes • Why delayed response is risky DPDP compliance is not a checkbox. It’s operational maturity. Video link: https://lnkd.in/g7H-t-2e #DPDPAct #DataBreach #PrivacyCompliance #IncidentResponse #PrivacyEngineering #DataProtectionIndia

3

A day in the life of a SOC analyst is defined by one thing: time-to-clarity. Every alert, every escalation, every investigation hinges on how quickly an analyst can move from noise → signal → action. That’s why the evolution of the Microsoft Security Store matters so much. Security Agents built by our partners are reshaping the SOC workflow. Instead of stitching together tools, pivoting across portals, or manually enriching signals, analysts can now deploy agentic, task‑specific AI directly inside the Microsoft security ecosystem leveraging one or many of these capabilities built in Defender, Sentinel, Entra, Purview, or Intune. These Security Agents give analysts real advantages: 1) Autonomous reasoning that accelerates triage and reduces cognitive load 2) Context-aware enrichment that pulls from Microsoft’s security graph without switching tools 3) Repeatable, governed workflows that eliminate tribal knowledge gaps 4) Rapid deployment from the Security Store—no custom integrations, no friction 5) Partner specialization, where each agent encodes deep expertise in threat detection, compliance automation, identity hardening, or incident response For SOC teams, this isn’t just convenience. It’s scale. For partners, it’s a new way to deliver differentiated value—directly where customers already work. The agentic SOC era is here, and our partner-built Security Agents are becoming the force multipliers analysts rely on every single day. If you are a partner, get inspired to build out your Security Agent with Microsoft Security Copilot. See this video from KC Li and Preeti Krishna https://lnkd.in/gUf-xWdu Get these agents from here: https://lnkd.in/gYvZyNBK James K. Vikram Anbazhagan Ankur Arora Franck Dauché, PhD Pedro G. Sudarshan J. Naadia Sayed Vanda Reis de Carvalho Eric Burkholder Renee Gallant-McKay Melissa Chan Pablo J. Chacón Shagun Gupta

41

🚀 DevSecOps: Myths vs Reality And how DefensaNet’s “DefSecOps” bridges the gap In today’s world of continuous delivery and rising cyber threats, DevSecOps has become more than just a buzzword — it’s a necessity. But it’s also surrounded by confusion and unrealistic expectations. Let’s set the record straight by busting some popular myths — and showing how solutions like DefensaNet’s DefSecOps platform can help teams move from theory to reality. ⸻ ❌ Myth 1: DevSecOps is just DevOps with security tools added ✅ Reality: DevSecOps is about shifting security left and embedding it across the pipeline. 🔧 How DefSecOps helps: DefSecOps integrates directly into your CI/CD workflows, automating secure code scans, secrets detection, and compliance checks — all while promoting a culture of shared responsibility between dev, ops, and security. ⸻ ❌ Myth 2: DevSecOps slows down development ✅ Reality: Security automation speeds things up. 🔧 How DefSecOps helps: With pre-built policies, automated guardrails, and real-time vulnerability feedback, DefSecOps enables developers to fix issues early — without blocking releases or overwhelming security teams. ⸻ ❌ Myth 3: DevSecOps is only for big enterprises ✅ Reality: Small and mid-sized businesses need it even more. 🔧 How DefSecOps helps: Designed with scalability in mind, DefSecOps offers enterprise-grade security at a fraction of the complexity — making it accessible for lean teams that need powerful security, fast. ⸻ ❌ Myth 4: Security is only the security team’s job ✅ Reality: In DevSecOps, everyone owns security. 🔧 How DefSecOps helps: DefSecOps fosters collaboration by giving developers, SREs, and compliance teams a unified dashboard to monitor, manage, and resolve security issues together. ⸻ ❌ Myth 5: Buying tools = instant DevSecOps ✅ Reality: Tools without culture = failure. 🔧 How DefSecOps helps: More than a tool, DefSecOps includes built-in playbooks, security-as-code templates, and onboarding aids to promote the mindset shift needed for real transformation. ⸻ ❌ Myth 6: Once implemented, you’re done ✅ Reality: DevSecOps is continuous. 🔧 How DefSecOps helps: With continuous scanning, drift detection, and live policy enforcement, DefSecOps helps you evolve with threats, stay compliant, and improve over time. ⸻ ❌ Myth 7: Compliance = Security ✅ Reality: Compliance is just the starting point. 🔧 How DefSecOps helps: Whether it’s CERT-In, RBI, or DefSecOps maps real-time controls to compliance requirements — while also identifying risks beyond what regulations demand. ⸻ 🔁 What DevSecOps myths have you heard or believed? Let’s discuss — and if you’re curious how DefSecOps can help, let’s connect! -Vinayak KW #DevSecOps #CyberSecurity #ShiftLeft #SecureDevOps #AppSec #RBI #CERTIn #HealthcareSecurity #BFSISecurity #InfoSec #DefensaNet #DefSecOps #SecurityAutomation #LinkedInBlog

21

Most enterprise databases are designed for someone else's jurisdiction. ShaktiDB starts from a different premise: what does an Indian enterprise actually need from its database layer? Data that stays in India. Security posture aligned to Cert-In. Compliance with RBI, SEBI, and government mandates from day one. Architecture that scales beyond single-instance PostgreSQL. And a single control plane to run it. Built on PostgreSQL. Extended for India-scale workloads. Catch us at PGConf India 2026 — March 11–13, Bengaluru. https://lnkd.in/gRTHt6q4 ‍IITM Pravartak Technologies Foundation l Indian Institute of Technology, Madras l Department of Science & Technology, Government of India l MJS Raman l G Veeraraghavan l Balamurali Shankar l Meenakshi Chidambaram l Rajendra Mootha l Ashutosh Kumar, आशुतोष कुमार l Balaji Krishnarajan l Gayathri Varadarajan l Vasan Srini l Renuka Sushil l STPI - Software Technology Parks of India l STPI-Chennai #iitm #iitmadras #iitmpravartak #ShaktiDB #PGConfIndia #DataSovereignty #MadeInIndia

31

1 Comment

Finding bugs in big platforms is definitely impressive, but let’s be honest - in today’s cybersecurity community, bug hunting is becoming quite common. What really matters is the severity - a P1 (critical) is a game changer, but not every bug makes that kind of impact. Not sure why people always hype it up without knowing the full story. Let’s appreciate the effort, but also stay grounded in reality. 

28

From Chernobyl to Cybersecurity! How “Safety Culture” Became the North Star for OT Security ======================================= The Wake-Up Call - April 1986 A late-night safety test simulating a total power outage at Reactor 4 went off-script. Operators overrode protections, a design flaw kicked in, and a runaway power surge ruptured the core. The resulting steam explosion and graphite fire ejected ~5 % of the reactor’s radioactive inventory into the atmosphere. Chernobyl is one of only two events ever rated Level 7 (major accident) on the International Nuclear Event Scale, the other is Fukushima 2011. Safety culture moved safety from a technical checkbox to an overriding mindset: every decision, design, operations, or incident response must prioritize human life and the environment. 💡Takeaways: - Design for failure: Assume control layers will break or be breached. - Test like it’s live: Exercise cyber-safety scenarios with the same rigor as process-safety drills. - Measure what matters: Track safety-relevant cyber KPIs Such gaps can turn even minor incident into operational shutdowns, equipment damage, personnel injuries, and environmental harm. #Bradleyrollins #SafetyCulture #OTSecurity #IndustrialCyber #RiskManagement

27

2 Comments

From Detection to Remediation: CyBrief’s Guided Approach We don’t just point problems out. We guide you until they’re fixed. #GuidedRemediation #InfosecIndia #WhereCybersecurityMeetsClarity

1

📧 Addressing a Phishing Email Attack: Enhancing Security Measures In the scenario of a phishing email attack, understanding the critical steps to detect and respond efficiently is paramount for cybersecurity resilience. 🔹 Step 1: SIEM (Detection & Monitoring) - SIEM gathers data from various sources like email gateways and endpoints. - Notable events include spotting suspicious emails, users interacting with malicious links, and unusual login patterns. - Alerts are triggered for potential phishing or malware activities, necessitating manual investigation and remediation by analysts. 🔹 Step 2: SOAR (Automated Response) - SOAR streamlines the response process by automating actions based on SIEM alerts. - Automated playbooks can swiftly quarantine malicious emails, reset user passwords, and block harmful URLs. - This automation significantly reduces response time, though it relies on initial alerts from tools like SIEM. 🔹 Step 3: XDR (Unified Threat Detection & Response) - XDR offers comprehensive monitoring across email, endpoints, identity, and networks. - It autonomously correlates data points to identify and respond to phishing campaigns swiftly. - Analysts benefit from a consolidated view for containment, threat mitigation, and rapid incident response. ⚖️ Comparing Security Measures in Phishing Scenarios: Stage | SIEM | SOAR | XDR Response | Manual | Automated | Unified Console Investigation | Multiple Tools | Automated Enrichment | Single-pane Visibility Speed | Slower | Faster | Fastest Limitation | Alert Fatigue | Playbook Dependency | Vendor Specificity 👉 Analogy: - SIEM is akin to a CCTV system, diligently recording and alerting. - SOAR acts as the security guard automation, swiftly responding to threats. - XDR functions like a smart AI-driven security system, efficiently detecting, responding, and alerting in a unified manner.

4

How #PTaaS Reduces Mean Time to Remediation (MTTR)? Cyber threats are not only increasing in volume but evolving in complexity. For small and medium-sized businesses (SMBs) in India, this creates a growing urgency to detect and fix vulnerabilities before they can be exploited. One key performance indicator for security readiness is Mean Time to Remediation (MTTR), the average time taken to identify, resolve, and verify the fix for a security vulnerability. Read more: https://lnkd.in/gH22YGQx

3