Cybersecurity for Stock Brokers & Custodians: Meeting SEBI\u2019s CSCRF Mandates”.<\/a><\/span><\/li>\n<\/ul>\nFurthermore, there is a realization that software developers and vendors often create new products by using existing open source & commercial software components. However, recent security breaches at third party vendors like Apache and Solarwinds have mandated the requirement of a <\/span>Software Bill of Materials (SBOM)<\/b>, a formal record containing details & supply chain relationship of various components used in building that particular software.\u00a0<\/span><\/p>\nAll REs have to retain SBOMs for their existing critical systems before February 20, 2025, so <\/span>click here<\/span> for us to help you out with that if you haven\u2019t started. Additionally, SBOMs have to be obtained for all new software products\/SaaS to be used in critical systems.\u00a0<\/span><\/p>\nA typical SBOM includes all these elements:<\/span><\/p>\n\n- License information<\/span><\/li>\n
- Name of supplier<\/span><\/li>\n
- All primary components with their respective transitive dependencies<\/span><\/li>\n
- Encryption used<\/span><\/li>\n
- Cryptographic hash of components<\/span><\/li>\n
- Frequency of updates<\/span><\/li>\n
- Known unknowns where SBOM does not include the full dependency graphs<\/span><\/li>\n
- Access Control Methods<\/span><\/li>\n
- Methods for accommodating occasional incidental errors<\/span><\/li>\n<\/ul>\n
With SBOMs, you become more aware of all the myriad elements involved in your software, thus having more information to make better security decisions. It also helps mitigate supply chain risks that are proving to be a big issue for many organizations.<\/span><\/p>\nSecuring Communications: Encryption & Safe Transmission<\/h3>\n
SEBI defines a <\/span>secure channel<\/b> as \u2018a protected communications link established between a cryptographic module and the sender\/receiver to securely communicate and verify the validation of plaintext CSPs, keys, authentication data and other sensitive data.\u2019<\/span><\/p>\nCSCRF mandates the protection of data-at-rest and data-in-transit for all REs. Like we mentioned earlier, <\/span>encryption<\/b> used is a key element of the SBOM requirements, as it is the driver for securing all the data in that particular software. You can read more about how encryption can be used for data-at-rest <\/span>here<\/span>.<\/span><\/p>\nSimilarly, encryption plays a key role in securing communications and protecting your data in transit. Here are the CSCRF requirements for the same:<\/span><\/p>\n\n- When an application transmitting sensitive data communicates over the Internet with the REs systems (ex. IBT communication from client\u2019s web browser), it should be done over a secure, encrypted channel using a strong transport encryption mechanism like <\/span>Transport Layer Security (TLS)<\/b>. The asymmetric public key cryptography used in TLS helps prevent Man in the Middle (MITM) attacks.<\/span><\/li>\n
- For applications carrying sensitive data served as web pages over the Internet, a valid, properly configured <\/span>TLS certificate<\/b> on that web server is mandatory. This is shown through the HTTP(S) padlock sign on your browser.<\/span><\/li>\n
- Use secure protocols like <\/span>FTP(S), SSH and VPN tunnels<\/b>.<\/span><\/li>\n<\/ul>\n
iValue\u2019s state-of-the-art cybersecurity suite can help secure your software, secure your communications and adhere to all the myriad requirements mandated by SEBI.\u00a0<\/span><\/p>\nHere are the solutions we provide to help <\/span>secure your software and applications<\/b>:<\/span><\/p>\n\n- Risk assessment tools<\/b> like <\/span>Nessus<\/b> and <\/span>Tenable<\/b> that perform vulnerability scans and provide detailed reports for mitigation.<\/span><\/li>\n
- An advanced <\/span>SSDLC solution<\/b> that provides threat modeling to identify potential threats & attack vectors, secure coding standards, code review & static analysis, and dynamic application security testing (DAST).<\/span><\/li>\n
- Web Application Security Testing<\/b> through solutions like <\/span>Tenable<\/b>, <\/span>Opentext Fortify<\/b> and <\/span>Levo<\/b>, which help identify vulnerabilities in web applications.<\/span><\/li>\n
- The required experience and processes to take you through the <\/span>SBOM<\/b> mandate for all your vendors.<\/span><\/li>\n<\/ul>\n
Additionally, we provide a wide variety of <\/span>encryption solutions<\/b>, from symmetric to asymmetric and full disk encryption to file based encryption, through partnerships with industry leaders like <\/span>Thales<\/b> and <\/span>Ultimaco<\/b>. We can also help you obtain TLS certificates to secure your communication through the Internet. You can read more about our encryption solutions <\/span>here<\/span>.<\/span><\/p>\nWe close it by saying that if you fall under SEBI\u2019s REs, the next year could get pretty hectic with all the various requirements. If you need a partner to streamline that for you while you focus on what you do best, <\/span>click here<\/span> to set up a meeting with us.<\/span><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"The Need for SEBI Compliance in Securing Customer Data and Communications India\u2019s growth story is reflected in the emergence of its financial markets. The total market capitalization of India\u2019s stock market exceeded $5 trillion recently, and a key reason for this is the democratization of access to these markets. In FY24, non-institutional investors accounted for …<\/p>\n
Securing Customer Communications & Portfolio Data: Achieving SEBI Compliance for Portfolio Managers & Investment Advisors<\/span> Read More \u00bb<\/a><\/p>\n","protected":false},"author":1,"featured_media":20191,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"default","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"default","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","footnotes":"","_links_to":"","_links_to_target":""},"categories":[131],"tags":[182,136,268,383,379,378,382,377,381,380],"whitepapers":[],"case_studies":[],"acf":[],"_links":{"self":[{"href":"https:\/\/ivaluegroup.com\/en-in\/wp-json\/wp\/v2\/posts\/23088"}],"collection":[{"href":"https:\/\/ivaluegroup.com\/en-in\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ivaluegroup.com\/en-in\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ivaluegroup.com\/en-in\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ivaluegroup.com\/en-in\/wp-json\/wp\/v2\/comments?post=23088"}],"version-history":[{"count":5,"href":"https:\/\/ivaluegroup.com\/en-in\/wp-json\/wp\/v2\/posts\/23088\/revisions"}],"predecessor-version":[{"id":23099,"href":"https:\/\/ivaluegroup.com\/en-in\/wp-json\/wp\/v2\/posts\/23088\/revisions\/23099"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ivaluegroup.com\/en-in\/wp-json\/wp\/v2\/media\/20191"}],"wp:attachment":[{"href":"https:\/\/ivaluegroup.com\/en-in\/wp-json\/wp\/v2\/media?parent=23088"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ivaluegroup.com\/en-in\/wp-json\/wp\/v2\/categories?post=23088"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ivaluegroup.com\/en-in\/wp-json\/wp\/v2\/tags?post=23088"},{"taxonomy":"whitepapers","embeddable":true,"href":"https:\/\/ivaluegroup.com\/en-in\/wp-json\/wp\/v2\/whitepapers?post=23088"},{"taxonomy":"case_studies","embeddable":true,"href":"https:\/\/ivaluegroup.com\/en-in\/wp-json\/wp\/v2\/case_studies?post=23088"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}