TaxTMI 
TaxTMI 
Cyber Security and Cyber Resilience framework of Stock Exchanges, Clearing Corporations and Depositories
X X X X Extracts X X X X
X X X X Extracts X X X X
....ecided that MIIs shall have a Cyber Security Operation Center (C-SOC) that would be a 24x7x365 set-up manned by dedicated security analysts to identify, respond, respond, recover and protect from cyber security incidents. 4. The C-SOC shall function in accordance with the framework specified in SEBI Circular CIR/MRD/DP/13/2015 dated July 06, 2015. Illustrative list of broad functions and objectives to be carried out by a C-SOC are mentioned hereunder: 4.1. Prevention of cyber security incidents through proactive actions: (a) Continuous threat analysis, (b) Network and host scanning for vulnerabilities and breaches, (c) Countermeasure deployment coordination, (d) Deploy adequate and appropriate technology at the perimeter to prevent attacks originating from external environment and internal controls to manage insider threats. MIIs may implement necessary controls to achieve zero trust security model. 4.2. Monitoring, detection, and analysis of potential intrusions / security incidents in real time and through historical trending on security-relevant data sources. 4.3. Response to confirmed incidents, by coordinating resources and....
X X X X Extracts X X X X
X X X X Extracts X X X X
....C-SOC should conduct periodic awareness and training programs at the MII and for its members / participants / intermediaries with regard to cyber security, situational awareness and social engineering. 5.7. The C-SOC should be capable to prevent attacks similar to those already faced. The C-SOC should also deploy multiple honey pot services which are dynamic in characteristics to avoid being detected as honey pot by attackers. 6. As building an effective C-SOC requires appropriate mix of right people, suitable security products (Technology), and well-defined processes and procedures (Processes), an indicative list of areas that MIIs should consider while designing and implementing a C-SOC are as follows: 6.1. The MII shall ensure that the governance and reporting structure of the C-SOC is commensurate with the risk and threat landscape of the MII. The C-SOC shall be headed by the Chief Information Security Officer (CISO) of the MII. The CISO shall be designated as a Key Managerial Personnel (KMP) and relevant provisions relating to KMPs in the SEBI Securities Contracts (Regulation) (Stock Exchanges and Clearing Corporations) Regulations, 2012 and the subsequent circulars i....
X X X X Extracts X X X X
X X X X Extracts X X X X
....perations from their DR-C-SOC. 6.9. The C-SOC should document the cases and escalation matrices for declaring a disaster. 7. In view of the feedback received from MIIs, it has been decided that MIIs may choose any of the following models to set-up their C-SOC : (i) MII's own C-SOC manned primarily by its internal staff, (ii) MII's own C-SOC, staffed by a service provider, but supervised by a full time staff of the MII. (Refer to 7.3) (iii) C-SOC that may be shared by the MII with its group entities (that are also SEBI recognized MIls), (iv) C-SOC that may be shared by the MII with other SEBI recognized MII(s). 7.1. The responsibility of cyber security of an MII, adherence to business continuity and recovery objectives, etc. should lie with the respective MII, irrespective of the model adopted for C-SOC. 7.2. The respective risk committee(s) of the MII should evaluate the risks of outsourcing the respective activity. 7.3. The MII may outsource C-SOC activities in line with the guidelines as given in Annexure-A. 8. A report on the functioning of the C-SOC, including details of cyber-attacks faced by the MII, major cyber even....
X X X X Extracts X X X X
X X X X Extracts X X X X
....d) Perform first level event analysis before qualifying the incidents. (e) Qualifying the event as an incident using Knowledgebase. (f) Escalating exceptions & Events to L2 level. (g) Log Incident tickets in service management tool and assign it to the respective team. (h) Follow-up for the closure of the incident tickets generated. 1.2. Security Analyst Level 2 (L2): Combination of Outsource / In-House (a) Exception Analysis. (b) Analysis of extended events. (c) Confirmation of False +ve & update Knowledge Base. (d) Qualify Incident & provide mitigation suggestions. (e) Escalate incident to next level. (f) Update /configuration correlation rules after approval. 1.3. Security Analyst Level 3 (L3): Combination of Outsource / In-House (a) Analysis of escalated Incidents. (b) Define correlation rules. (c) Analysis of impact on SIEM over all correlation rules and operations for the correlation rules suggested by Level 2 Analyst. (d) Approve correlation rules after the impact analysis. (e) Perform impact analysis before deployment of correlat....
X X X X Extracts X X X X
X X X X Extracts X X X X
....in the Integrated and Transition vendor announcements & manage SIEM System update alerts; (l) Install application patches and software updates in order to improve performance, or enable additional functionality Illustrative Training Requirements Security Analyst Level 1 (L1): 1) SEC401: Security Essentials Bootcamp Style https://www.sans.org/event/cyber-defence-canberra-2018/course/security-essentials-bootcamp-style 2) SEC301: Introduction to Cyber Security https://www.sans.org/course/introduction-cyber-security Security Analyst Level 2 (L2): 1) SEC542: Web App Penetration Testing and Ethical Hacking https://www.sans.org/event/cyber-defence-canberra-2018/course/web-app-penetration-testing-ethical-hacking 2) SEC566: Implementing and Auditing the Critical Security Controls - In-Depth https://www.sans.org/private-training/course/implementing-auditing-critical-security-controls 3) SEC575: Mobile Device Security and Ethical Hacking https://www.sans.org/private-training/course/mobile-device-security-ethical-hacking Security Analyst Level 3 (L3): 1) SEC504: Hacker Tools, Techniques, Exploits, and Incident Handling https://www.sans.o....