《毕马威:2023年印度网络安全与数字风险报告(英文版)(64页).pdf》由会员分享,可在线阅读,更多相关《毕马威:2023年印度网络安全与数字风险报告(英文版)(64页).pdf(64页珍藏版)》请在三个皮匠报告上搜索。
1、December Secure in India 2023GCC empowered global cybersecurity and digital risk management2 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limite
2、d,a private English company limited by guarantee.All rights reserved.Contents Why global organisations invest in cyber GCCs1?Why cyber GCC leaders are key for global cybersecurity?What functions cyber GCCs deliver?How cyber GCCs foster innovation culture?Do cyber GCCs leverage emerging technologies?
3、Key use cases for innovation and leveraging emerging technologies Do cyber GCCs continue to have required depth and breadth of cyber skills?Do cyber GCCs continue to acquire and retain talent?Do cyber GCCs contribute to DE&I agenda?Cybersecurity talent,Diversity,Equity,and Inclusion(DE&I)20GCC cyber
4、security organisation12Securing digital transformation 26 Cyber GCCs identify,manage and report risks What keeps cyber GCC leaders awake?Key initiatives cyber GCCs undertake to promote risk culture38Cyber risk cultureGCC Global Capability Centre1.Cyber GCC refers to teams focused on global cybersecu
5、rity delivery,located within respective GCCs in India21342 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limite
6、d by guarantee.All rights reserved.3 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rig
7、hts reserved.60Methodology61Acknowledgements Defense in depth through Cyber Fusion Centres Cyber insurance enabled cyber GCCs Are cyber GCCs privacy ready?Cyber GCCs in a Volatility,Uncertainty,Complexity,and Ambiguity(VUCA)World52 Why and how cyber GCCs collaborate with their ecosystem?Together for
8、 better4635786 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.4 2023 KP
9、MG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.4 2023 KPMG Assurance and Consu
10、lting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.5 2023 KPMG Assurance and Consulting Services LLP,an
11、Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.Today,we are in a world dealing with geopolitical conflicts,supply chain di
12、sruptions,economic uncertainties,continued emergence of digital,operational,and advanced technologies,especially with the rise of Artificial Intelligence(AI).These global events continue to have a ripple effect on the global business ecosystem,pose unforeseen challenges and provide opportunities to
13、transform.Trust in business is a key asset for organisations and is vital to build and protect trust in the world challenged with above events.With rampant digitisation,data is a foundational block for competitive advantage and global organisations are tapping the data to provide transformative expe
14、rience to their customers.However,cyber criminals are ahead of the curve in proactively leveraging advanced technologies,including AI,in exploiting weaknesses of global organisations impacting the trust,data and other valuable assets.Within this ecosystem,where digitisation meets the challenge of sa
15、feguarding business assets,global organisations continue to embrace and expand cyber GCCs in managing cybersecurity and digital risks.Today,cyber GCCs are seen as value generating entities and hubs of cyber leadership,diverse cybersecurity talent,and excellence.They drive global cybersecurity and di
16、gital risk management employing innovation,resilience,adaptability,DE&I and business growth agenda propelling these as cyber-Centres of Excellence(CoE).Cyber GCCs are not only about protection but also focus on anticipation,collaboration,unlocking horizontal value and enabling business growth.The Se
17、cure in India report,in its previous editions,provided global leadership with a viewpoint on cyber GCCs capabilities,leading practices,innovation,talent,and ecosystem.This edition of Secure in India focuses on how cyber GCCs are empowering their global organisations deal with cybersecurity and digit
18、al risks,including new business and digital technology models.The insights detailed in this report have been prepared based on an extensive study and in consultation with global cyber leaders,cyber GCC leaders,cybersecurity Subject Matter Experts(SMEs)and reputed industry bodies.It provides key reco
19、mmendations for cyber GCCs to help them sustain competitive advantage,transform into global centres of expertise and enable global organisations to Secure in India.Foreword Atul GuptaPartner and HeadDigital Trust,KPMG in IndiaK S ViswanathanVice President,Industry Initiatives,nasscomVinayak GodseCEO
20、,Data SecurityCouncil of India(DSCI)5 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All ri
21、ghts reserved.6 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.Industry
22、 viewGCCs have emerged as transformation partners for their global organizations by building trust,strengthening resilience and exceeding outcomes across key business growth drivers.GCCs continue to strive for excellence by not only improving in existing business services and technologies but also d
23、eliver on innovation and growth agenda.Cyber GCCs are a source of strategic advantage to global organizations,as they enable various businesses to protect,adapt,scale and innovate.Cyber GCCs continue to expand their contribution across cybersecurity and digital risk functions,proactively their globa
24、l organizations deal with uncertainties across geopolitical,regulatory,dynamic business,technology,and social landscape.Cyber GCCs help in nurturing talent,sustain,and develop skills,contribute to improved business practices including DE&I agenda.Its heartening to experience new generations of talen
25、t learn,integrate and contribute to the global business ecosystem through cyber GCC platform.As cyber GCCs gather momentum in dealing with new business models powered by technology advancements(e.g.,AI,crypto,operational technology etc.),global organizations have both accountability as well as signi
26、ficant opportunity in contributing to the entire world through empowering Cyber GCCs and helping them reach their fullest potential.6Ramachandra KulkarniManaging Director,Technology Risk,Goldman Sachs 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a membe
27、r firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.7 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG glo
28、bal organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.Organisations across industries and geographies are increasingly relying on digital technologies.With this reliance comes the challenge of protec
29、ting networks and data from cyber threats,thus highlighting the critical need for skilled cybersecurity professionals.Despite the global cybersecurity workforce growing by an estimated 10 per cent between 2022 and 2023,a deficit of almost four million cybersecurity professionals remains.India is no
30、exception to this trend.In May 2023,there were an estimated 40,000 job openings for cybersecurity professionals,yet due to talent shortages,30 per cent of these vacancies could not be filled.To tackle the workforce gap,organisations must proactively invest in attracting,training,and retaining cybers
31、ecurity workers.Failure to do so can have far-reaching consequences with organisations finding themselves understaffed in the face of emerging threats.In fact,today,64 per cent of cyber leaders rank talent-related challenges,such as recruitment and retention,as key obstacles to managing organisation
32、al cyber resilience.The deficit of cybersecurity professionals not only hampers an organisations ability to anticipate and respond to cyberattacks including 1.3 million attacks reported across India in 2022 but also poses serious implications for the economy and national security.With one of the wor
33、lds largest youth populations and boasting 31.7 per cent of Science,Technology,Engineering and Mathematics(STEM)graduates worldwide,India has the opportunity to position itself as a fertile ground for cultivating cyber talent.Ultimately,such assets coupled with Indias emerging cybersecurity market,w
34、hich is expected to reach a value of US$13.6 billion by 2025,can help ensure a continuous pipeline of skilled professionals and position the country as a global leader in cybersecurity for years to come.In this pursuit,GCCs in India have a key role to play as they provide organisations across the wo
35、rld with a platform to access talent,skills and innovation.In the coming years,these GCCs have the potential to grow up the value chain and strengthen resilience across the global business ecosystem.Global view 7Akshay JoshiHead of Industry and Partnerships,Centre for Cybersecurity,World Economic Fo
36、rum 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.8 2023 KPMG Assuranc
37、e and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.Government viewCybersecurity is no longer
38、confined to the digital world only.It has become a subject of national security global security.Securing Digital India8 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated wit
39、h KPMG International Limited,a private English company limited by guarantee.All rights reserved.9 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International L
40、imited,a private English company limited by guarantee.All rights reserved.9 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private Engli
41、sh company limited by guarantee.All rights reserved.Key TakeawaysGlobal organisations continue to invest in cyber GCCs to manage cybersecurity and digital risksTop five drivers to establish cyber GCCs include-availability of cybersecurity skills(86 per cent),cost arbitrage(75 per cent),round the clo
42、ck delivery(75 per cent),cyber innovation,research and development(58 per cent)and proximity with other business functions(53 per cent)About 28 per cent of global organisations surveyed have more than half of their global cybersecurity teams in cyber GCCs.This has doubled since 2020.About 70 per cen
43、t of respondents have cybersecurity teams with over 25 resources in IndiaAbout 89 per cent of cyber GCC CISOs participate in global committees governing cybersecurity.67 per cent of the organisations surveyed have cybersecurity team members across global locations reporting to cyber GCC leadership.C
44、yber GCCs emerge as global cybersecurity skills hubMaximum increase in cyber skill demand is noted for cloud security(81 per cent),followed by third party risk management(78 per cent),cybersecurity risk assessments(75 per cent),technology regulatory compliance and standards management(75 per cent)an
45、d secure development(69 per cent)Cyber GCC attrition challenges continue,with compensation,market demand for similar skillsets and locational preferences reported as top three challenges in retention of cyber talent.Remote working,since covid,continues to play a role in locational preference shiftin
46、g to hometownMost cyber GCCs have DE&I agenda focused on cybersecurity with top three initiatives as targeted recruitment(22 per cent),DE&I training and awareness(22 per cent)and inclusion and sustenance at various leadership levels(20 per cent).010210 2023 KPMG Assurance and Consulting Services LLP
47、,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.11 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Li
48、ability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.Cyber GCCs focus on culture of innovation to manage risks effectivelyMost of the organisatio
49、ns surveyed are leveraging emerging technologies for cybersecurity,including cloud(81 per cent),Robotic Process Automation(RPA)(56 per cent),AI and Machine Learning(ML)(39 per cent)and low code and no code(33 per cent)Significant interest has been noted in Generative AI for cybersecurity,across vari
50、ous functions including security operations,third party risk management,vulnerability management,risk and control assessments etc.The top three innovation programs leveraged by cyber GCCs include incubation events,hackathons,bug bounty programs,implementation of focused innovation programs and idea-
51、based investments.Cyber GCCs foster risk culture and risk transparencyMost cyber GCCs are helping their global organisations identify,assess,remediate,track and report cybersecurity risks to their global boards.The top five cybersecurity risks reported to the global boards include third party cybers
52、ecurity risk,software supply chain security risk,cyber regulatory risk,endpoint security risk and cloud security riskPreferred methods of cybersecurity risk reporting include cybersecurity dashboards,periodic cybersecurity governance meetings,periodic cybersecurity posture reporting and cyber risk q
53、uantification.About 44 per cent still utilise manual Key Performance Indicators(KPIs)and Key Risk Indicators(KRIs)reportingKey programs to promote cybersecurity risk culture in cyber GCCs include cybersecurity training and awareness,recognition/incentivisation and gamification/simulation/bug bountie
54、s.Global organisations trust cyber GCCs across three lines of defense About 78 per cent of cyber GCCs are unlocking horizontal value as teams across their three Lines of Defense(3LoD)actively collaborate for managing cybersecurity and digital risksCyber GCCs belonging to sectors such as technology,t
55、elecom,energy etc.,have established 3LoD approach to cybersecurity and digital risk management,as well,beyond financial services Top five cybersecurity functions based on budget prioritisation include-cybersecurity risk assessments,technology regulatory audit and standards compliance management,cybe
56、rsecurity engineering,product management and automation,third party risk management and secure development.03040511 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KP
57、MG International Limited,a private English company limited by guarantee.All rights reserved.01GCC cybersecurity organisation12 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affilia
58、ted with KPMG International Limited,a private English company limited by guarantee.All rights reserved.1313 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG Inter
59、national Limited,a private English company limited by guarantee.All rights reserved.Global organisations have been focusing on managing cybersecurity and digital risks.They continue to invest in and expand cyber GCCs,elevate cyber GCC leadership and talent,harness innovation and scale offered by the
60、 cyber GCCs.As cyber GCC organisations mature,expectations are not only to manage risks effectively but also to enable global organisations innovate,grow and sustain their businesses through continued,proactive and scalable cybersecurity and digital risk management capabilities.As global leaders see
61、k agile and affordable cybersecurity strategies that integrate seamlessly,cyber GCCs are helping their global organisations meet their key business objectives.By spearheading the delivery of diverse portfolios,cyber GCC organisations are playing a vital role in empowering global cybersecurity and di
62、gital risk management.#1 Cyber GCCs empower global cybersecurity and digital risk managementCybersecurity talent availability continues to be the top driverAvailability of cybersecurity skills continues to be the top draw in leveraging the GCC model in India.86 per cent of the cyber GCCs surveyed be
63、lieve that this is a key driver for leveraging India as a preferred destination.With remote working,the talent pool for cybersecurity services has further expanded beyond traditional locations.Cyber GCCs continue to offer round the clock delivery advantage As cybersecurity and digital risks grow mul
64、tifold,global organisations see a clear need for round the clock capabilities in specific cybersecurity and digital risk functions.Of the respondents surveyed,75 per cent agreed that round the clock delivery is a key driver to leverage the GCC model in India.Cost arbitrage still offered by cyber GCC
65、sAbout 75 per cent of the survey respondents believe that cost arbitrage associated with delivering cybersecurity services from India continues to be a key driver to leverage the cyber GCC model.This reflects that India continues to be efficient in managing cybersecurity and digital risks.While thes
66、e continue to be key drivers in setting up and expanding cyber GCCs,faster and efficient cyber innovation,Research and Development(R&D),proximity with other business functions and reduced risk exposure(due to minimal access to the organisational network)are emerging as significant factors for levera
67、ging the GCC model.Figure 1:Key drivers to leverage GCC model for cybersecurity6%33%53%58%75%75%86%Others(9):Reduced risk exposure(due to minimal external access to the organisational network)Proximity with other business functionsA faster and efficient wayfor cyber innovation,research and developme
68、nt Round the clock delivery(e.g.,security operations,identify and access management incident and breach response,etc.)Cost arbitrage associated with cybersecurity skillsAvailability of cybersecurity skills 14 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and
69、 a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.#2 The growth trajectory of cyber GCCs The surge in cyber GCCs over the last seven years can be attributed to a com
70、bination of factors including significant rise in cybersecurity and digital risks associated with continued digitisation,new business models,rise in advanced technologies and increasing expansion of talent pool in the cybersecurity domain.This has led to about 23 per cent increase in cyber GCCs sinc
71、e 2020,with global organisations strategically choosing to establish their presence in cyber GCCs,capitalising on its ecosystem for technological innovation and cybersecurity talent.-2023Before 200813%32%55%of Cyber GCCs established in IndiaYear of establishing Cyber GCC in IndiaFigure
72、2:Year of inception of cybersecurity functions in India GCCs#3 Cyber GCCs in India emerge as a global cybersecurity hub Cyber GCCs witness a significant increase in team size.About 28 per cent of global organisations have more than half of their global cybersecurity team strength in India.This growt
73、h reflects cyber GCCs prominence as a strategic hub for cybersecurity and digital risk management.50%-75%11%More than 75%17%1%-9%19%10%-24%11%25%-49%42%With increased digitisation,the need for managing cybersecurity and digital risks is on the rise.GCCs in India have gained the confidence of their g
74、lobal parent organisations based on cyber GCCs focus on nurturing niche and specialised cybersecurity talent and developing digital risk skillsets.Pranav Kathale,Partner,Digital Risk and Cloud Security,KPMG in IndiaFigure 3:Per centage of global cybersecurity team strength in cyber GCCFigure 4:Growt
75、h in Cybersecurity team strength%team strengthrespondents19%11%42%11%17%31%28%25%7%9%1%-9%10%-24%25%-49%50%-75%more than75%202320201515 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firm
76、s affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.Cyber GCC leadership has risen to the global challenge of growing cybersecurity and digital risks.They contribute to build and sustain a cyber risk culture,develop cybersecurity teams of s
77、cale and upgrade their skillsets on a continuous basis,and help advise global leadership on cybersecurity matters.They have become key for effective global cybersecurity and digital risk management.Srinivas Potharaju,Partner,Digital Risk and Cyber,KPMG in India Figure 6:Global team reporting into cy
78、ber GCC leadership67%33%No11%89%29%71%NoYes20232020Figure 5:GCCs CISO Participation in Global CommitteesFigure 5:Cyber GCC leadership participation in global committees#4 Cyber GCC leadership accountability is on the riseAs cybersecurity and digital risk functions are increasingly delivered from cyb
79、er GCCs,accountability and influence of cyber GCC leadership has risen significantly.About 89 per cent of survey respondents highlighted cyber GCC leadership is part of the global committees managing cybersecurity and digital risks.About 67 per cent also highlighted that global teams are reporting i
80、nto the cyber GCC leadership,signifying growing stature and importance of cyber GCCs to their global organisations.#5 Cyber GCCs fortify the three lines of defenseMajority of cyber GCCs follow three Lines of Defense(3LoD)approach to identify,manage,and monitor cybersecurity risks effectively and eff
81、iciently.More importantly,cyber GCCs are unlocking horizontal value,as teams across 3LoD are actively engaging and collaborating for managing cybersecurity and digital risks.22%78%NoYesFigure 7:Adoption of 3LoD by GCCsCyber GCCs are playing an important role in modernising various cybersecurity acti
82、vities and functions across the 3LoD,as they continue to operate with clear understanding of issues and changes needed.Yes16 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliate
83、d with KPMG International Limited,a private English company limited by guarantee.All rights reserved.72%72%75%75%78%81%81%83%83%83%Technology regulatory,audit and standards compliance managementCloud securityCybersecurity engineering,product management and automationSecure developmentThird party ris
84、k management(vendor/supplier cyber risk management)Cybersecurity operations(e.g.,SOC,DLP,etc.)Identity and access management(including privileged access management)Cybersecurity governanceCybersecurity risk assessmentsApplication security and vulnerability management#6 Core1grows further and emergin
85、g functions surgeTop five cyber GCC functions include application security and vulnerability management,cybersecurity risk assessments,cybersecurity governance,Identity and Access Management(IAM)and cybersecurity operations.These form core of the cyber GCC contribution to managing cybersecurity risk
86、s and continue to grow significantly.Cyber GCCs have experienced a significant increase in emerging functions such as cybersecurity engineering,product management and automation,secure development,cloud security and third party risk management including software supply chain security risk management
87、.Figure 8:Top 10 cybersecurity functions being delivered from cyber GCCs1.Core functions refer to cybersecurity and digital risk functions which are on the rise and are being prioritised based on budget,compliance and necessity.Risk assessment of emerging technologies:A leading energy GCC has develo
88、ped a focused team to perform risk assessment of various emerging technologies such as drones,Distributed Ledger Technology/Blockchain(DLT),Low Code and No Code Platforms,RPA,Operations and Technology(OT)based applications,Internet of Things(IoT)based applications,AI based applications etc.This has
89、resulted in greater understanding and appreciation of emerging technology risk,identification of suitable controls to manage the risk and enhanced awareness amongst user communities of corresponding emerging technology risk.Third party risk signals:A leading telecom GCC developed a custom solution t
90、o monitor security risks from their third parties,through available risk intelligence platforms.Also,a leading pharma GCC has developed a Natural Language Processing(NLP)based solution to sift through third party data and identify risk signals,correlating with insights from their internal and extern
91、al data sources.GenAI risk and control framework:A leading energy major GCC has developed aGenAI risk and control framework and applied the same for all GenAI use cases.This has resulted in risk managing the innovative use cases,identifying new risks and helping develop suitable controls.Cyber GCC C
92、ase Studies1717 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.#7 Cyber
93、 GCCs continue to spend on core and invest on emergingTop functions based on cybersecurity and digital risk budget prioritisationVulnerability managementCybersecurity risk assessments Identity and Access Management(IAM)Technology regulatory audit and standards compliance managementCybersecurity risk
94、 assessmentsCybersecurity engineering,product management and automationTPRMTPRMCybersecurity operationsSecure development20202023In addition to the above mentioned,following are next five functions,basis budget prioritisation Cybersecurity strategyIAM(including privileged access management)Applicati
95、on security and vulnerability managementCybersecurity governanceCyber resilienceAs digitisation footprint grows,proactive risk management caused by adoption of digital solutions,has resulted in,cybersecurity risk assessments,Third Party Risk Management(TPRM)and Technology,regulatory,audit and compli
96、ance management functions gaining substantial budgetary allocation.Shift left,digitisation of cybersecurity functions,tech for cyber and continuous risk management approaches have shaped greater focus on these functions,especially secure development and cybersecurity engineering product management a
97、nd automation.18 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.No Chan
98、ge6%100%8%75%-100%14%Less than 10%14%10%-25%19%25%-50%19%50%-75%20%#8 Cyber GCCs reported exponential growth in cybersecurity deliveryAbout 94 per cent of respondents have reported an increase in services delivered by cybersecurity functions,with more than 42 per centreporting about 50 per cent incr
99、ease.No cyber GCC reported de-growth,highlighting continued expansion of cybersecurity functions across cyber GCCs,including a significant rise in emerging functions to manage digital risks.Figure 9:Growth in cybersecurity services Cybersecurity and digital risk functions growth in cyber GCCs reflec
100、ts both the talent and initiative of cyber GCCs in delivering consistently and exceeding outcomes to their global organisations.Whether its existing cybersecurity or emerging digital risks,cyber GCCs are working in tandem with their global counterparts to proactively manage the risks.Akhilesh Tuteja
101、,Head of Clients and Markets and Global Cybersecurity Leader,KPMG in IndiaAutomated Continuous Controls Monitoring(CCM)platform:A leading financial services GCC has built a CCM platform a.Which measures control effectiveness for entire population of control transactions,for each control,on a continu
102、ous basisb.Reports control effectiveness gaps,as and when they occur,through automated dashboard c.Auto assigns remediation actions to respective role-based action ownersControls across various control programs such as Sarbanes Oxley(SOX),International Standard on Assurance Engagements(ISAE),Risk an
103、d Control Self-Assessment(RCSA)etc.have been onboarded to the CCM platform d.Providing continuous coverage of control effectiveness measuremente.Reducing manual efforts involved in control testingf.Covering entire control transactions on an occurrence basis as against a sample on a periodic basis.Cy
104、ber GCC Case Studies1919 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved
105、.69%58%56%47%47%44%39%39%39%36%36%Cybersecurity delivery from Cyber GCCAutomation of cybersecurity servicesCloud adoptionAgile approach to cybersecurityIntegration of cybersecurity components and functionalities across platforms/tools/productsCybersecurity cost-benefit analysis and rationalisationCy
106、bersecurity tools/platforms/products license managementEmbracing outcome/value delivery/managed services delivery for various cybersecurity functionsProcess re-engineering of cybersecurity activityCybersecurity crisis management planningDedicated member on the board,who is a cyber expertFigure 11:St
107、rategies for delivering value to GCCs#9 Cyber GCCs playing catalyst in managing cybersecurity debtCyber GCCs have become trusted advisors and partners for global organisations,helping them with the challenges and opportunities created by geopolitical tensions,supply chain disruptions,economic uncert
108、ainties,and the ongoing rise of digital,operational,and advanced technologies,especially AI.Their commitment to collaboration,innovation,and value delivery approach makes them an asset to the global organisations.Easier collaboration with various groups of the global organisation24%Increase in scope
109、 of the services being offered as part of cyber GCC23%Increased cybersecurity attacks17%Ability to provide rapid scale during peak periods15%Budget constraints in global locations15%Others(13)6%Figure 10:Growth factors of cyber GCCsDelivery of cybersecurity with agile approachesAdvanced automationCl
110、oud adoptionIntegration of cyber strategies across platforms/tools and productsDedicated cybersecurity experts#10 Cyber GCCs deliver significant valueIn the wake of economic challenges and uncertainties,global organisations are faced with growing cybersecurity and digital risks.Cyber GCCs come to th
111、e rescue,implementing various strategies including:Cyber GCCs help global organisations optimise cybersecurity spend,allowing them“to do more with less”20 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of inde
112、pendent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.02Cybersecurity talent,Diversity,Equity,and Inclusion(DE&I)20 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm o
113、f the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.2121 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global o
114、rganization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.81%78%75%75%69%Cloud securityThird party riskmanagement(vendor/supplier cyberrisk management)Cybersecurity riskassessmentsTechnology regulatory,audit
115、and standardscompliancemanagementSecure development(e.g.,DevSecOps,SSDLC,etc)#1 Significant rise in demand for cybersecurity and digital risk management skillsThe global cybersecurity landscape is influenced by various events including digitisation,rapid evolution of AI technology,increased reliance
116、 on third party ecosystem and supply chain,emerging business and technology models(including Web 3.0,crypto,DLT etc.).Cyber GCCs have been focusing on cybersecurity and digital risk functions,helping their global organisations deal with the cybersecurity challenges resulting from these global events
117、.In line with the global demand,cyber GCCs have experienced a significant rise in demand for various cybersecurity skills.These include cloud security,Third party risk management,cyber risk assessment,secure development and technology,regulatory,audit and standards management.Amidst the surge in dem
118、and for cybersecurity skills,cyber GCCs are constantly evolving their talent acquisition and development strategies.While cyber GCCs are looking to implement automation-based strategies to bring in efficiencies of scale in BAU operations,they are also looking to upskill and attract talent in emergin
119、g technologies and initiatives to meet business imperatives.The rise in demand for cyber skills,combined with shortage of specific cybersecurity skills,makes talent retention a key area of focus for cyber GCC leaders.Cyber GCCs have also embraced the DE&I agenda,focusing on inclusivity and empowerme
120、nt as core values.Figure 12:Cybersecurity skills in demand#2 Cybersecurity skills acquisition requires a balanced approach Growing demand for cybersecurity skills requires cyber GCCs to implement various strategies including external hire,using service providers,internal training and leveraging the
121、gig workforce.Cyber GCCs are exploring gig model for certain skill requirements such as technology,regulatory,audit and standards management and cyber forensics.Certain cyber GCCs have reported leverage of Hire-Train-Deploy(HTD)model for training and acquiring talent for various cybersecurity skills
122、.22 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.#3 Advancing cyber G
123、CC expertise through upskilling In line with rising cybersecurity talent demand,cyber GCCs are actively leveraging interactive and collaborative methods for cybersecurity and digital risk learning.By embracing methods such as gamification,bug bounties,cyber war games and hackathons,cyber GCCs are en
124、abling their talent with experiential learning techniques.Certain cyber GCCs have signed up focused programs with universities and finishing schools,especially for emerging technology,cybersecurity and digital risk skills.Training and awareness programs,certification programs,professional examinatio
125、ns and workshops through both classroom and digital learning continue to be the most preferred methods for upskilling and cross skilling cyber talent.GCCs encourage cross-functional experience or job-rotation,for deeper understanding of business environment beyond the cyber function.Almost 69 per ce
126、nt of respondents acknowledge the value of active engagement with industry forums and special interest groups.This supports active learning and sharing intelligence with the wider cyber ecosystem beyond the GCC,facing similar challenges and benefit from community-based initiatives.Upskilling and Cro
127、ss-skilling cybersecurity talent across cybersecurity and digital risk functions is not just about creating technically well-rounded professionals but also,about fostering a culture of understanding the impact and collaborating with various teams to protect against cyber threats.In addition to techn
128、ical skills,understanding of specific business priorities and challenges are required for cyber GCCs to deliver strategic value.Vijay Kumar Puttaswamy,Director,Information Security Compliance&GRCTransformation for VMWare#4 Annual attrition rate of cyber GCCs has increased over the last three yearsDe
129、mand for cybersecurity and digital risk talent continues to highlight the reliance of global organisations on cyber GCCs.In the current survey,almost 83 per cent of cyber GCCs reported an average attrition rate ranging from 1-15 per cent.About 17 per cent of the survey respondents reported a higher
130、annual attrition rate falling between 16-25 per cent range.The growth in cyber GCCs in India is consistently fueling the demand for cyber talent and talent retention is a key priority for cyber leaders.16%-25%17%1%-7%41%8%-15%42%Figure 13:Annual attrition rate of GCC cybersecurity team2323 2023 KPMG
131、 Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.#5 Demand for remote working pose
132、s a challenge Key challenges highlighted by cyber GCCs in attracting or retaining cybersecurity talent include growing market demand for similar skillsets,compensation and rewards and locational preferences.Figure 14:Key challenges towards attracting/retaining cyber talentPost covid,demand for remot
133、e work has presented both opportunities and complexities for cyber GCCs.While remote working provides access to a larger and more diverse talent pool beyond traditional work locations,it has become a significant challenge in attracting cybersecurity professionals required to be based in office locat
134、ions.There is an increase in demand for remote work from cyber GCC professionals.64%Compensation/Rewards33%Locational preferences22%Aspiration for higher educationInadequate work-life balance and limited employee benefits(e.g.,long working hours,low adoption of work from home,rotational shifts,etc.)
135、11%33%Demand for remote working56%Market demand for similar skills19%Lack of defined career path5%Limited opportunity for mid/senior leadership roles24 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of indepen
136、dent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.#6 DE&I empowers cybersecurityTo improve the pipeline of diversity in talent,cyber GCCs are actively hiring across levels,from diverse groups including differently-abled,ve
137、terans,women in cyber,LGBTQ+,millennials and new age talent etc.Cyber GCCs continue to run training and awareness programs to uplift the awareness and sensitivity of the teams to the challenges faced by these groups.Many organisations leverage formal and informal mechanisms for teams to discuss and
138、share experiences to enhance the DE&I quotient.These forums may extend to the wider community as well.Organisations also conduct regular events including discussion forums,networking events etc.celebrating their contributions.Figure 15:Top five initiatives to promote DE&IConducting regular diversity
139、 and inclusion assessments,events etc.Targeted recruitmentDE&I training and awarenessEstablishing diverse support groups(women,LGBTQ+,veterans,differentially abled etc.in cyber)Ensuring inclusion and maintenance of DE&I at various leadership levels69%69%61%53%47%2525 2023 KPMG Assurance and Consulti
140、ng Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.By providing exposure to different Cybersecurity domains
141、By assigning Cybersecurity mentorsBy conducting and encouraging participation in Cybersecurity competitions/hackathons/exercisesBy providing structured Cybersecurity training programsBy offering internship in Cybersecurity roles for undergraduatesBy conducting regular check-ins to track progress and
142、 address any identified skill gapsCyber GCCs are refreshing their approaches to deal with new age cybersecurity and digital risk challenges.With most cyber GCCs experimenting with emerging technologies for competitive advantage,the gap in knowledge and experience between a fresher and an experienced
143、 cyber professional is closing in rapidly.Freshers have the advantage of rigorous training in new technologies,come with fresh thinking and approaches vital for the cybersecurity teams.Cyber GCCs are adopting various methods,specific to business environment,to attract new age cyber talent including
144、mentorship,internship,defining structured cybersecurity curriculum,focused cybersecurity programs,pre-campus engagement for specific cybersecurity problems,conducting Catch-The-Flag(CTF)contests,cybersecurity hackathons and bug bounties etc.Cyber GCCs execute four key strategies for enhancing the sk
145、ills of entry-level professionals:#7 New age cybersecurity challenges require fresh thinking Approximately 22per cent implement structured cybersecurity training programs tailored to equip freshers with skills vital for addressing the dynamic landscape of cyber threatsAbout 19 percent actively engag
146、e employees in cybersecurity competitions,hackathon exercises and similar initiatives to enhance practical skillsAbout 16 percent focus on exposing freshers to diverse cybersecurity domains,facilitating identification of their specific areas of interestFinally,15 percent offer internships in cyberse
147、curity roles for undergraduates preparing them with cybersecurity mentors to guide and facilitate their development in specific area of cybersecurity75%64%56%53%53%44%Figure 16:Strategies for training freshers on cybersecurity26 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liabi
148、lity Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.Securing digital transformation 0326 2023 KPMG Assurance and Consulting Services LLP,an Indian
149、Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.2727 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability P
150、artnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.#1 Cyber GCCs cultivating an innovation cultureGCCs have been at the forefront of innovation in cyber
151、security for their global organisations,failing fast,failing cheaper and innovating with experiential learning.Cyber GCC talent has been tapped beyond day-to-day operations through various structured interventions including the following:In the age of artificial intelligence,cyber GCCs must embrace
152、digital transformation as a strategic enabler,integrating cutting-edge technologies to elevate their cybersecurity capabilities and safeguard global cybersecurity.Annapurna Alladi,Partner,Cyber Assurance,KPMG in India Involving wider organisation(e.g.,developer community)to ideate,report,recognise,e
153、ncourage and solve known and unknown cybersecurity challenges and problems.Developing a trusted,engaging and collaborative cybersecurity ecosystem within the organisation and across the industry.Hackathon/bug bounty/incubation events Following the success of start-up ecosystem globally and in India,
154、specific carveouts/focused groups/tiger teams have been created in cyber GCCs to conceptualise,experiment,contextualise,harden and adopt latest/advanced technology empowered cybersecurity solutions.Many GCCs encourage an engineering approach of developing Minimum Viable Products(MVPs)to demonstrate
155、quick results to help assess go/no-go decision and secure further investments.Idea based investments Global organisations have dedicated investments and charter to identify and solve short-term(tactical and ad-hoc solutions such as access recertification program),medium-term(cybersecurity engineerin
156、g,automation and implementation programs)and long-term(minimisingheavy investments with alternate and advanced techniques,solutions and technologies)cybersecurity challenges.Focused programs Figure 17:Key initiatives taken to promote a culture of innovationIncubation events,hackathons,bug bounty pro
157、grams etcFocused innovation program for idea generation,prioritised idea implementation,etcLeveraging immersive labs and cyber range facilitiesInnovation as a KPI for performance reviewIdea based investment and encouraging entrepreneurshipDedicated team for supporting innovation61%61%39%39%25%25%28
158、2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.Other measures adopted b
159、y GCCs to enhance innovation quotient include 1)innovation as a Key Performance Indicator(KPI),making the cyber GCC leadership accountable for defining and implementing the innovation agenda 2)leveraging cyber immersive labs,providing a gamified environment for experiential learning 3)setting up Cen
160、ters of excellence/dedicated teams for innovation in cyber,with clearly established outcomes including new products,integration features for existing products,curated solutions for specific cybersecurity functions.Vulnerability rewards programs,secure tools and platforms programs,risk and control au
161、tomation programs including packaged software implementation,bespoke cyber software implementation,Artificial Intelligence(AI)and Machine Learning(ML)empowered cybersecurity and digital risk platforms etc.are some of the key initiatives,programs that cyber GCCs are involved with and driving along wi
162、th their global counterparts.Many of the cyber GCCs surveyed have initiated innovation programs,with some providing specific examples in their survey response,including:Key Cyber Innovation use casesCyber innovation through Service/Process/Program improvementCyber fusion centresIntegrated audit and
163、risk frameworkEnd User Computing Applications(EUCA),End User Developed Applications(EUDA)reduction and risk management frameworkAI and ML risk managementRPA and low code and no code platform risk managementDLT risk management.Platform/Technology based cyber innovation Development and maintenance of
164、automated risk and control measurement engines(e.g.,automated CCM)Development of TPRM platformDevelopment and maintenance of global cybersecurity reporting and dashboardingImplementation of Security Orchestration,Automation and Response(SOAR)for Security Operations Centre(SOC)AI empowered assessment
165、 platforms to process third party submitted compliance evidence reportsCloud security posture managementDevelopment of in-house,24/7 Capture-the-Flag(CTF)platform in both tech and non-tech rolesUse of RPA for seamless service account password changesCloud security automation(including compliance as
166、a code)Data Loss Prevention(DLP)monitoring and automationImprovement in security monitoring and incident response by leveraging Robotics Process Automation(RPA)Application security management.2929 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member fi
167、rm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.GenAI powered cybersecurity use casesInnovation has been cornerstone in addressing the fast evolving and ever-growing cybersecu
168、rity and digital risks.Cyber functions in GCCs have emerged as leaders in addressing these requirements through working on complex use cases,establishing labs to explore synergies across tools and platforms,reengineering of processes and innovating the risk solutions.GCCs have an advantage of establ
169、ishing the right balance across business risk and cyber risk to create a Trusted environment.Atul Gupta,Partner and Head,Digital Trust,KPMG in IndiaCyber Fusion Centrea)Pattern recognition and rule-based flagging of Suspicious Activity Reporting(SAR)b)Transaction fraud prevention,potentially associa
170、ted with money launderingSecurity Operations/Incident Response/Threat Managementa)Incident Response(analysis for pattern recognition and response definition)b)Incident dashboard creation.Near zero manual intervention except for last minute fine tuningc)Refining some of the UEBA rule sets to reduce f
171、alse positivesd)Reverse engineer the payloadse)Use plain English for threat hunting,without need to learn multiple Query LanguagesTechnology Risk Management and Governancea)Create effective controls,policies,and risk statements for rules/requirements b)Enhanced obligation summary generation-Generate
172、 a plain simple language summary of rules/requirements,maintaining their original content and intent,allowing users for the creation of summaries that are easy to comprehend for a wide audience,while still conveying the necessary information and nuances of the original rules/requirementsc)Merge simi
173、lar obligations-streamline and consolidate obligations to enhance efficiency,reduce duplication,and improve overall compliance management.d)Harmonisationof controls-eliminate unnecessary duplicates and streamline the compliance efforts e)Control validation-enable users to assess the quality of contr
174、ols based on standard attributes f)Creating audit scope(requires sanity checks and to further refine the results)g)Confirming classification of document to ensure sensitive and confidential are rightly classifiedVulnerability Managementa)Auto fix code vulnerabilities from SASTb)Consolidation of vuln
175、erabilities and baseline configuration issuesc)Predictive vulnerability detection Third Party Risk Management(TPRM)a)Analyse patterns/themes from third party risk datab)Track the flow of data across the lifecycle,including when it leaves an organisation to boundary third or fourth party etc.Relevant
176、 across cybersecurity domainsa)Aggregation,normalisation,first level of analysis to identify anomaliesb)Assessment reporting(initial draft)c)Analysis of collected data;and identification of issues/itemsd)Reporting and dashboarding30 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited L
177、iability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.Vulnerability rewards program:A leading financial services GCC has put in place a program f
178、or their developer community,to encourage them self-report their application vulnerabilities,incentivising and gamifying vulnerability reporting through organisation wide recognition and assignment of specific rewards,including monetary and leadership engagement.This has resulted in identification o
179、f vulnerabilities across various production systems,reducing efforts involved in ethical hacking and penetration testing and more importantly made the developer community more security conscious,and in some cases involved them more in faster remediation.Customer GRC platform:A leading financial serv
180、ices GCC has built custom applications replacing a commercial eGRC platform.These include a risk and control catalog system,risk assessment platform,vulnerability management platform,security incident management platform,continuous controls monitoring platform and a threat work bench.Third Party con
181、tinuous cyber risk monitoring:A leading telecommunications GCC has developed a solution for continuous monitoring of cyber risks associated with its identified portfolio of third parties,which helps in responding to or managing potential cyber risks arising from the third parties on a daily basis.Ri
182、sk Intel collected from subscribed and other publicly available sources is leveraged to monitor the vulnerabilities in systems/applications/networks,security incidents and significant changes in risk score.This intel is further contextualised to the arrangement/service provided by each third party w
183、ithin the portfolio.The output of this effort is identification of third parties of interest and controls relevant to the identified vulnerabilities.This solution focuses on mitigating the impact of these vulnerabilities,by focusing on effectiveness of relevant controls.Cyber GCC Case Studies3131 20
184、23 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.#3.Cyber GCCs foster open-
185、source technologies adoption About 58 per cent of cyber GCCs surveyed are either actively using or planning to consider using open-source technologies for cybersecurity.Cyber GCCs are leveraging open-source technologies for cybersecurity,as they help tap into the innovation through wider developer c
186、ommunity,open-source components and standards(e.g.leveraging Open Security Controls Assessment Language(OSCAL)by National Institute of Standards and Technology(NIST),facilitating standardised and machine readable formats for automated control assessments).In this ever-evolving landscape fueled by te
187、chnological advancements,visibility of assets and observability of events are pivotal to managing risk across technology assets.By integrating comprehensive monitoring and real-time analysis,organizations can anticipate and mitigate potential threats,ensuring a robust cybersecurity posturein a conne
188、cted world.Hariharan DharmarajanVice President,Cyber Security,Global Services,FiservFigure 18:Adoption of open-source technologiesNot usingActively usingUnder considerationUnder design/implementation on phase 42%28%25%5%Zed Attack Proxy(ZAP)based solution for security scanning:A leading financial se
189、rvices GCC built a custom solution leveraging open-source security scanning platform(ZAP-ZED Attack Proxy),which scans entire application portfolio.This solution is implemented on their infrastructure,integrated with Continuous Integration/Continuous Delivery(CI/CD)pipeline and ticketing tools,along
190、 with automation for running the solution in headless mode and for multiple authentication mechanisms.Also,they have created custom scan policy to tackle our changing cybersecurity threats and created a framework to send scanned reports to the respective stakeholders directly.This resulted in a redu
191、ction in time and manual effort to run scans on application ecosystem,leading to 1)cost-savings vis-a-vis licensing cost and resource time,and 2)greater flexibility in customising the platform as per requirement.Cyber GCC Case Studies32 2023 KPMG Assurance and Consulting Services LLP,an Indian Limit
192、ed Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.Key cybersecurity areas where cyber GCCs leverage open-source TechnologiesSoftware secu
193、rityMultifactor authenticationLog monitoring and event monitoringVulnerability management(SAST and DAST)Data in motion Network mapping Cloud security posture managementGovernance,Risk and Compliance(GRC)Antivirus and antimalwareCyber GCCs,on the other hand,continue to manage potential risks and vuln
194、erabilities associated with adoption of open-source technologies.Various programs including third-party application risk management,open-source software security management and software supply chain security management are playing a key role in securing adoption of open-source technologies.#4.Naviga
195、ting the future:A deep dive into the adoption of emerging technologies by cyber GCCsFigure 19:Usage of emerging technology for cybersecurity activityAdvanced analytics using MLCloud19%DLT6%SOAR and SOC automation58%19%RPA56%17%Risk and control automationAdvanced roboticsNo code/Low code platforms33%
196、25%AR/VR/MR19%6%Metaverse17%3%Behavioural analytics39%33%47%42%39%28%Context-aware security81%11%17%14%42%28%Extended Detection and Response(XDR)/Extended security intelligence and automation management(XSIAM)50%17%Zero trust44%36%Web 3.0 security31%25%Actively usingPlanning to use3333 2023 KPMG Ass
197、urance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.With the changing cybersecurity lands
198、cape,cyber GCCs have actively deployed existing and emerging technologies for effective cybersecurity and digital risk management.Of the survey respondents,top five technologies being leveraged for cybersecurity includeCloudThe widespread adoption of cloud technologies is rooted in the pursuit of sc
199、alability,flexibility,cost competitiveness and collaboration solutions.Cloud technologies empower cyber GCCs to adapt swiftly to evolving threats and provide a robust foundation for secure and scalable cybersecurity operations.Some use cases for adopting cloud-based solutions for cybersecurity inclu
200、de:Cloud based SIEMCloud based Identityand Access ManagementCloud based end point solutionsSecurity Orchestration,Automation and Response(SOAR)and Security Operations Centre(SOC)AutomationAutomating response to threats detectedIntegration withGRC for issue managementPhishing mail analysis forpattern
201、 recognitionReducing time to respond and SOC analyst fatigueCyber GCCs adopt various technologies for their SOC automation with the aim of achieving efficiencies of scale and reducing manual workloads in their security orchestration processes.SOAR and SOC automation empower cyber GCCs to respond pro
202、mptly to security incidents,minimising response time,and allowing for a more proactive,resilient and robust cybersecurity posture.The following instances are some of the notable use cases:Robotic Process Automation(RPA)RPA serves as a transformer in enhancing the capabilities of cyber GCCs.RPA makes
203、 it easier to automate routine and repetitive tasks and is preferred choice for cyber process automation.This allows the analyst to focusing resources on assessing root cause of issues and their impact.Use cases developed by cyber GCCs includeAccess reviews and access certification Automatedticket h
204、andling Automated evidence gatheringAutomated reporting in incident analysis34 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private En
205、glish company limited by guarantee.All rights reserved.AUDIBOTs:A leading manufacturing GCC has developed Robotics Processing Automation(RPA)bots for performing specific audit activities of various business,IT and security controls.This has led to reduced manual efforts,faster identification of audi
206、t issues and reduced audit risks.Vendor BOTs:A leading global bank GCC,has developed bots for assisting their vendors perform desktop checks,which are part of their ODC third party risk management framework.This has helped vendors reduce their manual efforts,enhance their compliance levels and made
207、the third party risk management more collaborative and partnership oriented.Cyber GCC Case StudiesExtended Detection and Response(XDR)and Extended Security Intelligence on Automation Management(XSIAM)Cyber GCCs leverage XDR and XSIAM solutions for enhanced threat visibility,streamlined response capa
208、bilities,and automation in cybersecurity operations which use stand-alone security solutions.The unified approach of XDR and XSIAM enables quicker response towards security incidents reducing risk exposure.Use cases developed by cyber GCCs includeThreat managementEnd point and networksecurity manage
209、mentRisk and Control AutomationCyber GCCs leverage risk and controls automation to enhance and streamline risk management process and internal controls.Cyber GCCs have moved on from leveraging automation only for risk and control reporting to automation in risk and control assessments,control testin
210、g,controls monitoring and issue management,contributing to enhanced risk visibility.The adoption of risk and control automation is grounded in the global trend towards proactive risk management.Some specific areas where risk and controls automation are being leveraged includeAutomated CCMAudit workf
211、low managementCompliance workflow automation and centralising artefact collection and archival3535 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International
212、Limited,a private English company limited by guarantee.All rights reserved.Leveraging emerging technologies for cyber GCCs(Technology for cyber)Cyber GCCs are actively exploring the use of AI/ML including GenAI in enhancing productivity and improving accuracy of outcome.Some specific use cases for A
213、I/ML includeAI(generative,predictive,conversational)Advanced cybersecurityanalytics using MLThreat vector analysisAI for risk identificationAI models integration with Integrated Development Environments(IDE)for vulnerability identificationIntelligent threat detection,case content summarisation,incid
214、ent response recommendation,error detection.User Entity Behavioural Analytics(UEBA)Risk profiling of endusers and end points Correlation of logs for Incident Response(IR)SOC and incident prioritisationEvent managementSecure SDLC fraud and abuse detectionData protection Controls review.#5.Cyber GCCs
215、playing a crucial role in tracking End-of-Life and End-of-Support components Cyber GCCs are proactively tracking and managing risks from End-of-Life(EoL)or End-of-Support(EoS)software,hardware,and other technology components to protect business functions dependent on such assets.Global organisations
216、 continue to report EOL/EOS to their global boards and associated committees and secure investments to plan and implement upgrades or alternates.72%28%YesNoFigure 20:End-of-Life(EOL)/End-of-Support(EOS)tracking36 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership
217、 and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.Figure 21:Mode of cybersecurity software procurementThe majority of the respondents surveyed are currently proc
218、uring cybersecurity solutions/software globally for use locally.However,33%of the respondents have chosen to procure locally.This will help optimise the cost of software used in cyber GCCs better.Figure 22:Cybersecurity software publisher customer adoption teams helping cyber GCC teams to get maximu
219、m valueAlso,cyber GCCs work closely with the software publisher customer success/adoption teams to gain maximum value from the platforms/solutions.As many as 75%of the respondents have experienced significant value in working with customer success teams of cybersecurity platform and software publish
220、er.Procure locally,use locally14%Procure locally,use globally19%Not procuring in India GCC67%NoYes75%25%Key objectives of this engagement include enhancement of solution understanding,implementation capability and optimisation of usage of cybersecurity solutions.Organisations seem to prioritise buil
221、ding a collaborative relationship with customer success teams to address potential challenges,receive tailored and seamless support,and ensure a smoother integration of the acquired software into their cybersecurity systems landscape.#6 Cyber GCCs optimise software asset management3737 2023 KPMG Ass
222、urance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.Figure 23:Security review of software
223、#7.Cyber GCCs securing software throughout the lifecycleSoftware acquisition and development is one of the major functions delivered by most GCCs in India.Due to functional adjacency,cyber GCC teams are working closely with teams involved in software acquisition and software development to manage ri
224、sks associated with the software.About 81 per cent of survey respondents highlighted cyber GCCs are reviewing the security of software acquired or developed across their global organisations.Not reviewed in India GCC,as well as globally8%Reviewed in India GCC,used locally17%11%Reviewed in India GCC,
225、used locally and globally64%Not reviewed in India GCC,used locally38 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English comp
226、any limited by guarantee.All rights reserved.04Cyber risk culture38 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English compa
227、ny limited by guarantee.All rights reserved.3939 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guara
228、ntee.All rights reserved.67%47%44%44%39%Third partycybersecurity riskSoftware supply chainsecurity riskEnd points and end usercompromiseRegulatory riskCloud platformsexpansion risk(risk interms hardwareplatform optionality,placement of datacentres in complexjurisdictions and need tomake security tra
229、de-offs)#1:Cyber GCCs manage top risks tracked by their global boardsThe top five cybersecurity risks reported to the global boards include third party cybersecurity risk,software supply chain security risk,cyber regulatory risk,endpoint security risk and cloud security risk.These risks highlight gr
230、owing reliance on third party ecosystems,heightened scrutiny by regulators on existing and emerging technologies,continued end-point and end-user exposure and accelerated cloud expansion across sectors.Other key risks being tracked include insider risk,production integrity risk,product user security
231、 risk,operational technology security risk,reputational risk,identity risk,IT governance risk,critical infrastructure and system risk,cloud migration risk and technology obsolescence.Figure 24:Top five cybersecurity risks tracked by global boards40 2023 KPMG Assurance and Consulting Services LLP,an
232、Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.69%61%50%44%42%CybersecuritydashboardPeriodic governancemeetingsPeriodic cy
233、bersecurityposture reportingManual KPIs and KRIsreportingCyber risk quantification(e.g.,factor analysis ofinformation risk,analysis of informationrisk,etc.)#2:Cyber GCCs play an active role in managing top risksMany cyber GCCs are helping their global organisations identify,assess,remediate,track an
234、d report cybersecurity risks.Across the 3LoD,cyber GCCs are focused on identifying and assessing cybersecurity and digital risks,including emerging technologies such as,GenAI,DLT,cryptocurrency,payments,OT,low code and no code etc.Beyond risk assessments,cyber GCCs are helping identify and design su
235、itable controls to mitigate cybersecurity and digital risks working closely with relevant business,technology and other functional stakeholders in GCCs and across the locations of respective global organisations.Figure 25:Cyber GCC risk reporting models#3:Data driven cybersecurity risk reporting mec
236、hanism is growingThe evolution of cybersecurity risk reporting within cyber GCCs is marked by the increased adoption of cybersecurity risk quantification and automated reporting through cybersecurity dashboards.This strategic shift empowers decision-making processes,fostering transparency,with timel
237、y insights.Preferred methods of cybersecurity risk reporting include cybersecurity dashboards,periodic cybersecurity governance meetings,periodic cybersecurity posture reporting and cybersecurity risk quantification.About 44 per cent still utilise manual KPIs and KRIs for reporting.Cybersecurity rep
238、orting:A leading technology GCC and a leading investment bankGCC have developed an automated cybersecurity reporting system,based on metrics associated with key cybersecurity functions.A cybersecurity risk dashboard has been built on top of the system,providing enhanced risk visibility,tracking top
239、risks identified by their global boards and appointed committees.Cyber GCC Case Studies4141 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited
240、,a private English company limited by guarantee.All rights reserved.#4:Cyber GCCs navigate existing cybersecurity and emerging digital risk challengesTop challenges faced by cyber GCCs continue to be the same since 2020,these include:Emerging technology cyber attacksChanging regulatory landscapeThir
241、dparty risksDeveloping and sustaining risk cultureTraining/retaining cybersecurity skillsBudget constraintsAdding to this,CISOs are faced with challenges emerging from expanding digital footprint,evolving risks from emerging technologies usage and challenges in identifying advanced technologies empo
242、wered cybersecurity and digital risk management solutions to deal with new age technology risks(e.g.,AI for AI-AI powered solution for AI risk management,as against a manual or tactical automation-based solution).Figure 26:Top Challenges for cyber GCC leadership58%58%56%44%36%34%Changing regulatoryl
243、andscapeRise in emergingcyberattacks due toadoption ofemergingtechnologiesThird party riskDeveloping andsustaining riskculture(e.g.,organisationalalignment andempowerment ofCISO function,aligning securitywith businessobjectives,etc.Training andretainingcybersecurity skillsBudget constraints42 2023 K
244、PMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.#5:Key cloud security challeng
245、es faced by cyber GCCsCloud adoption has seen a significant increase across global organisations and GCCs help drive this as a key business initiative.Top security challenges reported by the GCCs in cloud adoption include the following:Figure 27:Key cybersecurity challenges faced by Cyber GCCs durin
246、g cloud adoptionHowever,cyber GCCs reported that risk managed cloud adoption has distinct advantages,including:Easier configuration of security controlsAutomationCost optimisation Infrastructure for innovation Integration with readily available third party tools61%56%42%42%39%33%31%14%Data securityR
247、egulatorycomplianceUnauthorisedaccessReducevisibility andcontrol(includingcloud serviceprovideroutsourcing)Multiple cloudsecurity toolsrequirementfor effectivecloud securityposturemanagementVendorsecurityIncreasedcomplexitydue tomigrationIncompletedata deletion4343 2023 KPMG Assurance and Consulting
248、 Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.#6:Key operational technology and network challenges faced
249、 by cyber GCCsGlobal organisations continue to deploy OT systems and leverage cyber GCCs to manage various applications and solutions powered by OT systems and networks.Cyber GCCs not only help in identifying risks but also are focused on implementing controls suitable to manage these risks.It is ob
250、served that maturity of handling OT security in cyber GCCs is evolving,however,the survey unveils a diverse set of challenges faced by cyber GCCs in managing OT systems and networks,including:Figure 28:Challengesfaced by Cyber GCCs in securing OT systems and networks17%17%17%11%11%8%8%Limited budget
251、allocationAbsence of cyberprotection for allOT usecasesAbsence ofdefined OTsecuritygovernance andpolicy frameworkLack of securityexpertise in thearea of OTsecurityAbsence ofphysical/on-sitepresence inplantsAbsence ofagreements withOEMs forpatchingDifficulty inmaintaining theavailability of OTsystems
252、 duringsecurityinterventions#7:Cyber GCCs key to manage Software Supply Chain Security Risk Management(SSCSRM)Cyber GCCs are playing a pivotal role in orchestrating and fortifying software supply chain security,safeguarding the integrity and resilience of global organisations and their corresponding
253、 software supply chains.They actively engage in critical functions including Software Bill of Materials(SBOM)and Software Supply Chain Security Risk Management(SSCSRM)lifecycle activities.Software Supply Chain Security(SSCS)Risk Management:A Swedish telecommunication GCC developed a framework to man
254、age and mitigate SSCS.Also,they perform SSCS risk assessment for third party software products covering risk areas such as Software Development Lifecycle,Software Development Infrastructure Security,SSCS program Governance,Software Product Security Capability,SBOM,and Third Party/Partners Risk Manag
255、ement.Cyber GCC Case Studies44 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights re
256、served.As cyber GCCs continue to deal with evolving cybersecurity threats,and challenges including emerging technologies risk management,cybersecurity and digital risk management requires,more important than ever,a cultural shift.Cyber GCCs continue to work with internal and external stakeholders to
257、 bring in and manage a change,which empowers their organisations to better understand and appreciate the cybersecurity and digital risks and associated impact on their business.Key programs taken up by cyber GCCs to promote cybersecurity risk culture include cybersecurity training and awareness,reco
258、gnition/incentivisation and gamification/simulation/bug bounties.There is an increase in gamification,simulation,and bug bounty programs(increased by about 30 per cent compared to 2020),while training and awareness continues to be a preferred approach,followed by organisations commitment to promote
259、cybersecurity risk culture and implementation of recognition and incentivisation measures.#8:Top 10 cyber threats Many cyber GCCs consider themselves at“adaptive”maturity level i.e.,continually improved,when it comes to dealing with cybersecurity threats.MalwarePhishingRogue softwareDrive-by-downloa
260、dPassword attacksSocial EngineeringDenial of Service(DoS)Man-in-the-Middle(MITM)Data breachInsider threat and Advanced Persistent Threat(APT)Top cyber threatsGCCs deal with are Notably,in 2023,cyber GCCs reported a substantial increase in readiness level for dealing with rogue software at
261、tacks.#9:Cyber GCCs imbibing cyber risk cultureFigure 29:Key initiatives taken to promoterisk culture in cyber GCCsTraining and awareness86%Organisational commitment to cybersecurity67%Recognition/incentivisation 56%Gamification/simulation/bug bounties44%45 2023 KPMG Assurance and Consulting Service
262、s LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.45 2023 KPMG Assurance and Consulting Services LLP,an Indian Limit
263、ed Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.46 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partners
264、hip and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.05Together for better 46 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partner
265、ship and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.4747 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member f
266、irm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.In the post-pandemic landscape,the imperative for collaboration within the cybersecurity ecosystem has grown exponentially,con
267、sistent with the rapid pace of digital transformation and advancements in emerging technologies.Central to this industry-wide collaboration driven by cyber GCCs is sharing of key challenges,benchmarks and leading practices in dealing with cybersecurity and digital risks.Cyber GCC forums are on the r
268、ise,showcasing innovation across key cybersecurity and digital risk domains and leveraging collective intelligence to provide counsel to government,regulators and industry bodies on cybersecurity matters impacting GCCs.Cyber GCCs collaboration with various industry stakeholders including start-ups,o
269、ther GCCs,academia and law enforcement,regulatory and industry bodies is driven by multifaceted strategy aimed at fostering innovation,knowledge exchange and industry resilience.Engagement with startups and academia offers cyber GCC access to diverse,accelerated and commercial models of innovation,l
270、everaging the agility and creativity inherent to them.Learning from other GCCs becomes a key motivator,creating a dynamic environment where shared experiences and insights contribute to collective growth and adaptability.Cyber GCCs interact and engage with the regulators not only focused on achievin
271、g regulatory compliance but also help appreciate global and cyber GCC challenges in meeting the regulatory requirements.In essence,Together for Better epitomises cyber GCCs commitment to increasing industry-wide cyber resilience and fostering a secure digital future for all.Figure 30:Top five driver
272、s for cyber GCC collaborationLearning fromother GCCs(e.g.,benchmarking,sharing business problems and solutions,sharing best practices,threat intel etc.)Industry representation to the regulators/government bodies on special issuesOrganising events/hackathons/accelerator programsIndustry exchange prog
273、ramsLower cost of innovation61%50%50%42%36%#1 Cyber GCCs collaborate for better Global organisations have been collaborating through various platforms including industry associations,information sharing and analysis groups,enabling their leaders and talent through industry events,hackathons and focu
274、s groups such as Special Interest Groups(SIGs)creating standards and industry-wide frameworks focused on cybersecurity and digital risk management.Cyber GCCs have imbibed this culture of industry-wide collaboration and have empowered their global organisations to innovate faster,strengthen organisat
275、ional and industry-wide resilience efforts and most importantly sustain and develop new generation talent,tools,platforms and new-age practices required to deal with cybersecurity and digital risks.48 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a membe
276、r firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.As cyber GCCs expand across various cybersecurity and digital risk management functions,it is imperative for them to learn
277、from peers through:Benchmarking of cybersecurity practices,sharing of cybersecurity challenges,problems and solutions,leading practices,threat intelligence etc.Participating in cyber GCC forums and events,to discuss emerging technologies and cybersecurity considerations and collaborate in improving
278、industry standards and frameworksConducting industry-wide joint simulation exercises to address common cybersecurity challenges.a.Learning from other GCCs b.Industry representation to the regulators/government bodieson specific issues and matters related to cybersecurityCyber GCCs collaborate with g
279、overnment bodies and regulators to ensure industry representation on specific issues due to the critical intersection between digital empowered economy and cybersecurity and digital risk management.By engaging with government and regulatory entities,cyber GCCs actively participate in shaping policie
280、s and regulations that directly affect the industry,ensuring that the rules are both effective and practical.This collaboration also facilitates information sharing,enabling timely response to emerging cybersecurity and digital risks and aligning industry practices with national security priorities.
281、Key drivers for cyber GCC collaboration include:Additionally,cyber GCCs bring global experience to the table,helping regulators better appreciate challenges and leading practices of global organisations.Some of the key government initiatives including National cybersecurity strategy,DPDP Act,G20 sum
282、mit declaration of cybersecurity as a global problem,Honourable Prime Minister of India call for crypto regulation,cybersecurity and human-centric AI governance have found resonance with cyber GCCs and their global counterparts.As India emerges stronger as a global economy,it continues to attract gl
283、obal organisations,the role of cyber GCCs will evolve further with active participation,consultation,compliance and formulation of various security strategies.4949 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organizatio
284、n of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.Many Cyber GCCs are leveraging start-ups to augment their capabilities and propel innovation by encouraging accelerator programme as well as exploring tie-ups w
285、ith the start-up community for:Co-creation of cybersecurity products,especially involving AI,Machine Learning and other advanced technologiesNiche product line,including Web 3.0 security,privacy technology,crypto security etc.Access to cybersecurity talent with niche skills in aforementioned areas.S
286、tart-ups are gaining access to global cybersecurity challenges,problems and sponsorship through cyber GCC platform.This will not only increase start-ups reach but also help them tap into the global market.c.Cyber GCCs partner with start-ups for innovationd.Cyber GCCs and academia unite:crafting a cy
287、bersecurity career value propositionAvailability of talent is a key factor in the growth of cyber GCCs in India.To attract and retain the right talent,cyber GCCs are working with academic institutions and schools in bringing practical experience to the curriculum.This is done through internships,men
288、torship programs,guest lectures,hackathons and industry specific programs.By actively engaging with educational institutions,these centres not only attract top-tier talent but also create a conducive environment for knowledge exchange and innovation.Collaboration with20232020other GCCs for benchmark
289、ing,sharing business problems and solutions,sharing leading practices and threat intel55%29%regulators and government bodies for Industry representation on specific issues47%23%branding for talent acquisition39%32%sharing information with the wider ecosystem33%NAfocus on leadership development31%NAC
290、ollaboration between a Cyber GCC and the broader ecosystem will foster the speed and enhance the impact from the work that they doing.Collaboration with the ecosystem peers,partners,startups and academia is a force multiplier having the potential of creating industry-wide collective cybersecurity sh
291、ield,safeguarding the health of global space,while fostering cybersecurity innovation.Sukanya Roy,Head,BPM and GCC Initiatives50 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affil
292、iated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.50 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG Inter
293、national Limited,a private English company limited by guarantee.All rights reserved.51 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a pr
294、ivate English company limited by guarantee.All rights reserved.52 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company
295、 limited by guarantee.All rights reserved.06Cyber GCCs in a Volatility,Uncertainty,Complexity,and Ambiguity(VUCA)World52 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated wi
296、th KPMG International Limited,a private English company limited by guarantee.All rights reserved.5353 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG Internation
297、al Limited,a private English company limited by guarantee.All rights reserved.#1 Cyber GCCs tap into advanced and latest technologiesPost covid,digital technology advancements including Gen-AI adoption,geopolitical uncertainties,rising cyber warfare and increased demand for cyber skillsets and talen
298、t,have led to significant increase in the role of cyber GCCs supporting their global organisations.Amidst changing regulatory landscape,global organisations are dealing with a dynamic and challenging environment.Cyber GCCs are working with their global organisations in managing these,in addition to
299、sustaining BAU and organisational priorities.Cyber GCCs are adopting innovative,collaborative and scalable approaches to cybersecurity and digital risk management.Cyber Fusion Centers are next generation Security Operation Centres(SOCs),acting as nerve centers,integrating deep functional and technic
300、al capabilities across Cyber GCCs and their global organisations.In this ever-evolving global cybersecurity and digital risk landscape,these centers of cyber excellence are at the forefront of navigating uncertaintiesShalini Pillay,Partner and GCC Leader,KPMG in IndiaAs the digital landscape continu
301、es to evolve,cyber GCCs recognise the importance of harnessing capabilities of advanced,latest,and fit-for-purpose cybersecurity instrumentation to identify,detect,protect,respond,and recover from growing and active cybersecurity threats.Top five cybersecurity tools leveraged by cyber GCCs include I
302、ntrusion Detection Systems/Intrusion Prevention Systems(IDS/IPS),Endpoint Detection and Response(EDR),Security Information and Event Management(SIEM),Threat Intelligence Platforms(TIP)and Network Traffic Analysis(NTA).Also,use cases are being developed with advanced technologies such as AI,ML,and be
303、havioural analytics to identify anomalies and to proactively defend against emerging threats.54 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Lim
304、ited,a private English company limited by guarantee.All rights reserved.#2 Elevating the defense by leveraging Cyber Fusion Centers(CFCs)CFCs are central for cross-functional collaboration and innovation to manage cybersecurity with agility and comprehensive response capabilities.They bring stand-al
305、one cyber functions together to respond to various cyber crisis situations.CFCs leverage emerging technologies,data driven strategies and threat intelligence in identifying and managing cybersecurity and digital risks on a real time basis.About 56 per cent of cyber GCCs support their global organisa
306、tions in either setting up or operating existing CFCs.The top three CFC benefits reported by cyber GCCs include:Faster Incident Response timeframe:CFCs are leveraged in building use cases through seamless integration of threat intelligence,advanced analytics,and automated workflows across various fu
307、nctions and processes,instrumental in achieving faster incident resolution and building resilience.Improved sharing of threat intelligence:CFCs within cyber GCCs are enhancing threat intelligence processing by contextualising information from diverse data sources,fostering real time collaboration am
308、ongst various security teams,leveraging advanced analytics including User and Entity Behaviour Analytics(UEBA).This approach is helping global organisations in gaining a comprehensive understanding of the evolving threats and accelerating distribution of timely information for better response.Enhanc
309、ed overall cybersecurity outcomes:CFCs within cyber GCCs are elevating the overall cybersecurity posture of the global organisations by operationalising a comprehensive framework.They streamline activities from various functions,processes and solutions and build models to anticipate and counter evol
310、ving threats and scenarios resulting in more informed decisions and outcomes.Faster incident response timeframe46%Improved threat intelligence sharing38%Enhanced overall cybersecurity outcomes38%Predict,detect,prevent and respond to cyber threats in a proactive and coordinated manner36%Using an inte
311、lligence-driven analysis and tailored incident response process30%Figure 31:Benefits of utilising CFCs5555 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG Intern
312、ational Limited,a private English company limited by guarantee.All rights reserved.Cyber GCC Case StudiesGenAI based assistance in incident response templates and queries to aid analysts in their analysis and correlationEnhanced incident enrichment through automated Intelligence feedsIndicators of C
313、ompromise(IOC)based threat huntingStreamlined incident response through seamless integration with other security solutionsAI BOT based quick reporting and dissemination of information(including graphs and reports)This resulted in reduced manual efforts,enhanced quality control on incident ledgers,re
314、duction of analyst time and incident containment,less than 30 minutes in most of the cases.AI empowered SOC automation:A leading financial services GCC has developed a solution to automate incident enrichment,analysis and remediation action,in order toenhance the overall incident response efficacy a
315、nd efficiency.This included:56 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights re
316、served.Global organisations constantly strive to implement robust cybersecurity practices across people,process,and technology landscape.However,due to the ever-evolving cybersecurity threat and attack landscape,regulatory complexities and third party risks,there is a residual risk that organisation
317、s need to proactively quantify and manage.Cybersecurity risk quantification exercise followed by procuring suitable insurance coverage continues to be an important initiative in global organisations approach to cybersecurity and digital risk management.The majority of GCCs(66 per cent)conduct cybers
318、ecurity risk assessment and quantification prior to procurement of cyber insurance following a risk-based approach to their cyber insurance strategies.For most of the global organisations(73 per cent),the global cyber insurance policy extends to their cyber GCC entities as well.This helps them bring
319、 a global risk lens and comprehensiveness in coverage.Cyber insurance is leveraged to protect from financial losses due to cyber incidents.The costs including forensic analysis,regulatory fines or penalties,losses in business operations,data recovery,and reputational management may be recovered base
320、d on the nature of the policy.According to the survey,top three cybersecurity incidents covered under cyber insurance include data breaches,business interruption and cyber extortion.Data breaches(including loss or theft of sensitive data)77%Business interruption(including network failures)57%Cyber e
321、xtortion47%43%Reputational damage#3 Cyber GCCs help in cyber risk quantification and cyber insurance Cyber insurance has been evaluated for appropriate risk management in the last few years.Some of the challenges encountered by GCCs in selecting cyber insurance include:Limitations in determining app
322、ropriate coverage limitsInability to quantifycyber risk Establishing premium costsFigure 32:Type of incidents covered undercyber insurance5757 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent memb
323、er firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.Figure 33:Cyber GCCs formailsed and implemented processes vis-a-vis DPDP Act requirementsDigital Personal Data Protection(DPDP)Act emphasises organisations duty to protect digital p
324、ersonal data,while safeguarding the freedom of individuals.While the privacy principles are fundamentally aligned to the principles of the global regulations defined in the last few years,DPDP Act has some unique requirements including applicability to digital personal data,non-distinction between P
325、ersonally Identifiable Information(PII)and Sensitive Personal Information(SPI),etc.Cyber GCCs have already been on privacy compliance journey,and this experience will be an advantage in meeting the DPDP Act requirements.Additional considerations for GCCs in implementing DPDP Act requirements include
326、 stakeholder complexity(internal employees,contractors,third parties,customers etc.)and regulatory penalties.Cyber GCCs internally have identified key focus areas pertaining to DPDP Act including defining a unified privacy governance program,personal data discovery,mapping and inventory,data protect
327、ion impact assessments,data breach management,security for privacy,data principals rights management,third party privacy management,cross border data transfer,privacy by design,training and awareness programs and privacy monitoring and reporting.The survey highlights that fewer than 50 per cent of G
328、CCs have formalised and implemented processes to comply with DPDP Act requirements of appointment of Data Protection Officer(DPO),grievance redressal,Data Protection Impact Assessment(DPIA),data retention,data deletion and privacy notice.However,majority of the cyber GCCs(50 per cent)have already fo
329、rmalised and implemented processes to comply with data breach management,cross border transfer and contractual requirements of the act.#4 Cyber GCCs proactively leverage global privacy practices to comply withDPDP ActValid contract is mandatory for onboarding third party(processing employee personal
330、 data)Data breach management(identification and reporting of breaches)Cross border transferData retention Data controller/fiduciary to ensure data is deleted by onboarded third partyData Protection Impact Assessment(DPIA)Appointment of DPOPrivacy notice to include data subject/principal rights and c
331、omplaint mechanism to Data Protection BoardGrievance redressal52%52%53%44%44%39%39%36%Global regulatory compliance has always been a key focus for cyber GCCs due to business and reputational impact leading to financial penalties.It is encouraging to note that most of the cyber GCCs have experience i
332、n addressing local(e.g.,DPDP,RBI etc.)as well as global regulations(e.g.,HIPPA,GDPR,PIPEDA,CCPA etc.)applicable.Vinayak Godse,CEO,DSCI58 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member fir
333、ms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.58 2023 KPMG Assurance and Consulting Services LLP,an Indian Limited Liability Partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.59 2023