Detailed Scope of Work - Data at Rest, In Transit, Logs Review
Assessment Methodology - Our 4-Step Process
Observation-Based Approach - How it works
Roles & Responsibilities - RACI Matrix
Timeline & Milestones - 10-Day Schedule
Daily Status Reporting - Communication Plan
Next Steps - Starting Today
Q&A Session
🎯 Engagement Overview
Objective
Assess whether PII data is stored, transmitted, or logged in unencrypted/clear-text format across SIDBI's infrastructure.
Scope
Oracle 19c (On-premise)
AWS S3 Buckets (5-6)
SQL Server (Cyfuture + ESDS x4)
Security Tools (SIEM, DAM, EDR, AV)
Final Deliverables: Assessment Report + CERT-In Certification
📋 Detailed Scope of Work
Objective: To assess whether PII data is stored, transmitted, or logged in an unencrypted or clear-text format across on-premises, cloud, and co-location
environments. CERT-In certification will be provided upon completion.
💾 Data at Rest
• Oracle 19c (On-premise): Verify TDE encryption status for PII data
• AWS S3 Buckets (5-6): Validate SSE/KMS encryption configuration
• SQL Server (Cyfuture + ESDS x4): Review TDE implementation and key management
🌐 Data in Transit
• Traffic Sampling: Review exit points/perimeter devices (minimum 10 samples)
• TLS Configuration: Evaluate Oracle, AWS, and SQL Server data transfers for
encryption
• Protocol Verification: Inspect perimeter devices for secure communication protocols
📋 Logs Review
• SIEM, DAM, EDR/XDR, Antivirus: Confirm PII is not forwarded in clear text
• Log Transfer Security: Assess whether logs are transmitted with encryption
enabled
• Pattern Detection: Search for PII exposure in security monitoring platforms
🔄 Our Assessment Process - 4 Steps
Step 1: Understand the System As-Is
📊 Initial discovery to understand your infrastructure, architecture, and current security controls
Step 2: Interview & Evidence Collection
📝 Structured questionnaire with stakeholders + Observation sessions where SIDBI
team demonstrates systems and provides proof/evidence
Step 3: Analysis & Report Preparation
📑 Analyze PII encryption findings (Data at Rest, In Transit, Logs),
perform gap analysis against best practices, and prepare comprehensive report on PII protection posture
Step 4: Daily Status Updates
📧 Daily progress reports to stakeholders ensuring transparency and alignment
🔄 End-to-End Process Flow
flowchart TB
START([🚀 Kickoff Meeting TODAY 3:30 PM])
subgraph STEP1["📊 STEP 1: Understand System As-Is"]
S1A[Review Architecture Diagrams]
S1B[Understand Data Flow]
S1C[Identify Systems in Scope]
S1D[Review Existing Security Controls]
end
subgraph STEP2["📝 STEP 2: Interview & Evidence Collection"]
S2A[Share Questionnaire 475 Questions]
S2B[Schedule Observation Sessions Days 1-6]
S2C[SIDBI Team Demonstrates Systems Skillmine Observes]
S2D[Collect Evidence Screenshots, Reports, Configs]
end
subgraph STEP3["📑 STEP 3: Analysis & Reporting"]
S3A[Consolidate Findings Day 7]
S3B[Gap Analysis & Risk Rating]
S3C[Draft Report Day 8]
S3D[SIDBI Review Day 9]
S3E[Final Report + CERT-In Day 10]
end
subgraph STEP4["📧 STEP 4: Daily Status Updates"]
S4A[Daily Email to Stakeholders]
S4B[Progress Tracking]
S4C[Issue Escalation if needed]
end
START --> STEP1
STEP1 --> STEP2
STEP2 --> STEP3
STEP3 --> END([✅ Engagement Complete Day 10])
STEP1 -.Daily Updates.-> STEP4
STEP2 -.Daily Updates.-> STEP4
STEP3 -.Daily Updates.-> STEP4
style START fill:#90EE90,stroke:#228B22
style END fill:#FFD700,stroke:#DAA520
style STEP1 fill:#E6F3FF,stroke:#1E90FF
style STEP2 fill:#FFE4B5,stroke:#FF8C00
style STEP3 fill:#E6FFE6,stroke:#228B22
style STEP4 fill:#FFE6E6,stroke:#DC143C
👀 Observation-Based Audit Model
Key Principle: Skillmine has NO direct access to any systems.
SIDBI team performs all actions while Skillmine observes and documents.
🏢 Onsite Mode
SIDBI staff uses their own laptop
Logs into systems
Navigates screens as requested
Skillmine observes and takes notes
🌐 Remote Mode
SIDBI shares screen via Teams/Zoom
Logs into systems
Navigates as requested
Skillmine observes remotely
🔍 How Observation Sessions Work
sequenceDiagram
participant SK as Skillmine
participant SB as SIDBI Team (DBA/SecOps)
participant SYS as System (Oracle/AWS/SQL)
SK->>SB: 1. Share verification scripts
Note over SB: SIDBI reviews beforehand
SK->>SB: 2. "Please execute this query"
SB->>SYS: 3. Execute query
SYS->>SB: 4. Return results
Note over SB,SYS: SIDBI demonstrates
SB->>SK: 5. Screen share (live)
SK->>SK: 6. Observe & take screenshots
SK->>SB: 7. "Can you show X?"
SB->>SYS: 8. Navigate to X
SYS->>SB: 9. Display X
SK->>SK: 10. Capture screenshots
SK->>SK: 11. Document findings
SK->>SK: 12. Organize evidence
SK->>SB: 13. "Session complete, thank you"
Note over SK,SB: All evidence captured by Skillmine
🎯 Four Assessment Pillars
graph TB
subgraph ASSESSMENT["🔍 PII Encryption Assessment"]
subgraph DAR["💾 Data at Rest (Days 1-3)"]
DAR1[Oracle 19c TDE]
DAR2[AWS S3 SSE/KMS]
DAR3[SQL Server TDE Cyfuture + ESDS x4]
DAR4[Key Management]
DAR5[Backup Encryption]
end
subgraph DIT["🌐 Data in Transit (Day 4)"]
DIT1[TLS Configuration Version 1.2+]
DIT2[Traffic Sampling 10+ samples]
DIT3[Oracle SQL*Net]
DIT4[SQL Connection Encryption]
DIT5[Certificate Management]
end
subgraph MASK["🎭 Data Masking (Days 1-6)"]
MASK1[Non-Prod Masking]
MASK2[Dynamic Masking]
MASK3[Tokenization]
MASK4[Masking Policies]
end
subgraph LOGS["📋 Logs Review (Days 5-6)"]
LOGS1[SIEM PII Pattern Search]
LOGS2[DAM Database Activity]
LOGS3[EDR/XDR Endpoint Logs]
LOGS4[Antivirus Scan Logs]
end
end
DAR --> REPORT[📑 Comprehensive Report Days 7-10]
DIT --> REPORT
MASK --> REPORT
LOGS --> REPORT
REPORT --> CERTIN[🏆 CERT-In Certification Day 10]
style DAR fill:#E6F3FF,stroke:#1E90FF
style DIT fill:#E6FFE6,stroke:#228B22
style MASK fill:#FFF0F5,stroke:#FF1493
style LOGS fill:#FFE6E6,stroke:#DC143C
style REPORT fill:#FFF3E6,stroke:#FF8C00
style CERTIN fill:#FFD700,stroke:#DAA520