Ehsaas to invite hackers to identify digital security vulnerabilities; Dr Nishtar

ISLAMABAD: Special Assistant to the Prime Minister on Social Protection and Poverty Alleviation, Dr. Sania Nishtar Wednesday said ethical hackers would be invited to identify the digital security vulnerabilities in the programs.

“We will be organizing a hackers competition inviting ethical hackers to outline our vulnerabilities”, she said while chairing the joint meeting of Risk Assurance and Management, and Audit Committees of Benazir Income Support Program (BISP) board.

Ehsaas will be the first public sector entity to implement a Vulnerability Disclosure Policy (VDP) that is intended to give ethical hackers clear guidelines for submitting potentially unknown and harmful security vulnerabilities.

Since Ehsaas’ operations are largely digital, it is critical to ensure that IT safety measures are in place; more than 100 steps have been taken to secure the IT system in that regard over the last 2 years, since she took over, Dr. Sania informed the committee members.

The discussion of the Risk Committee mainly centered on internal and external audits, Ehsaas Risk Registry, Error Fraud and Corruption Framework, implementation of security safeguards within the organization and setting up of the Cyber Control Wing.

Also, under observation were Ehsaas Governance and Integrity Policy and Observatory and how the organization was faring against 23 indicators of the policy and observatory to gauge the performance of BISP.

Dr. Sania gave directions to internal audit division to present quarterly reports to board meetings and instructed the finance division to submit quarterly reports on accrual accounting to the board meetings as well.

She also instructed the management to complete the departmental audit committees’ process in time.

She also advised to make changes to the risk register and map the key actions emanating from the risk register into departmental work plans and to use the parameters for performance assessment.

The Director General IT gave presentation on the progress underway to set up Cyber Control Wing.

He explained that extensive consultations had happened which led to the definition of the scope of work of the cyber control wing and terms of reference of individuals who are to be hired.

An expression of interest in this regard has already been floated to solicit applications.

The next meeting of the Risk Committee will be held in the fourth week of January 2021.