Rishipal Yadav on Rishipal Yadav · not your CISO

The Audit Room Has Two Stories And Neither Is the Full Truth

Thu, 24 Apr 2025 00:00:00 +0000

Every audit room has two stories playing simultaneously. The auditor walks in with a checklist, a mandate, and the quiet authority of an independent assessor. The auditee walks in with months of prep, a defensive posture, and the knowledge that something will be found — the only question is what.

The problem is neither side is telling their story particularly well. And that communication gap is where audits go from being useful to being theatre.

Cyber Risk to US Pipeline Critical Infrastructure — A Strategic Disruption Analysis

Wed, 01 May 2024 00:00:00 +0000

Course: ENPM808 — Independent Study, University of Maryland
Advisor: Prof Charles Harry →, School of Public Policy, UMD College Park
Period: 2024
Focus: Geopolitics, critical infrastructure, computational risk modelling

Summary
#

This independent study explored the cybersecurity ecosystem around US critical infrastructure — specifically pipeline networks — through a computational and policy lens. The research examined the intersection of cybersecurity frameworks and geopolitical risk, focusing on how nation-state actors could target energy infrastructure and how that risk can be quantified.

Security Awareness Training: A Design Thinking Project

Sat, 27 Apr 2024 00:00:00 +0000

During the last semester (Spring 2024) of my Master of Engineering in Cybersecurity at the University of Maryland, College Park, I joined the Innovation Fellowship cohort at the Academy for Innovation and Entrepreneurship. The project: apply design thinking to security awareness training.

Security awareness training has a reputation problem. Compliance teams love it. Employees hate it. And the data on whether it actually changes behaviour is, at best, mixed. The question I started with was: what would security awareness training look like if you designed it the way a product designer would — starting with the user, not the policy?

About

Mon, 01 Jan 2024 00:00:00 +0000

Who I am
#

I’m Rishipal Yadav — a CISSP-certified cybersecurity professional based in Gurugram, India. I hold an M.Eng in Cybersecurity from the University of Maryland, College Park (where I was selected as an RSA Conference Security Scholar ‘24), and a B.Tech in Computer Engineering from SVNIT, Surat.

My career has taken me from building production security infrastructure at HSBC, to running an end-to-end ISO 27001 program at Cyble, to advising Fortune-scale clients on data governance and GenAI risk at PwC, to leading enterprise GRC audits at Uniqus Consultech. Across all of it, the thread has been the same: making security rigorous, practical, and human.

Academic Contributions

Mon, 01 Jan 2024 00:00:00 +0000

Beyond writing and research, I contribute to the academic security community as a peer reviewer and invited speaker. I believe practitioners who engage with academic work make both worlds better — research gets grounded in operational reality, and practice gets informed by rigorous inquiry.

Technical Program Committees
#

ICISPD — International Conference on Information Security, Privacy and Digital Forensics
#

NIT Goa

Experience

Mon, 01 Jan 2024 00:00:00 +0000

Download resume (PDF) →
#

Current role
#

Assistant Manager — Cybersecurity · Uniqus Consultech
#

Gurugram, India · August 2025 – Present

Leading enterprise-scale GRC engagements across financial services and regulated industries.

Measuring the Integrated Cyber Attack Surface Across US County Government Networks

Mon, 01 May 2023 00:00:00 +0000

Institution: University of Maryland — School of Public Policy
Advisor: Prof Charles Harry →, School of Public Policy, UMD College Park
Period: Fall 2022 – Spring 2023
Full paper: Read on OSF →

Summary
#

This research developed a methodology to measure and compare the integrated cyber attack surface of US county government networks — a sector that is often overlooked in cybersecurity policy discussions despite being responsible for critical local services.

LinkedIn OSINT for a Quick Background Check: A Guide for HR

Thu, 27 Apr 2023 00:00:00 +0000

Most organisations run background checks before someone joins. But the standard checks - employment verification, criminal records — often miss what’s hiding in plain sight on LinkedIn. Open source intelligence (OSINT) techniques, applied to a public professional profile, can surface inconsistencies, red flags, and gaps that formal checks don’t catch.

This guide is for HR professionals and hiring managers who want to use LinkedIn more systematically as part of due diligence — without crossing into surveillance.

ChatGPT Policy for Your Organisation: The CISO's Concern

Sun, 09 Apr 2023 00:00:00 +0000

ChatGPT has been a buzzword for some time now. Be it a new product built on top of it or another capability announcement, just when you think the hype has peaked, something new drops. And through all of it, security teams have been quietly scrambling to figure out what their policy actually is.

This is not a technical breakdown of how large language models work. This is a practitioner’s take on the questions a CISO — or anyone responsible for security — needs to answer before their organisation gets too comfortable with ChatGPT in the workflow.

You Must Remove Text Message Two-Factor Authentication

Sat, 18 Feb 2023 00:00:00 +0000

Last night, just before I went to sleep, I decided to check Twitter. The first thing I saw was the announcement that Twitter was removing SMS-based two-factor authentication for non-Twitter Blue users. The reaction was predictably split — some celebrated, some panicked.

Both reactions missed the point.

SMS-based 2FA is not secure. It is better than a password alone, but SIM-swapping attacks have made it a weak link that sophisticated attackers exploit routinely. The Twitter decision — however poorly communicated — is directionally correct. The question for security teams and individuals alike is: what replaces it?

Bridging the Skill Gap in Cybersecurity — Hire Generalists, Create Specialists!

Fri, 20 Jan 2023 00:00:00 +0000

I have seen a lot of posts about the skill gap, unrealistic hiring expectations, and the number of open security roles. Most of them circle the same frustration: organisations want five years of experience in a technology that has existed for two, and then complain they can’t hire.

But I think the framing is wrong. The skill gap isn’t primarily a supply problem — it’s a hiring and development problem. Organisations have been optimising for the role they need filled today, not the practitioner they need in three years.

Cybersecurity Roadmap 2023: How Do I Start in Cybersecurity?

Fri, 13 Jan 2023 00:00:00 +0000

How do I start in cybersecurity? What basic skills do I need to get into cybersecurity?

These are the questions I get most often — from students, from software engineers eyeing a pivot, from IT professionals who want to move into security. There is no single right answer, but there are a lot of wrong approaches, and this guide is my attempt to cut through the noise.

Operational Security 101

Wed, 04 Jan 2023 00:00:00 +0000

Last week, Andrew Tate got into a Twitter fight with Greta Thunberg, both taking jibes at each other. It got ugly — and the next day, Romanian authorities used a pizza box visible in his response video to confirm his location and arrest him.

You genuinely could not write a better operational security case study.

Operational security, or OPSEC, started as a military concept — protecting information about your own operations from an adversary who might use it against you. In the digital age, it applies to everyone: activists, executives, journalists, and apparently influencers who pick fights on Twitter.

So You Do Not Want to Become a CISO Anymore?

Sun, 09 Oct 2022 00:00:00 +0000

There has been quite a chatter in the security community for the last couple of weeks. It is always some discussion — be it a new breach, a new framework, or a regulatory shift — but this one felt different.

The conversation: is the CISO role broken? Between the SolarWinds aftermath, the SEC charging CISOs personally, the expectation of omniscience with the authority of a middle manager, and the burnout rates — a lot of security professionals who once had the CISO job as their north star are quietly reconsidering.

Educate Your Team — Do Not Chase When It Comes to Security

Mon, 05 Sep 2022 00:00:00 +0000

“Hey, could you please complete the security training, it was due two days ago?”

If that message sounds familiar — either as the person sending it or the one ignoring it — your security awareness program has a problem. And the problem isn’t that people are lazy or don’t care about security. The problem is that you’ve built a compliance exercise and called it a culture.

Back to Office: But What About Security?

Thu, 28 Jul 2022 00:00:00 +0000

Things are back to normal, and everyone is returning to their offices. Some are ecstatic about free food, coffee, and office gossip. Others are dragging their feet. And most security teams are somewhere in between — quietly aware that two years of remote-first work has created some habits that don’t translate well to shared physical spaces.

My Cybersecurity Journey

Wed, 25 May 2022 00:00:00 +0000

I found my first position at a college placement fair. I began working as a software engineer building a digital security platform at HSBC — designing the backend for secure authentication and authorisation for mobile banking apps. It was more of a software development job, but I had to learn a lot about security concepts to actually do it well.

Preserving Location Privacy

Wed, 01 Jan 2020 00:00:00 +0000

Institution: Sardar Vallabhbhai National Institute of Technology (SVNIT), Surat
Published: Springer, 2020
Full paper: Read on Springer →

Summary
#

This senior year project investigated techniques for preserving the location privacy of mobile users — a problem that has grown significantly with the proliferation of location-aware applications and services.

The research reviewed and evaluated existing privacy-preserving mechanisms including k-anonymity, differential privacy approaches applied to location data, and obfuscation strategies, with a focus on their practical trade-offs between privacy guarantees and service utility.

Rishipal Yadav on Rishipal Yadav · not your CISO

The Audit Room Has Two Stories And Neither Is the Full Truth

Cyber Risk to US Pipeline Critical Infrastructure — A Strategic Disruption Analysis

Summary #

Security Awareness Training: A Design Thinking Project

About

Who I am #

Academic Contributions

Technical Program Committees #

ICISPD — International Conference on Information Security, Privacy and Digital Forensics #

Experience

Download resume (PDF) → #

Current role #

Assistant Manager — Cybersecurity · Uniqus Consultech #

Measuring the Integrated Cyber Attack Surface Across US County Government Networks

Summary #

LinkedIn OSINT for a Quick Background Check: A Guide for HR

ChatGPT Policy for Your Organisation: The CISO's Concern

You Must Remove Text Message Two-Factor Authentication

Bridging the Skill Gap in Cybersecurity — Hire Generalists, Create Specialists!

Cybersecurity Roadmap 2023: How Do I Start in Cybersecurity?

Operational Security 101

So You Do Not Want to Become a CISO Anymore?

Educate Your Team — Do Not Chase When It Comes to Security

Back to Office: But What About Security?

My Cybersecurity Journey

Preserving Location Privacy

Summary #

Summary
#

Who I am
#

Technical Program Committees
#

ICISPD — International Conference on Information Security, Privacy and Digital Forensics
#

Download resume (PDF) →
#

Current role
#

Assistant Manager — Cybersecurity · Uniqus Consultech
#

Summary
#

Summary
#