Need to Security Private Information - Requirement in India

Unique Identification Authority of India (UIDAI) data center in Bangalore is reported to have got a cover of 65 star guards from multi-skilled security agency, the Central Industrial Security Force (CISF) - Your identity is guarded by 65 armed men (article on times of India).

It indeed is a commendable step by the authorities, but my question here is - Is this measure enough to secure the Identity and avert the threat from identity theft? Actually Speaking NO and the reasons that attribute to the answer NO are -

1. The personal information of an average Indian is scattered across the Government Offices, Public and Private Banks and other Financial Institutions to a large extent.  More scary portion is the availability of this information on papers across the offices
2. There is no defined mechanism to destroy the paper work by the various organizations and agencies.  Many a times some or other people from various organizations sell of these as waste papers to the scrap dealers.  There have been various incidents in past where papers with critical and sensitive information have been located with the road side vendors (bhel puri and other chat senders)
3. There is no defined guideline by the Government of India on how to use / dispose / destroy the information whether in paper or on computers
4. There are no set standards in India with respect to destruction or recycling of magnetic / optical media that may contain sensitive / private / identity information.  Such media may be Hard-Drives, Pen-Drives, Backup Tapes, CDs, DVDs, SD Cards etc among others
5. Nasscom has also not worked to this effect to advice with any standard guidelines to be utilized to this effect

Saying all this, we should not actually be cheering the news as published as it is the least of the measures that is required at deployment.  Another aspect to look at is - Has Government also provisioned a DR site for the UIDAI Data Center? Is that location also guarded with similar set of Security Personnel?  Unless we get that information, I guess this news is just a hogwash,

If you feel I am trying to belittle Government's efforts, then well I am not.  But my effort is to sensitize that there are additional steps required by the Government to ensure that the information related to the Identity of Indians as well as tourists / visitors to India is treated as sensitive and private.  Adequate measures as detailed below need to be put in place to ensure that such information is treated in fair and just manner - 

1. Enact a Data Privacy Law - Government needs to take immediate measures to ensure that the Data Privacy Law is enacted and enforced to set the expectations on dealing with Private and Sensitive Data.  The Information that needs to be treated as private and sensitive should include - Aadhar Number (as part of the UIDAI effort), PAN Card numbers (from Income Tax Authorities), Voter ID (from election commission), Ration Card, Passports and any other similar set of documents and information that can help establish the identity of any individual
2. Define Data Handling Guidelines - As part of the Data Privacy Law, Government must define the treatment of information classified as Private and Personal in a manner cognizant to safeguard the Identity of person holding it
3. Define Data Destruction Guidelines - As part of the Data Privacy Law, Government must also define how the data no more needed is to be destroyed.  For the data on paper and optical media for that matter must be destroyed by using shredders. The data on magnetic media for that matter must be destroyed by using programs that would over-write the data multiple times using different algorithms and thus rendering data as unreadable
4. Define Consent Requirement - Often this is one of the most overlooked case where the private and personal information of any individual is circulated / shared for commercial benefits.  There are cases where the Customer Relationship Officers or the Marketing Staff carries over the contact and similar other information to the next organization without consent of the Data Owners.  It needs to be noted that the receiving Organizations / Agencies are Data Custodians and not Data Owners, meaning they can use data for their internal processing purpose only.  For sharing or using data for any other reason than intended reason should not be permitted without consent from the Data Owners (Data Owner is the person about whom the information is)
5. Define Agreement Forms - Government must ensure that the Agreement forms used for the purpose of providing services are defined only for those services for which the Information is obtained.  Such Agreements must not any Clause or Fine Prints like "Organization / Agency may use this information for any of the required processing as may be deemed required by the organization / agency.

These are the basic steps to be taken to ensure Data Privacy & Protection.  These needs to be enforced along with the Indian IT Security Act 2008 Amendment Act to ensure that adequate Information Security Risks are addressed including the identity theft and information compromise.....

BYOD Program & Controls Requirement - II

As I wrote the previous Post - BYOD Program & Controls Requirement I received the comment on WFH, but I am certainly not covering that in this article, as that is a separate topic of discussion. What is more interesting that broke out as a discussion point with a colleague over a cup of coffee.  The discussion actually presented a counter argument to the Jump Server configuration.  

While in the discussion, I was very much inclined to and well still am that an organization as the first step to BYOD program should define the set of machines that they would allow.  It is pretty much important for the organization to define whether they are going to allow.  The Deep Dive on the topic reveals that the selection of devices would prompt additional thought process or should I say depending on the Support Strategy for the BYOD program the organization needs to define what devices would be allowed.

The various strategies would revolve around user experience v/s technological deployments. If an organization would like to restrict user experience and go with technological deployments that would ensure Data Security and related controls, the organization would then need to restrict the BYOD to Laptops and Desktops (may be or when its WFH). In this case the controls would be around the set of controls that have already been discussed in the previous post as mentioned above.

In case the organization would select User Experience then the organization would need to ensure that they provide support to any device and enhance the Mobility aspect of the user.  This decision however needs to be based on the following decisions - 

1. What applications would be supported for BYOD and what level of modifications / application changes would need to be carried out?
2. What level of Security would be needed to extend the support to the devices?
3. What would be the application support, would it be Browser based only or Client based with a part of the program sits on the client side
4. Would VPN security be extended to these Devices that would be supported?

There are many more questions that need to be answered for a Successful BYOD program. The Organization would additionally need to check if One Device One Number sort of Program be adopted or not. If the organization would decide to implement this program for increased mobility they need to ensure the Soft Phone Support. 

The BYOD Program as it seems is not actually an easy decision to take as the organization would require to answer many other questions and Specifically that would help them ensure mitigating Risks and meeting Compliance Requirements in Operationally Effective and Efficient Manner

BYOD Program & Controls Requirement

BYOD or Bring Your Own Device is the way organizations are planning to take.  The talk is going abuzz in the corporate world as it would help organizations reduce their IT budget and increase operational efficiency.  In my view it is not that bad an idea, but would require looking a bit deeper at the Compliance perspective and the risks that would emanate when an organization would run BYOD.  The Organizations would require investing and managing various technological solutions to ensure that the Data Privacy and Protection Laws of the world are addresses and that the common framework of controls is enforced across all the devices that come in being due to BYOD. 

The BYOD program from the aspect of controlling data access and ensuring data protection would need to evaluate and consider deploying following technologies:

•   Jump Server – to log in to the organizations corporate network and provide viral desktop environment to the users.  The virtual desktop would have all the desired user settings including file & print configuration, Proxy settings, mailbox configuration and the application shortcuts for the desired applications for the user concerned
• Network Admission Control – to control the risks emanating from the unpatched and unprotected personal devices that can introduce Trojans, viruses, worms, BOTS etc in the corporate network.  The Organizations would need to critically look at investing on a strict Anti-Virus & Patch Management Regime Supported by the Network Admission Control devices.
• Two Factor Authentications – to ensure that the password compromises do not impact / provide access to the corporate network. Additionally this would also help organizations to be able to support the Work from Home (WFH) program thus further reducing their operational cost associated with Facility Management for the ever growing number of seats with workforce increase.

These are just the indicative controls that should be considered or rather implemented by the organizations seriously going the BYOD path.  Certainly the CXOs of the world would be better placed to take the final decision on the set of controls from the likes of IDM, DLP, SSO to add to.  This would certainly require an indepth assessment on the requirements and the risks emanating to an organization.

Driving Factors for Information Security

Information Security has become the need for survival of the Business today. Irrespective of the Geographic Location or Industry sector, following could be identified as the common Driving factors for the Information Security -

Information Security Threats and Risks

Any information system usage or implementation may be a target for range of serious threats, including computer based fraud, espionage, sabotage, vandalism and other forms of systems failure or disaster. This may result in risk of data loss from accidental/malafide unauthorized access, use, misappropriation, modification or destruction of information and information systems.

Moreover, sharing of information for business reasons using new applications and inter-connected resources increases the threat of information pilferage. Ensuring security of business critical information is important for Organization maintain competitive advantage in the marketplace. In the course of conducting business, any such information must be shared hundreds, even thousands of times each day. Designing, building, marketing and selling products requires discussing, faxing, e-mailing or otherwise sharing sensitive, proprietary information. Each time such information is shared, it is further exposed to the risk of being lost or compromised. Each conduit for information sharing presents opportunities to unauthorized persons to attempt to acquire such information.

Inconsistent policies for assigning system usage may also result in access rights to information and information systems exceeding the needs of employees’ job responsibility. While the number of users accessing information systems are increasing, the control exercised by the system owners or provider is being dissipated.

While technological advancement has provided significant benefits, it has also equipped malicious users with more advanced means and tools to obtain unauthorized access to data/information. With the availability of Internet, there is an increasing risk that these tools are freely available.

Legal and Statutory Requirements

Security requirements also arise from and are subject to the statutory and contractual requirements of Organization, its service providers and third parties. Information Security Department will also ensure that the security policies factor account these requirements as well.

(The U.S. government has created new laws that specifically address Information Age misconduct; Sarbanes Oxley Act, GLBA and HIPAA are the mentionable names in this aspect. In India too initiatives have been taken in this regard and “Indian Information Technology Act 2000” has been rolled out. More is expected to fall in place as the Government and Industry consortium is working in Unison to create much awaited infrastructure for secure organizational practices.)

Apart from the laws, there are the internationally acclaimed best practices and the standards that have evolved. 27001, ISO/IEC 17799; 21827; 15408 etc from ISO, CoBit, COSO, SAS 70 etc are few of such standards where the organizations are seeking compliance for the Security Practices and Operations.

But beyond these laws, best practices and standards, organizations need to know how to create a system and a culture that will not be susceptible to this type of illegal behavior. It’s a good practice to put some basic policies and guidelines in place and share it with the associates, consultants, customers & vendors.

Gaining User Support

It is also necessary to ensure adequate IT control environment to minimize the risk of any negative incidents involving computers. This assumes significance in view of the rapid strides that Organization has achieved in adopting newer technologies. The end-user confidence and support is one of the fundamental building block for deriving full benefits of IT resources.

Building Customer Confidence

Customers must have confidence that information systems will operate as intended without unanticipated failures or problems. Otherwise, the systems and its underlying technologies may not be utilized to its optimum level and further growth and innovation may be inhibited.

Any views?