Cyber attackers are creating mayhem in the digital world, forcing a wide range of companies, young and old, to re-think their digital security best practices. Not surprisingly, the $60-billion-plus IT services industry in India, known for being a pioneer in establishing quality standards that has impressed its global clients, is not taking chances.

While most of these companies have their own security best practices, efforts are underway to standardise them, spearheaded by the Data Security Council of India (DSCI), a Nasscom organisation that looks after data protection in India. In a pioneering move, DSCI is planning to launch a certification process for the Indian IT services providers.

Cyber attacks in the recent past—whether targeting consumer electronics giant Sony, or the systems of International Monetary Fund (IMF)—are even more insidious because they don’t reveal any common pattern or motive.
The only thing that is certain is that companies that fall prey to such attacks are subject to a high degree of reputational risk, not to mention the financial losses incurred due to data leakage.

“It starts with the basic premise of making quick money to more complex things like competitive warfare and espionage. In my opinion there is no simple trend or pattern,” says Sudhir Kumar Reddy, CIO of MindTree. “The perpetrators of these attacks could be disgruntled employees on the inside to professional hackers on the outside,” he adds.

The reason why experts feel that Indian IT services industry is a ripe target for possible attackers is that they are sitting on tonnes of data generated both domestically and by their global clients. Any kind of assault to their systems could have a disastrous impact on the export-driven industry and tarnish its image considerably. This is especially so since competing emerging markets are trying to position themselves as safer and viable destinations for IT outsourcing. “Of course, it could affect the reputation of the industry. In terms of data, the attackers could pull out financial data, competition data and HR data which will have a serious impact on their business,” said Siddharth Vishwanath, associate director (consulting) PwC.

According to security experts, the risk is more in a case where the IT/BPO company is handling a client’s data. For example, the global banking clients of most of the IT/ITeS services providers in India share their corporate banking information, including the names and details of their customers, with their service providers. Take the example of a large bank which outsources its works to most Indian IT services providers. “We need to protect not only the corporate banking information of the client, but the privacy of millions of their customers as well,” said an industry source on condition of anonymity. Some Indian IT companies, however, feel that they may not be a plum target of cyber attackers. “Most Indian IT companies may not be attractive targets as they do not offer information a hacker can profit from …These are neither transactional sites nor have information of relevance to warrant such attacks,” said MindTree’s Reddy.

On their own, Indian IT companies are not leaving any stone unturned. Most of the companies have employed security tools like anti-virus, firewalls and intrusion detection system. The data leak prevention software installed at these companies ensures that nobody is able to download the confidential financial data of the clients which could contain things like account information and credit card information. “At HCL Technologies’ business services division, there is a strong emphasis on Information Security,” says Sundaresan Ramamoorthy, VP and chief risk officer, HCL Technologies.

“We have a comprehensive multi-domain, multi-layered, multi-level information security policy which is divided into 11 domains with 39 control objectives and 133 controls which are audited at regular intervals,” he adds.

At present, most of the IT companies in India follow ISO 27001, that so far is the only global standard that takes care of the security elements. However, according to DSCI, ISO 27001 may not be enough to ensure that the companies that have adopted it are not prone to cyber attacks. The security certification that DSCI is planning to offer under the DSCI Security Frameworks (DSF), will rate Indian IT companies based on 16 areas.

This includes the security policies, processes, people induction, people maturity, buying of the equipment, third-part software testing and application security. The certification will also cover threat and vulnerability management, network access and data layer, among others, according to DSCI. “Some of these elements are not part of the ISO 27001. We believe that DSF has a better approach to security than the ISO standard,” says DSCI CEO Kamlesh Bajaj.

DSCI is already doing a pilot with about 15-20 IT/ITeS companies of various sizes on its own and with the help of consulting firms like KPMG, Deloitte, PwC and E&Y. The rating process is expected to start in the next 6-8 months.

Why online attacks can be a piece of cake?
According to industry experts, most of the applications in the Internet world are developed in a hurry and deployed immediately without testing for potential security problems. This happens because of the go-to-market pressure, as companies always want to be the first mover.

“Before you deploy any application, it must be developed very securely and tested thoroughly. So if this one precaution is taken, I think large number of attacks can be averted,” said Kamalesh Bajaj, CEO of DSCI. For example if someone is developing an internet payment gateway, the developer need to ensure that every part of that data is sent in an encrypted format.

Source:http://www.business-standard.com/taketwo/news/it-firms-resolve-to-thwart-cyber-attacks-/441720/

Internet is increasingly seen as the Wild Wild West (www) and a virtual world of lawlessness in the US. Under Obama’s new Cyber Security policy, India will be an active partner in combating cyber terrorism, says cyber security expert Clifford Gregory, also senior VP (security solutions), IonIdea, an Indian outsourcing firm. He spent over quarter century in the US Military developing cyber security programmes for the Senate and White House, apart from working for the FBI, Metropolitan Police, US Secret Service, and other Federal and security agencies.

Could you give us a figure of what each malware attack costs a company?
Each malware attack costs a company $70K, while lost or stolen hardware costs amounts to $300K. Spear Phishing (specific target) costs $500K, damage by disgruntled employees cost a neat one million each, resulting in a $5 million tag when you destroy a brand. These cost figures are averages. If your company is dependent on data regarding customers, the loss could be multiplied.

What are the gaps that you notice in your assessment of Indian companies?
In my earlier stint with a major bank, we had done an assessment of the global operations of 1,600 large Indian companies including BPOs. We noticed three major weaknesses. One is access control specifically knowing the person logged onto the system with access to customer data was the person who was authorised to do so and we felt that companies should adopt either multi-factor authentication or direct observation via CCTV to provide this level of assurance. Two, was in the area of information transit. Some vendors made great efforts to protect data within their networks, but simply did not consider what might happen while the information was in transit. The third gap was in data leakage private or non-public personal information that is sent via email or other means, especially as part of a call center process or part of the software development testing process.

In terms of Obama’s focus on cyber security, do you see an increased number of opportunities for Indian companies which provide security solutions?

India is one of US’s greatest allies, in combating cyber terrorism, and the opportunity could only get bigger. President Obama sees the threat and I am certain he understands that while an attack may be directed against Wall Street, the effect would be felt in every major financial markets in the world.

I read a report that China has a single point of entry to the internet from outside their country as a defensive measure against cyberwar and this might be true one day for other nations too.

Source:http://timesofindia.indiatimes.com/biz/india-business/Any-cyber-attack-will-affect-major-fin-mkts/articleshow/6088117.cms