Globally, government agencies and authorities have gradually understood the significance of IT and its role in reaching out to people in implementing various beneficial schemes and policies today. However, with complex security threats emerging in the cyberworld, the wave of e-governance will not have a smooth sailing ahead in time
Thursday, August 26, 2010
Thursday, August 26, 2010
Ilias Chantzos, Symantec Software India's director Symantec Government Relations for EMEA and APJ talks to Pankaj Maru of CyberMedia News about IT security challenges faced by governments globally, measures to enhance IT security and protecting information, India's ambitious UID project and effectiveness of Indian cyber laws. Excerpts:
In your opinion what are the challenges that governments across the world are facing today in terms of IT security?
Governments across the world hold terabytes of information – personal and country-specific confidential information. This information in digital format today is more vulnerable to threats than ever before. With informationization, the extent by which an economy becomes information-based, any loss of sensitive information could cause serious and even irrevocable damage to countries. An act including cyber attacks can destabilize, interfere with or disable online national security assets or entities of a state or government.
Protection against these types of threats must go beyond the usual countermeasures of firewalls, antivirus and intrusion detection or prevention and must include programs that can instantly relay information that an attack is happening, where it is happening, and how it is happening.
In addition, true resiliency against such an attack can only be attained by having backed up and stored information in advance, with an information management program in place that has catalogued, organized, and prioritized it to quickly recover any information that has been lost or exposed. The proper combination of people, processes and technology can ensure that a critical infrastructure provider is protected and can withstand an attack, recover, and continue to operate.
It has been observed that problems faced by governments across the world vary very little across geographies. With the laws governing right to privacy of information becoming more complex, data protection and the prevention of data loss is rapidly gaining significance. These scenarios warrant not just more efficient technology, but also fool proof data protection and privacy laws.
What are the measures that central and state government department in India can take to secure privacy and protection of confidential data?
According to the DSCI-KPMG Data Security Survey 2009, 43 per cent of Indian organizations are concerned about data security risks due to mobile, remote and “always-on” access. Data privacy also emerges as a steadily growing trend – 99 per cent participants from telecom and 96 per cent from financial services attributed it to be ‘Critical’ or ‘Top.' One of the reasons for the growing focus on data privacy could be the increased inflow of critical data and processes to outsourcing service providers.
Legal, contractual and compliance requirements are resulting in clients from various geographies demanding greater assurance on data privacy by the outsourcing service providers. An attempt was made, through a survey, to identify significant threats to data privacy, as perceived by the respondents. The results revealed that scenarios such as emails without encryption (63%) printing of information (60%), use of CDs and USBs (57%), employees retaining critical information (51%) are being given serious thought.
In India, information-led change has affected a great variety of sectors and processes. Information invasions from the outside as well as planned information policies have virtually changed the landscape of the sectors. It is now important to put into place more robust data security and privacy laws and legislations that are uniformly applicable to relevant industries and individuals/groups etc.
Particularly, these laws and regulations need to make sure that they themselves are compliant with other international and country-specific laws and regulations. We strongly believe that there is a need for a unified data protection legislation covering both government and private sector and the government should take into account best practices in recognized frameworks like the OECD Privacy Principles and the APEC Privacy Framework.
The government should also focus on introducing comprehensive protection covering all relevant aspects like notification, collection, use, consent, access, integrity and data security. There is a need to consider socio-technology developments in crafting these laws, for example tracking cookies, rise of social networks, use of mobility devices to store information (photos, videos, personal data), etc.
Besides, the Government should focus on the protection aspect and on the remedy aspect, i.e. what happens after a data breach occurs as it is bound to occur. Overall need for automation and strong governance practices to address data leakage have to be reinforced.
Does the UID project, which is a major project in e-governance domain, excite you?
Increasingly, governments and other public as well as private organizations collect vast amounts of personal information about individuals for a variety of purposes. The law of privacy should regulate the type of information which may be collected and how this information may be used and stored.
In the recent Union budget, the government allotted an expenditure of Rs.19 billion (US$409 million) for the UID project. The centralized nature of data collection inherent in the UID proposal, they fear, heightens the risk of misuse of personal information and therefore potentially violates privacy rights.
Identities are very valuable and the potential to misuse them is very high. It is therefore very important that they are protected and made accessible only to authorized persons. Already with the anonymity of the Internet and the evolving threat landscape, people and organizations are struggling to maintain confidence in the security of their interactions, information and identities online.
At the same time, people’s personal and professional lives have converged and they want to use their various digital devices to access information wherever they are without jeopardizing their privacy. The challenge is giving users appropriate access, while ensuring that confidential data is not at risk.
Do you think the current cyber security law in India is effective for addressing all the issues related to it?
The Symantec Internet Security Threat 2009 report has ranked India 5th in malicious activity, i.e. a climb of six places. India is the highest spam originating country in the world, contributing 4 per cent to the worldwide spam volumes, while the country ranks first in the APJ region. On the basis of web-based attacks, India has gone up from 13th rank in 2008 to 3rd rank in 2009, next to the US and Brazil.
It is evident that cyber attacks are fast becoming the next generation of threats and no single service could work in isolation.
Leaders in the country have expressed the need to make India’s cyber systems as secure and as non-porous as possible. Overall there is a need for a sound cyber law and effective ICT and cyber security policies.
Cybersecurity is larger than putting in place an antivirus solution, encrypting laptops or deploying data loss prevention technology at network gateways. Cybersecurity is now everything. We live in a digital world, and so we need to have comprehensive digital security. More importantly, a sound e-governance policy requires a sound and secure e-governance base as well.
The security and safety of various ICT platforms and projects in India must be considered on a priority basis. This presupposes the adoption and use of security measures more particularly empowering judiciary and law enforcement manpower with the knowledge and use of cyber forensics and digital evidencing.
©CyberMedia News
