Jay Bavisi, an information security evangelist, talks about cyber attacks and preventive measures
Jay Bavisi is an information security evangelist and serves on the board of the Global Institute of Information Security Research, a collaborative initiative of the National Security Agency, Department of Homeland Security, private industry and academia in the US.
Hyderabad: EC-Council (International Council of Electronic Commerce Consultants), which certifies ethical hacking, operates in 92 countries. The organization has trained investigators in various counter hacking measures.
Co-founder and president Jay Bavisi is an information security evangelist and serves on the board of the Global Institute of Information Security Research, a collaborative initiative of the National Security Agency, Department of Homeland Security, private industry and academia in the US.
In a recent interview during a visit to India, Bavisi pointed out that Indian firms are poorly prepared to deal with cyber attacks and that the country’s agencies are not even aware of hacking incidents within their systems. He also said it was important to write code in a secure manner right from the beginning of the software development life cycle to prevent breaches. He also spoke about the government’s Aadhaar identity programme. Edited excerpts:
Q: How is the information security landscape changing?
A: The evidence of security posture is common news you are getting around the world. The fact is over the last 20 years, IT security budgets across the world have gone up, IT security training has gone up, IT security regulations and compliance have been increased but the amount of security breaches has increased as well. That’s a very unusual correlation. So the situation is not good and it is only going to get worse in the post PC era—the movement of computing power from traditional computing to mobility is going to drive more security breaches. Businesses are going to need to take a very hard look at what they can do to protect themselves.
Q: How do Indian businesses, the software industry in particular, fare?
A: India is in an extremely vulnerable position right now. The math does not add up. India plays a leading role in terms of software development, in BPO, in terms of the engineers, in terms of technology services it provides. But India ranks fifth in the world in countries that are victims of cybercrime. So if you are leading in all technology elements and yet you are also leading in terms of being a victim, then you are not going to have confidence of foreign institutions because they cannot trust India to be a secure solution provider. This is a major risk to business because India needs to package itself as an extremely safe place to operate.
Q: How should India go about this?
A: Every major software provider follows SDLC (software development life cycle). The problem is there are select teams that actually deal with security. The engineers who code from the start, have never been taught what secure software development looks like. So now you have thousands of mechanics out there, they are all producing your car, but they have not been trained in safety standards. And then there is one team that comes and looks at the safety standard. That is not a very efficient way. A much more efficient way would be to ensure everyone who produces it, has it encoded in their DNA what security is. As they write codes, they are writing it securely. They are avoiding mistakes. It increases productivity, reduces wastages and increases security. I think that by taking a step back, we will be able to take a leap forward.
Q: Recently, hackers purportedly from China accessed security details of prominent people in the US. So there are vulnerabilities there too.
A: The difference between India and the US is every time there is a security breach, they seem to know about it and it comes out. Every time India gets breached, we don’t even know about it. As I speak to you right now, there are serious systems that have already been breached, and we don’t know about it. Seventy percent of Indian government websites have already been compromised.
Q: There have been concerns about Aadhaar project in India by privacy advocates. How would you view this?
A: From the limited knowledge I have... putting the entire country into one system would be pretty scary. If India wants to move forward and become computerized, I think it should take baby steps rather than take an entire leap by putting everything into one single database. India has not been able to protect its government websites, how is it going to protect this? I am sure they would have appointed some extremely talented consulting companies that are well versed in doing a programme like that (but) the problem is the country is not ready for a system like that. You do not have the infrastructure in terms of the people—the intellect of security behind it to be able to defend. The agency that spends the most money on cyber defence, the US Department of Defense, the Pentagon, has been hacked numerous times. The White House has been hacked. So, how dare we say we are so secure? RSA, the company that provides the algorithm, has been hacked. In security, the beauty is nobody can be arrogant enough to say we cannot be hacked. Now you have said, this is my Kohinoor and this is what you should be robbing.
Q: Is there a way this can be addressed?
A: There are definitely measures that could be put in place like isolation of data. Then what about replication? We can’t talk about security without disaster recovery. Where are you going to mirror the data? Does India want its servers to be residing in other sovereign countries? If the answer is no, then the question is will the data only reside in India? Then, in the point of an attack, it becomes your weakness. It’s a double-edged sword. There are issues of sovereignty, security, practicality... To build a penthouse without a foundation would be disastrous
