The importance of security in e-Governance

Technology has proliferated in all spheres of life. Accompanied by the rapid growth of the Internet there has been a concomitant rise in online transactions. The government sector has been no exception to these facts and it has wholeheartedly embraced IT in general and Internet-based technologies in particular, of late, in order to extend the benefits of governance to all citizens—urban and rural—through a slew of e-Governance projects.

At the Sabha, Anil Sagar, Additional Director, Indian Computer Emergency Response Team (CERT-In) said, “As computer systems have become more user friendly and easy to access, their adoption has grown phenomenally. As a result, we have a scenario wherein multiple operating systems and infrastructure components co-exist. This has increased the potential for security threats.”

Too often, security is described as something necessary to keep you out of trouble. It is more than that. When your information is secure, you can use it to accelerate your business. Amuleek Bijral, country manager, RSA Securities commented, “Despite massive investments in security technologies and services, few companies can claim that all their data is adequately protected.”
Like any other IT-enabled project, an e-Governance project also runs on a network. A government department deals with a considerable amount of information that may be critical to several other government departments concerned as well as external parties and citizens.

Security without borders

In the past, guarding the perimeter against external threats was sufficient, but today’s organizations are virtual, global, and dynamic. Simply deploying perimeter-based security is no longer enough to protect data, as information does not reside within static boundaries. On the contrary, a perimeter-centric security model hinders the frictionless movement of information between users spread across the globe what with users accessing data from a variety of devices such as PCs, PDAs, mobile phones, laptops, etc. Anil Sagar emphasized, “Attackers and users, both, are not confined to a particular geographical location so it becomes difficult to trace back the attacker. Also users are not always aware of and do not give sufficient importance to security measures.” The weakest link in the system is the human one.

As Bijral put it, “Data cannot be confined to one place; the importance of data lies in sharing it. When you share your data, it is spread across several devices including PCs, laptops, data centre servers, mobile phones etc. You need to secure the end-point. Rather than securing the environment, greater emphasis should be given to secure the information that is flowing across several networks.” Information-centric security binds security directly to information and to the people who need it.

The aim of attacks is changing from ‘preserving oneself and wiping out the enemy’ to ‘preserving oneself and controlling the opponent.’ Cyber attacks involve collecting the tactical information and using the same to overpower enemy systems, which brings down servers and thereby, business activities to a standstill. Hemal Patel, MD & CEO Elitecore Technologies, predicted the possibility of cyber warfare, which he defined as ‘an attack on information in the information age’.

A full-fledged Cyber attack involves gaining control over networks and there are four steps in it. They are:

1 Gain control over Network of Government and Defense Establishments.
2 Bring down the Financial Systems: The Stock Markets and Banks.
3 Take Control of a Nations’ Utilities (Power, Telecom etc).
4 Take control over personal identities (Passport data / Driving License / PAN No. / Ration Cards etc).

Today there are numerous threats—malware, bots, key-loggers, phishing and spoofing to name a few common ones. Lack of security awareness was cited as the biggest cause for attacks.

Control strategy

CERT-In (computer emergency research team-India) along with NIC and other IT vendors has been working towards improving the security levels of IT systems. CERT-In had recently tied up with Quick Heal to deploy the company’s anti-virus solution on government PCs. Bijral said, “If we can identify the data that we care about and where that data resides, then we need a model to discuss risks and threats.”

Draft amendments to the IT Act 2000 lack strong protection against cyber terrorism or cyber war. Patel said, “There should be a combined effort from intelligence agencies, NIC, CERT and the industry to collectively fight a Cyber War.” A central nodal agency is required, one that can frame a national strategy for countering insurgency in cyberspace. The creation of national nodal agency for IP Security deployments is vital.

There is a need for security solutions that not only cover security threats from end-to-end but also result in low CAPEX and OPEX. Another important aspect of adopting a security solution is to comply with regulations. Regulations, however, are dynamic and keep on changing. It is to handle this eventuality that the ISO 27001 and ISO 27002 standards had been developed. These adopt a framework approach combining the solutions that are required to cover end-to-end system security. ISO 27001 and ISO 27002 deliver a common language communicating security on a global basis to protect customers, outsourcers, business partners, regulators, auditors and non-security staff.

In a framework-based approach, the key areas of risk are identified to begin with, after which the solutions to counter those risks are taken into consideration, and in the next step technology controls are applied, as are policies and procedures. A review of the implementation of controls ensures that they align with an organization’s security policy and that there is consistency across data classification categories.

Furthermore, there is also the need to inculcate security awareness amongst users about recent threats/attacks as well as the dos and don’ts of using Internet. Security has become a key issue that needs to be addressed. Since government deals with sensitive information of national interest, securing data is of utmost importance. The key to securing information, however, does not lie in infrastructure security but the data and information security that are shared over various systems. That is why the need for securing such information has become a priority.

ISO 27001 certification helps deliver measurable difference for BT

An international security standard is giving BT’s customers peace of mind - and helping the company secure major deals.

ISO27001 - an international standard designed around 133 security controls - provides a model for setting up and running an effective information security management system.
The company now has 26 certificates covering more than 60 key sites and services - and 20 new sites have been earmarked for certification.

According to global head of IT governance for bid security and certifications Lou Garcia, this demonstrates that BT meets security control requirements - and shows a high level of security governance, especially in the area of risk management. Lou said: “Many of BT’s most significant customers demand this certification for the services BT provides - and, as demand from our customers increases, so does our programme of certification.”

Source: http://businessassurance.com/iso-27001-certification-helps-deliver-measurable-difference-for-bt/

The key to data wiping

You've just spent the last of the financial year's budget on new computers. Fantastic. And you might even donate your old computers to charity, or sell them on eBay. But what about the data stored on them? You may need to get rid of it before you get rid of the computers.

Adrian Briscoe, General Manager Asia Pacific, Kroll Ontrack, a data recovery company, advises businesses and individuals to be cautious when discarding old hardware with proprietary information.

A test of three PC workstations and two servers purchased by Kroll Ontrack on eBay found that, while all the hardware had been subjected to some type of data erasing, three units had a combined total of approximately 70GB of data ranging from Excel, Lotus 1-2-3, image files and back-up archives. "Take care to delete data properly," says Mr Briscoe, "and not just by using the format command on your computer. You need to erase the hard drive to a certain standard."Bill Taylor-Mountford, general manager of Acronis, a company that provides storage management and disaster recovery software, agrees."Deleting data leaves a fingerprint, or a ghosted image. With the right tools, specialists can recover the data after it has been deleted.

That's why some software-wiping algorithms use 35 passes to destroy data."Mr Briscoe says any device that has information presents some risk to organisations, and needs to be wiped permanently. "The erasing process will take anywhere from half an hour to half a day. Nobody considers buying a PC without having antivirus software. Why not run erasing software as part of the process at the end of the computer's life cycle?"But is just deleting your data every time you get rid of computers the smartest thing to do? What if you have 1000 computers to get rid of?

Wiping everything may take up more time, energy and money than it's worth, says Milton Baar, director of IT Security consultants The Swoose Partnership, and committee member of Standards Australia IT 12/4, which represents Australia for ISO27001, the international standard for information security management."Organisations should start a thousand miles earlier than end of financial year," says MrBaar. "They need corporate governance practices, which cover information security issues.

Organisations should understand what information they have on their computers and have control of it, rather than just wiping everything when they get rid of the equipment."

ISO 27005 will assist organizations in their information security risk management

The FINANCIAL -- Organizations of all types are very concerned by threats that could compromise their information security and managing this aspect has become a primary concern for their information technology (IT) departments.

The new International Standard ISO/IEC 27005:2008, which describes the information security risk management process and associated actions, will help them to manage risks.

Threats may be deliberate or accidental, and may relate to either the use and application of IT systems or to IT's physical and environmental aspects. These threats may take any form from identity theft, risks of doing business on-line, denial of service attacks, remote spying, theft of equipment or documents through to a seismic or climatic phenomenon, fire, floods or pandemic problems. These threats may result in various business impacts, for example, financial loss or damage, loss of essential network services, loss of customer confidence through to loss power supply or failure of telecommunication equipment.

"A risk is a combination of the consequences that would follow from the occurrence of an unwanted event and the likelihood of the occurrence of the event. Risk assessment quantifies or qualitatively describes the risk and enables managers to prioritize risks according to their perceived seriousness or other established criteria." ISO reports.

ISO/IEC 27005:2008, Information technology – Security techniques – Information security risk management, provides guidelines for information security risk management and supports the general concepts specified in ISO/IEC 27001:2005, Information technology – Security techniques – Information security management systems – Requirements.

The new standard is designed to assist the implementation of ISO/IEC 27001, the information security management system standard, which is based on a risk management approach. Knowledge of the concepts, models, processes and terminologies described in ISO/IEC 27001 and ISO/IEC 27002: 2005, Information technology – Security techniques – Code of practice for information security management, is important for a complete understanding of this International Standard.

The information security risk management process consists of:

• context establishment
• risk assessment
• risk treatment
• risk acceptance
• risk communication,
• risk monitoring and
• review.
  

However, ISO/IEC 27005:2008 does not provide any specific methodology for information security risk management. It is up to the organization to define its approach to risk management, depending, for example, on the scope of the information security management system, based on the context of risk management, or the industry sector.

Edward Humphreys, convener of the ISO/IEC working group that developed the standard comments: “Today, most organizations recognize the critical role that information technology plays in supporting their business objectives and with the advent of the Internet and the prospect of performing business online, IT security has been in the forefront. ISO/IEC 27005:2008 is relevant to managers and staff concerned with information security risk management within an organization and, where appropriate, external parties supporting such activities.”

Source: http://finchannel.com

DoF participates in ISO meeting in Japan

DoF's participation - the first-ever by a governmental organisation from the GCC region - reflects its commitment to adopting the latest total quality standards at all levels of Governmental practice, especially in the information security. 

This is in line with DoF's preparations to acquire the ISO 27001 Certificate by the end of this year. 

The participants in the Kyoto meeting discussed several topics related to information security systems, including applied standards and universal measurements set by ISO in this sector. 

The participants brought up issues pertaining to information security management for critical infrastructure and information security governance. 

'Our participation comes in line with the directives of DoF's top management represented by H.H. Sheikh Mohammed Bin Khalifa Al Nahyan, Chairman; H.E. Hamad Al Hurr Al Suwaidi and H.E. Mohammed Sultan Al Hameli, Executive Director, to enhance the level of IT performance and security. DoF has achieved several milestones in implementing its IT infrastructure and now works to add more value and to enhance overall quality standards,' said Salem Al Rumaithi, Head of the IT Directorate at DoF. 

The discussions at Kyoto focused on a series of standards that will help in establishing and maintaining an efficient information management system, using a constant improvement approach. Putting these standards into practice will help attain the security control objectives through a recommended range of specific security controls. 

Butti Al Rumaithi, Head of Information Security Office, said: 'We are committed to improving the performance of IT systems and information security procedures by adopting International best practices in this field. During the meeting, we exchanged ideas about ways of managing information systems and enhancing their security. We also shared views concerning the implementation of international standards related to data protection and risk management. We look forward to leveraging the department's participation in specialised International meetings, as we consider that developing the overall performance and enhancing security of our IT systems is one of our top priorities.' 

DoF recently launched its Strategic Plan for 2008-2012 which included priorities that call to develop state-of-the-art IT technologies to support the future role and activities of the Department.

Source: http://www.ameinfo.com/160017.html

The Bare Minimum

We have all heard about ISO 17799 and ISO 27001; ISO 17799 is being renamed to ISO 27002 and ISO 27001 was formally known as BS7799-2. If you haven’t and your reading this, stop now and go look them up. Here is a good place for an general overview.

These standards are the basis of least requirement for doing business, when security is concern. Instead what you see are most companies, those that care and especially here in the US, are still in a phase of “working towards” meeting these standards. Very few western organizations have implemented or even looked at these standards. In Japan over 2000 companies have been certified meaning that Japan dwarfs any country by at least 300% more compliance than the UK and the US put together.

Something needs to be done to bring the compliance level up. Especially when it comes to the base foundation for security controls and ISMS.

So what can you do? Here is a 10 step guide to becoming certified.

1. Prepare the ground: obtain copies of the ISO 17799 and BS7799-2 standards, research the background, set the objectives, understand the costs and benefits, and liaise with senior management to gain their support.
2. Define the scope: what’s in, what’s out, including issues like location, assets and so on. Prepare a Statement of Applicability.
3. Define a formal ISMS (Information Security Management System) policy.
4. Analyze the information security risks to identify the corresponding security control objectives.
5. Prepare a security implementation plan describing the implementation of specific information security controls to satisfy the objectives identified in step 4. Gain management approval and secure the budget.
6. Implement the plan. Prepare, review, approve and publish information security policies, procedures, standards and so forth. Bring controls protecting the IT infrastructure and facilities up to scratch. Review and where necessary improve application security controls. Prepare and exercise contingency plans.
7. Operate and maintain the information security management system. Keep records to document proper use of your system (e.g. information arising from the review of system security logs).
8. Perform an information security audit and management review to check that everything is in order (this typically involves an informal pre-certification assessment by the certification body).
9. Make any last-minute adjustments to the information security management system to address issues identified in the pre-certification assessment.
10. Undergo the formal certification assessment by an accredited certification body.

Source: http://securitymusings.com/article/307/the-bare-minimum

Axur ISMS is now approved by European Union

Axur ISMS is the only full ISO 27001 oriented management system recommended by ENISA - European Network and Information Security Agency. It´s a great honor for us!

You can check more about ENISA at: http://www.enisa.europa.eu

And you can read more about Axur ISMS & ENISA at: http://www.enisa.europa.eu/rmra/methods_tools/t_axur.html