Indian Thoughts in Information Security
•
3 gostaram•1,468 visualizações
A brief perspective on Information security from the India point of view.
Recomendados
Recomendados
Mais conteúdo relacionado
Destaque
Destaque (8)
Semelhante a Indian Thoughts in Information Security
Semelhante a Indian Thoughts in Information Security (20)
Mais de Dinesh O Bareja
Mais de Dinesh O Bareja (9)
Último
Último (20)
Indian Thoughts in Information Security
- 1. © www.IndiaIndian Thoughts in I N F I N I T E C H A N N E L S T O W A T C H A N D S E C U R E It is critical and can be destructive... Yet few seem to be serious about it... Some things that you wanted to know but did not know whom to ask.. , or, things you knew but did not have in place to provide the desired, or required, level of safeguards June 20, 2013
- 2. © www.IndiaIndian Thoughts in Life‟s Dimensions • Earth – we live on • Water – is the elixir of life • Air – we breathe to live
- 3. © www.IndiaIndian Thoughts in Internet: The Fourth Dimension Normal doesn‟t apply anymore!
- 4. © www.IndiaIndian Thoughts in Awareness and Training • Is your IS team “aware” ---- about security • Is your IS team “trained” --- to respond, audit, controls testing • Awareness is clubbed with Training and handled by the Training or HR team and gets a backseat Training and Awareness have different objectives and MUST BE TREATED DIFERENTLY
- 5. © www.IndiaIndian Thoughts in Awareness is the most abused term in the Information Security lexicon. Every ‘expert’ swears this as the best and most effective antidote for InfoSec ills, but a few have walked the talk or done something constructive. Awareness
- 6. © www.IndiaIndian Thoughts in Living in Denial COMMON REFRAINS • It cannot happen to me • I am too small a business with no data of value why will anyone be interested in me • I cannot afford Information Security COMMON CLAIMS • We are fully prepared and have EVERYTHING in place • I am big and strong and we have the best systems and devices in place we are hack- proof • We have a million dollar budget and have hired the best
- 7. © www.IndiaIndian Thoughts in Inadequate Response • Messed up between being aware and trained • Living in Denial end up being over-protected or under-protected • In event of an Incident – the response is • Chaotic • Too many cooks and a doomed broth in the making • Respond and go back to „normal‟ life • Knee-jerk budget bonanza • Costs ~ zero learning …
- 8. © www.IndiaIndian Thoughts in Indian Thoughts… • Create a practical and user-friendly IS environment so you are not on everyone‟s “$hi** list” • Don‟t forget to plan and then follow it • Do not cross the Lakshman Rekha … Polices and rules are for compliance by all • Skillset and knowledge must be complete when responding to an incident – do not follow Abhimanyu‟s example • Senior management is your Achilles heel • Being certified does not give you divine protection there are more devils than gods in today‟s age!
- 9. © www.IndiaIndian Thoughts in I N F I N I T E C H A N N E L S T O W A T C H A N D S E C U R E www.indiawatch.in INFO@INDIAWATCH.IN +91.9769890505
- 10. © www.IndiaIndian Thoughts in Dinesh O Bareja CISA, CISM, ITIL, ERM, Cert IPR, BS7799 (LA) • Information Security enthusiast, observer, analyst, learner, practitioner and evangelist. Wannabe photographer and published author. Opinionated blogger and writer on Information Security. • Cyber Surveillance Advisor – CYBER DEFENCE RESEARCH CENTRE, JHARKHAND POLICE • Analyst - INDIAWATCH • Principal Advisor, PYRAMID CYBER SECURITY & FORENSICS PVT LTD • BOMBAY STOCK EXCHANGE • OPEN SECURITY ALLIANCE • Co-Founder, INDIAN HONEYNET PROJECT
- 11. © www.IndiaIndian Thoughts in India centric research firm that endeavours to be ahead in knowledge, intelligence and thought Specialize in Management & Security of Information and Data as related to People, Processes and Technologies Provides strategic and tactical thought leadership to government, public and private institutions Welcomes opportunities to contribute in the interest of national security, public safety and resilience About
Notas do Editor
- We will take a look at Infosec from our local point of view. Some practices and some concerns that raise perpetual red flags that may be visible or not !
- The baby boomers and earlier generations grew up aware of three dimensions in life –Gen X, Y and those yet to come live in the fourth dimension 1. The rules of one dimension do not apply to the other two. Example – the rules of breathing in water are different from that in air or for creatures that live inside the earth…
- While the Gen X’s and Y’s walk into this new dimension from birth, their learning and education is still old-world. That is three dimensional This is the paradox of today’s world. It’s like when Ford came up with Model T and everyone wondered why have a carriage that you have to drive to a gas-station to refuel when you have a horse carriage which is oh-so-convenient. The horse is in the stable, attached to your home, eats hay all day long and all you need to do is hitch it to the carriage and flick a whip or shout something unintelligible.
- [opening line] HOWEVER MUCH ONE MAY TALK ABOUT AWARENESS AND TRAINING, IT WILL ALWAYS BE LESS THAN THAT REQUIRED[takeaway]Education and learning. You can be educated but you have to be on a different plane to be considered learned by your peers. In the same manner – you may be trained but not aware and you may be aware but not trained !So you are aware that when you machine slows down for no reason it may be infected but you may not have the training to investigate and clean, which is when you call the office Systems Engineer. He / she will be aware of the sensitive work you perform for your employer but is not trained for that work !
- This is a quote, as the earlier one, from our report on Information Security Concerns for India – Top 3 Report for 2013. It is a compilation of concerns in the IS domain for 2013 as submitted by respondents to a survey we had put up.
- One primary observation, through interactions with numerous clients – CxO’s and their IS managers has that many of them are living in denial. Maybe it is a manifestation of our culture that gives us strength from our immense faith in divine intervention.But then again even among those living in denial – there are the Naysayers and the Yaysayers - (I think this depends on the divinity that has intervened !)
- Living in denial, in the real world, has real consequences. The fallout is dangerous and is inevitable. The actual effect of this risky behaviour results in inadequate response to threat / risk events. And the results are .
- Our first report was on Top5 Information Security Concerns for India for 2013 We believe if one manages Information and Technology well, Security will be in place. One pursues Security as the be all and end all but this is really incorrect strategy – you are chasing a goal without having studied the how – when – where – why Working with government in India and overseas for