Information Security (IS)-Part-I
Sudhir Kumar
![Sudhir Kumar]()
Sudhir Kumar
IoD Certified Corporate Director, ESG& DEI Expert #1bestselling author, Risk Analysis, Nuclear Tech &SMRs, Leadership, OD & Team Building, AI,Quantumn & Cyber Secu
- The governments and organizations world over are spending a lot on Information Security(IS), still the serious breaches have taken place and I am sure that future cyber attacks, hacking incidents & incursions are going to increase multifold. There will be more planned, organized and technologically innovative & sophisticated intrusions in networks to gain either competitive advantage through data / information theft or simply putting some one out of business reasons best known to them. If I put some statistics it could easily be concluded. The Global Digital Traffic shall be about 02 Zettabytes annually and 14.6 GB for an average internet user by 1919. The device population shall be about 25 billion by the same time. This kind of digital expansion will certainly attract more cyber attacks, hacking attempts and intrusions.
- The Information is most sought after commodity in this Digital World (DW) and Information Security (IS) hence would be susceptible in the same proportion to the Intended Attempts (IAs) as information is Life Line (LL) or Backbone of DW. To protect data theft or safe guard information is an important issue today & in days ahead and IS should be accorded among top priorities now by the organizations. Let me put a definition of IS to put it in right perspective which was given by the US National Centre for Systems Security and that defines, “Information Security(IS) as the protection of information & information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity and availability(CIA Triad).
- These days Cryptography & Encryption techniques are used to ensure confidentiality. The Integrity could be compromised by midway Intended Attempts (IAs). The Availability to the end user could also be restricted by “Denial of Service (DoS)” and “Distributed Denial of Service (DDoS” attacks. Today, the exchange of information is taking place across vide distances in virtual world remotely. The information technology is the main enabler and computers, internet, software’s and hardware are key to the success of most of the businesses. Hence, IS is a prime concern to all as it provides the necessary trust to the operations in any business The IS not only protects the stored data but also keeps protecting the life span of the flowing data(information). IS has become significantly important as it protects data stored within at Data Centers and outside at Cloud. To take care of IS, the organizations are evolving and adopting an ongoing pursuit towards risk management policy and Information Assurance Security (IAS) extending it to the CIA Triad by adding the five important elements in IS Design such as privacy, authenticity, trustworthiness, non-repudiation, accountability and audit ability.
- Recently, the Information Security Monitoring Station (ISMS) of one organization in one of the South Asian country detected some suspicious activity (a breach) at company’s networked laptops connected to the network remotely were unsuccessfully attempting to communicate with an external server known for being used for virus intrusions. It took the company about 20 days of investigations mobilizing internal IS department resources and hiring cyber forensics experts from outside to detect the source of intrusion and the cost of entire effort was about $ 80,000. The IS experts finally nailed down the problem back to the 03 laptops of the employees used in three different locations. One laptop in one of the South Asian country was infected with script containing elements of the Backdoor-H worms. Another more dangerous version of the virus was detecting in another laptops used in one of the EU location. The third laptop was found in North African location which was down loading stuff from the internet without following safe guards prescribed by the company. The lessons learnt were an effort of 20 days & loss of $80,000 and restriction on the free flow of internal communication on some routes during this fault finding mission. At least 470 man-hours of Internal IS resources with huge cost was wasted.
- It is a fact and lately the Cyber attacks have become very sophisticated in nature and targeted for potential financial gains. It is also a fact that we can have all the security features / systems and fireballs in place, the intentional malware actors can find way through to nail you down to gain competitive differentials in that time span which you spend on solving the problem caused to you intentionally and bringing back your system in to action. The phishing attacks have become a big business and hackers are on demand with heavy pay outs. By impersonating legitimate mails from reliable company or professionals, they deceive people in to opening attachments or down loading updates that give the attacker access to the sensitive information and networks. Hence, it is essential that the group companies, or business unit or units / regional heads have to adopt the standard “Company IS Code of Conduct” to keep Cyber attacks away from its territory of operations.
- The organizations have to adopt to the 05 essential steps in their IS Design i.e. Identify, Protect, Detect, Respond and Recover .There were about 01 Mn malware attempts every day in 2014 and malware thrives to grow in quality as well as quantity finding innovative ways to attack soft targets and avoid incorporated detection & encryption. During a study conducted among 0.5 million people in different geographies that about 29% people as recipients of such targeted mails opened phishing messages and about 18% even than opened attachments. This percentage may go higher on a bigger scale of sample and especially in Asian & African Countries.
- Finally it is concluded that:
- Cyber attacks could easily get in to confidential data & information, hence, affect the business competitive advantage or innovation.
- The intrusions or incursions can play with the integrity of data and provide a confidence that all the transactions are correct though it is not.
- Malware intrusions can disrupt the availability of data and bring entire systems down by corrupting its data base.
- The vulnerable organizations may go out of business with serious targeted / intended cyber attacks.
- The Cyber frauds in “Attackers to Consumer Mode (A to C Mode)” are not only fetal but creating confusion among masses about authenticity & effectiveness of IS measures in use for Social Media.
- Cyber attacks against some defence installations and National Critical Infrastructure could be catastrophic to such a scale to the society where economies may pay a very heavy price.
- Any way technology always has advantages versus disadvantages to its credit but we move ahead collectively addressing challenges and Digital Innovations also has the same to its disposal. We can find solutions accordingly in days ahead with the increased use of Digital Technology and make stride for the unprecedented benefits to be accrued by it.
- The stand alone mechanism and connectivity there only where unavoidable is a Mantra I subscribe and endorse that physical security has to be the best comprised of SOPs as part of Integrated Security Design in an organization to counter cyber attacks.
- The data breach in the case of J P Morgan and Home Depot in-respect of 100 Mn individuals in USA was one of the eye openers to fathom what kind of penetration, damage and magnitude such attacks can have. The intrusion in Sony lab was a different issue but it has an angle one has to look at & could it be concluded with this incident that USA lost the first Cyber War (CW) but against whom not clear, hence, it is a different proposition in a dangerous domain. So, the best managed organizations those have money & adequate resources to their disposal for putting the best security designs for IS in place could be intruded and put to huge disadvantages.
- So, it is necessary that the organizations adopt to IS measures at the design / planning stage itself and have a ISMS in place with ISO 27001 standards. The penetration testing as part of risk audit in periodic business continuity plan drill be executed. The fast Response & Recovery Practices be demonstrated as part of DRP drills against Cyber Attacks among employees on a regular basis. An awareness programme for the employees is to be conducted on a regular basis to keep them align to adhere to the best practices as IS Code of Conduct.-an essential feature of ongoing operations. Incident reporting must be swift without losing advantage. A Defence in Depth (DiD) needs to be practiced to have Information Assurance Situational Awareness for IS Design. The IA (Information Assurance) should be selected to take care of internal as well as external threats and it should be comprised of Risk Assessment for vulnerability & threat, Risk Analysis to ascertain probability & impact, Risk Management for best practices in place such as Risk IT, PCJ DSS, ISO 17799 and ISO / IEC 27002, CobiT and Periodic Conduct of Risk Audits to remain align to the IS Risk Profile.
IoD Certified Corporate Director, ESG& DEI Expert #1bestselling author, Risk Analysis, Nuclear Tech &SMRs, Leadership, OD & Team Building, AI,Quantumn & Cyber Secu
9yMy Friends -Please offer your comments on this portal as they are so essential for me to improve upon. Thanks!