Cyber Security | NASSCOM shows the way

Cyber Security | NASSCOM shows the way

A ‘secure and reliable’ environment— defined by strong copyright, IT and cyber laws—is an imperative for the growth and future success of the ITeS BPO industries

R Jai Krishna

Tuesday, December 11, 2007

Email This

Print This

Comments

RSS

NASSCOM has been proactive in pushing this cause and ensuring that the Indian Information Security environment benchmarks with the best across the globe. Indian ITeS-BPO companies today adhere to international best practices – they are regularly audited by independent certified auditors, comply with international standards at the highest levels, update procedures and practices regularly and meet, if not exceed the worldwide information security standards to ensure that data and personal information of international customers is adequately protected.

Security environment in India

Indian companies are known for their quality deliverables. International certifications like ISO 9000 went a long way in establishing this reputation. Likewise following international standards in information security is also helping Indian companies build credibility among customers. While most Indian BPO firms are recognized for high quality processes and services, information security practices need to be constantly reviewed and updated according to the rapidly changing environment. Customer data demands special focus.

Currently, the information security environment in India is:

Indian companies have robust security practices comparable to those followed by western companies. Indian companies primarily comply with BS 7799 – a global standard that covers all domains of security

Companies sign Service Level Agreements (SLA), which have very strict confidentiality and security clauses built into them at the network and data level. Such SLAs also cover all relevant laws that the companies want its offshore providers to comply with and actions that can be taken in case of breaches

Laws such as the IT Act 2000, Indian Copyright Act, Indian Penal Code Act and the Indian Contract Act, 1972 provide adequate safeguards to companies offshoring work to US and UK

Most of the BPO companies providing services to UK clients ensure compliance with UK Data Protection Act 1998 (DPA) through contractual agreements

Companies dealing with US clients require compliance depending upon the industry served. E.g. Healthcare requires compliance with HIPAA, Financial services require compliance with GLBA. To ensure compliance with such laws, Indian vendors follow security practices as specified by clients such as security awareness, protection of information, non-disclosure agreements, screening of employees, etc.

Further, clients conduct periodic audits to ensure compliance. Many companies in India are undergoing or have undergone SAS 70 Audit. SAS-70 assignments helps service companies operating from India to implement and improve internal controls, ensure minimal disruptions to business from clients' auditors, and is potent marketing tool in the face of increasing competition.

NASSCOM's security initiatives

NASSCOM has taken a holistic view of Information Security through its 'Trusted Sourcing' Initiative to strengthen the regulatory framework and further improve India's attractiveness as an outsourcing destination. This multi-pronged initiative is targeted at employees, organizations, enforcement agencies and policy amendment, through a '4E Framework' - Engagement, Education, Enactment and Enforcement.

NASSCOM has been working closely with the ITeS - BPO industry in India, to create a robust and secure Information Security culture, and in association with other stakeholders like the Indian Government on the issue of creating a relevant regulatory environment. All these initiatives aim to further strengthen information security environment, together with initiatives being rolled out by NASSCOM and the ITeS - BPO industry.

NASSCOM, with the Indian government has also laid the foundation for the required legal framework through the proposed Amendments to the Indian IT Act of 2000 which includes laws and policies concerning data security and cyber crimes and the Indian Copyright Act of 1972 which deals with copyright issues in computer programs.

Trusted Sourcing initiative

This initiative seeks to reinforce India as a secure and reliable technology partner. NASSCOM has also instituted the 4E framework to establish India as a trusted sourcing destination. This framework ensures highest standard of information security in the outsourcing industry in India.

As part of the Trusted Sourcing initiative, the following activities have been undertaken until now:

NASSCOM'S flagship initiatives

Proposed Self-Regulatory Organization (SRO): The Self-Regulatory Organization has been conceptualized following an in-depth gap analysis of the Indian law and various international standards (like US and EU laws), identifying the loopholes and then attempting to amend the Indian law to make it equivalent to the global standards that exist. SRO is an independent, self-regulatory body that proposes a basic set of security and privacy standards, to which companies can choose to adhere. This SRO would establish, monitor, and enforce privacy and data protection standards for India's ITES-BPO Industry. The SRO is now taken the shape of the Data Security Council of India, and will be functional beginning next year.

National Skills Registry (NSR): This is a centralized database of all employees of the IT services and BPO companies in India. This database contains third party verified personal, qualification and career information of IT professionals. The objective of NSR is to improve recruitment practices in IT and BPO industry, which will in turn help in maintaining India's global competitive advantage. It is an employee-friendly measure to minimize any misuse of employee identity, where employers will be able to view the verified resume of the IT professional, if authorized by the professional.

Amendments to the Indian IT ACT

The union cabinet (on October 16 2006) has approved the amendment to the IT Act 2000. NASSCOM worked with the government to evolve recommendations for amendments to further strengthen the Indian IT Act 2000. The recommendations are focused around protecting overseas customer data and tightening the punishment for defaulters. The amendments have incorporated most of the recommendations, and are hopeful that this will lead to better handling of cyber crime by enforcement authorities. NASSCOM expects that this would be discussed in the winter session of the parliament.

Additionally, most Indian IT BPO companies conform to global standards such as BS 7799 and also specific standards depending on the country/sector they cater to. For example in the US, Healthcare requires compliance with HIPAA; financial services require compliance with GLBA.

(Compiled from NASSCOM Analysis on Information Security in India)
©CyberMedia News

Email This

Print This

Comments

RSS

Toon porn star 'Savita bhabhi' under fire

Nokia Eseries unveils E71 and E66

ViewSonic No. 1 in 22-inch LCD monitors

Firefox 3.0 sets new Guinness world record

Reshape disk for free without destroying data

BT to go beyond India IT, telecom sectors

Flavour of the Month: Gates' exit not a big deal for Microsoft

Global server revenue up 2.5pc in Q1-08

Advanced sputtering tool to fabricate hybrid solar cells

Economics of 450mm wafer transition

	Get the bigger IT Picture here
	How resilient is your organization?

	IBM: Internet Security Systems
	HP : Blade Server
	Trend Micro: Stay Ahead of Web Threats

	Open converged networking
	Solving the "lost data" problem
	24x7 availability of IT services globally at Porsche

	HP Business Availability Center
	Transforming Business
	Aligning IT and Business