Month: February 2019

Everything You Need To Know About Data Protection

Posted on by admin

India took a massive step with its own data protection act last year when the Srikrishna Committee shared its assessment and suggestions on data privacy and management. It is a great sign for the country as it solidifies the support that is envisioned for customers – especially keeping India’s digital economy in mind. This act will keep a set of privacy laws, policies and procedures in place to ensure that there is minimum encroachment in to any person’s privacy. This will include the storage, extraction or breakdown of data.

The first question that pops here is the line that is drawn on personal data – it is classified as any data that can be used to related or identify the person either from the government or from a private entity. Many people do raise questions on our fundamental rights to privacy – but take a check, that is not patently granted by the Constitution of India.

Looking at Section 43A of the Indian information technology act 2000, an organization that is in possession, dealing or handling sensitive information or personal data and is negligent in the implementation or maintenance with the pre-required security will be liable to pay for damages. Do note that there is no upper limit to the to the compensation that can be claimed in such an event – the damages can be put out to any extent.

What qualifies as personal information?

It is important to note that passwords, financial information that may contain the bank or credit card account details, health conditions, sexual orientation, history of medical records and biometric information all fall under personal information or sensitive data. If there is a breach of this data, action can be taken against the firm and they would be liable to pay damages to the person affected.

It is also vital to note that according to section 72A of the Indian information technology act, 2000, disclosure of this kind of sensitive information without consent or if is against a contractual agreement can lead to imprisonment of upto 3 years or a fine of 5 lakhs or both.

Of course, there are conditions at which these rules are relaxed. As per section 69 of the act, there is a general rule of maintenance of privacy and secrecy of the information and an exception on release of the data is necessary. These are,

  • The Sovereignty or Integrity of India,
  • The Defence of the country.
  • Security of a state.
  • Request from a foreign state
  • Public order or
  • Preventing incitement to the commission of any offence that may relate to the above or as an investigation.

In such an event, the government can deem to access or monitor the data or have it decrypted or stored in a computer resource. This data has to be divulged in interest of security and the government may require disclosure of such information. This can include national security, breach of law or fraud.

Can the Government interfere with data?

Now, under section 69 of the IT act, an authorized Government officer can be specially authorized by the Government – to intercept, monitor, decrypt, or cause to be intercepted or monitored, information that is transmitted or received or stored. The scope of section 69 of the IT act allows this for the purpose of investigation of cyber-crimes too. This allows the Government to block access to sites that it may deem dangerous too.

What is the penalty for damage to computer or computer systems under the IT Act?

As per IT Act Section 43, there would be a penalty without an upper limit for

  • Accessing or securing access to a computer or computer network.
  • Downloading or accessing data that may include information or data that is held in a removable storage medium.
  • Damage or cause of damage to a computer or a network.
  • Introduction of contaminant or virus into a computer or a network.
  • Causing disruption to a computer or network.
  • Denies or causes of denial to a person who is authorized access to a computer or a network.
  • Tampering or manipulating a computer or system would mean liability to pay damages by compensation to the affected.
  • Destroying or deleting information in a computer resource.
  • Concealing or altering data or source code used for a computer resource with the intention of causing damage.

As per section 65 of the IT act, the above actions shall be punishable with imprisonment of up to 3 years or with fine of up to Rs 2 Lakh or both.

Also, section 66 of the IT act states that if a person by any means of fraud referred to in section 43, can be punishable with imprisonment for a term of up to 3 years or a fine of Rs 5 Lakh or both.

The data protection act is without doubt one of the most required points in our digitally enabled country today. With more access to computers and networks, it is a must to be implemented today.

Why Invest In Vulnerability Assessment Penetration

Posted on by admin

When we make a checklist of all the risks that may cause turbulence to our business, we often forget the damage that can be caused by a cyber-attack! Not just that, most companies even ignore the fact that it is a constant investment too – leading to them not improving their security processes each year. The common problem that most companies have is to understand the risks that may be present. How do you do that? With a  vulnerability assessment  of your business!

A test of this kind would show the kind of weaknesses that exist in your company and how they can be exploited. These weaknesses could be because of ignorance, mistakes or just plain lack of attention.

To understand if the internet security is acceptable or stable for usage, a malicious attack is usually self generated or simulated. This is called penetration testing. Either of these methods can be used on a wired or wireless network which the program to penetrate could even be a mobile application. Of course both these testing processes would require a meaningful investment and here is why –

  • Understanding the errors in programming that maybe a possible risk towards cyber attacks.
  • Implementing these standards would secure your IT networks from attacks both internally and externally.
  • Create and implement a methodical approach towards risk management in the company.
  • Keep your entire business logic away from IT networks
  • Indentifying opportunities for ROI on IT security investments
  • Keep your business away from financial or reputational downfalls.

Why would your business be vulnerable?

Wrong programming practices would the first and sole reason and the second reason would be configurations errors of these programming practices. If you have your routers, switches or servers that are not configured right or have gaps in security – it would be extremely for a break into your internal system.

How can a vulnerability assessment help?

With a vulnerability assessment, you would be using a technical approach to find the gaps that lie in your network or software security system. This is completely a process of repeated searches for errors. Upon a single process, you would be able to see the vulnerabilities and the severity level for each of the problems. How would you explore and exploit a vulnerability in your system though?

Penetration testing to assess the damage

Penetration testing  would help you go deeper into the vulnerabilities that were highlighted. You would be sure of the vulnerability and know what damage can be caused to your application or network. Do keep in mind though that this process is very intrusive and can cause a lot of damage to your systems – hence you need to be very cautious and plan it out perfectly.

How do you choose between both?

The answer to this question is quite simple – you need both. You need to analyse the risks that are present first and then figure out the level of damage that can be done with keep such risks at hand. They both go hand in hand towards a more secure system and as per ISO 27001 you need to prevent the exploitations of any technical vulnerabilities that may lie on your system. Simply put, the need of the hour is to have both techniques on your system to ensure there are no gaps.