The Hindu Business Line : A slip of the lip...

Security isn't just guarding your computer networks. Casual speech can give away sensitive information too. Hence, companies first need to widen their view of information security.

PICTURE this scene: A team from an overseas client was in India recently, going around the facility of a prospective outsourcer before signing the deal. Along with the overseas team was a group of Indian consultants.

As the team went around inspecting the facility, its members spoke to the employees of the BPO outsourcing company about the facility, the kind of processes it owned, etc. A team leader at the facility was curious to know when the deal would be signed and in the process casually mentioned that if the proposed deal didn't come through, the BPO firm would have to face problems and start laying off people after a few weeks.

The consultant, taking a clue from what the team leader said, asked his client to negotiate for a better price. In the end, the BPO firm had to accept the deal at a nearly15 per cent discount. This is one among real instances wherein what was casual talk for a team leader turned out to be "sensitive information" for the client's representative, who, in turn, leveraged it to the benefit of his client.

Instances of this kind may be a regular feature as most Indian companies are yet to take an all-round view of their security framework, says Capt. Raghu Raman, Global head of Mahindra Consulting's Special Services Group (MCSSG).

When it comes to security, Indian companies just focus on having firewalls, implementing IDS and making their networks secure. However, they fail to look at the entire security framework, which, apart from IT security, includes the vital component of information security, he says. Moreover, Indian companies are increasingly exposed to the risks of confidentiality, integrity and availability of information even as they try to leverage the power of information and information systems for competitive edge and strategic advantage. Information security provides protection of people, processes and the technology assets of the company to help it in achieving its business goals, he says. Information technology is just one of the constituents of the information flow within the enterprise. Securing that one constituent alone is meaningless if the other process gaps are not plugged, says Capt Raghu Raman, a former Army officer, who has served with United Nations, where he was responsible for securing information flow between the UN HQ and Mission Control HQ in Africa.

The concept of information security is yet to catch on in India and there is a need to create awareness about it, he says. Indian firms have been addressing issues relating to IT security, including Internet security, to some extent. However, process and people security should be addressed in sync as they are important in the age of information warfare, he stresses.

The MCSSG has created a security framework model which divides information security into three constituents — process gaps, technological vulnerabilities and threat perception — as each of these constituents contributes directly to the security threshold of the enterprise. "We go beyond the purview of IT to enable a company secure its information. Our core team of security experts define the processes and strategies to secure a client's information from the attacks that are beyond the realm of IT," he says. When it comes to spending on security, most Indian firms allocate a percentage of their IT budget to security and the focus of the spending would be on firewalls and encryption systems. The focus of IT security management is myopic as the companies have the mindset of a defender, he says. Instead, he advocates an attacker's approach for the Indian companies.

MCSSG sees great business potential in the BPO sector where security could be the killer application. As overseas companies outsource their intensive data to offshore destinations like India, vendors here could use security as a key differentiator, he says.

vishwa@thehindu.co.in

Article E-Mail :: Comment :: Syndication

Stories in this Section
The guy who counts

No junking this threat

Making the twain meet

Score a hit

Quiz

Security - nothing absolute about it

Cartoon