when you outsource to india, where does your data go?: not where you think…
Post on 19-Sep-2016
215 views
TRANSCRIPT
Analysis
When you outsource to to India where does yourdata go? 1
Pentagon panel checks privacy on waron terrorism 1
Cyber attacks on banks double for2003 2
News In Brief 2,3
Corporate governance
Crime and punishment:corporate governance 4
Log correlation
The “Art” of log correlation:part 1 7
Video encryption
The epic movie battle 12
Forensic policy
The question of organizational forensic policy 13
Getting the Whole Picture
A FARES baseline analysis casestudy 15
Events 20
C o n t e n t s
Many outsourced IT servicesare being subcontracted fromIndian providers to countriessuch as Sudan, Iran andBulgaria, which increases thesecurity risk.
Risk management profes-sionals are warning companiesto stop and check that theirservice provider in India isactually performing contractedoffshore services itself and notoutsourcing further to othercountries.
Some companies in India arefaced with a labour shortageand lack of proper infrastruc-ture to cope with the burst ofbusiness from the west. “Theycan’t deliver what they’vesigned up to deliver, said SamirKapuria, director of strategicsolutions at security consultan-cy, @stake, “so they outsourceto other countries where thecost is lower.”
Colin Dixon, project manag-er at the Information SecurityForum (ISF), said many ISFmembers have reported thisproblem during an ongoing investigation by the elite secu-rity club into outsourcingrisks.
“Contracts should contain aclause banning offshoringcompanies from further out-sourcing without the client’sknowledge,” said Dixon.
Companies are being put inthe awkward position of “rely-ing on the Indian provider to
perform due diligence on theirsubcontractors and you don’tknow if they are able to dothat,” he said.
The elongated outsourcingchain multiplies the risk. It“leads to a high degree of sepa-ration in the development ofapplications for example,” saidKapuria.
Compliance with corporategovernance also gets morecomplicated as the responsibil-ity lies with the company andnot the provider. And adher-ence to regulations gets evenharder to control if services arebeing outsourced twice.
Most ISF members haveidentified the issue andstopped it before signing acontract, said Dixon.
But Kapuria said that someof @stake’s clients didn’t findout about the double outsourc-ing until after the contract wassigned.
Intrusion detection trafficcoming from outside Indiaalerted some banks that subcontracting was takingplace, said Kapuria.
70% of blue-chip companiesin the ISF are currently out-sourcing.
When you outsource to India, wheredoes your data go?
Not where you think…
Editor: Sarah Hilley
Editorial Advisors: Peter Stephenson,US; Silvano Ongetta, Italy; PaulSanderson, UK; Chris Amery, UK; JanEloff, South Africa; Hans Gliss, Germany;David Herson, UK; P.Kraaibeek, Germany;Wayne Madsen, Virginia, USA; BeldenMenkus, Tennessee, USA; Bill Murray,Connecticut, USA; Donn B. Parker, California,USA; Peter Sommer, UK; Mark Tantam,UK; Peter Thingsted, Denmark; HankWolfe, New Zealand; Charles CressonWood. Bill J. Caelli
Editorial Office:Elsevier Advanced Technology, PO Box 150Kidlington, Oxford OX5 1AS, UKTel: +44-(0)1865-843645Fax: +44-(0)1865-843971Email: [email protected]
Subscription Price for one year:(12 issues) US$833/¥102,240/�769.00including first class airmail delivery subject toour prevailing exchange rate
Price valid to end of 2004
Subscription Enquiries:Orders and Payments:
For customers residing in the Americas(North, South and Central America):Elsevier Journals Customer Service6277 Sea Harbor DriveOrlando, FL 32887-4800, USANorth American customers:Tel: +1 (877) 839-7126Fax: +1 (407) 363-1354Customers outside US:Tel: +1 (407) 345-4020Fax: +1 (407) 363-1354Email: [email protected]
For customers in the rest of the World:Elsevier Science Customer Support DepartmentPO Box 211, 1000 AE Amsterdam, TheNetherlandsTel: (+31) 20-3853757 Fax: (+31) 20-4853432Email: [email protected]
To order from our website:www.compseconline.com
Corporategovernance — 4
Log correlation — 7
Publishers of Network Security
Computers & Security Computer Fraud & Security
Computer Law & Security Report
Information Security Technical Report
June 2004
ISSN 1361-3723
“They can’t deliver what they’ve signed
up to deliver”