Viral Raval VP, IT, Kale Consultants

Information security can be achieved by hard controls and soft controls. Hard controls are the system tools like IDS, firewall and AV. Soft controls are the policies. A security policy would define the scope and extent to which a company’s IT assets are being safeguarded. It covers general policy, e-mail, Internet policy and also the physical security policy. The policies are normally drafted by a team of senior professionals including the CIO, HR head and the process head. The CEO adds inputs to it and finally approves the policy. 

On security policy and reviewing: Documented policy ensures uniformity and clarity on implementation. An external third party audit shall also insist on a documented policy, so will the compliance to standards like BS7799 or ISO 27001.

Security policy is also reaching the boardroom. The focus is on risk and its management. Risk management could be mitigation, acceptance or transfer of risks. Uptime of systems plays a pivotal role. At least once in six months, review is necessary. Review of a policy could be the outcome of a finding, due to a recent security incident. Policies need to adhere to the standard for which certification is sought. 

Take the case of Kale, we adopted BS7799/ISO27001-based ISMS. This talks of the Plan-Do-Check-Act (PDCA) implementation. There has to be a check on current level of implementation and the findings need to be corrected, which mostly could mean change in policy. This can happen if the reviews happen at regular intervals.

Our security policy focusses on ethical use of IT assets and facilities like e-mail, laptops and Internet. There are defined policies for routers, firewalls and AV deployment/patch management. The policy covers control on external devices and there is a check on what goes out of the premises. Emphasis on data ownership brings accountability. Similarly, we are planning to upgrade to the new standard. 

On physical access control: It is more to do with the trust factor. It is also difficult to check all the contents stored on media. While you may have a policy to control usage of CD-writers, what gets written on it, remains known to the person doing it. The challenge is to bring in culture shift, and accountability for assets. 

On audits: Half yearly audits are fine among organisations. However, a right mix of internal as well as external audit is necessary. The reason being internal audits are normally not taken seriously. In extreme cases, even the internal auditors can get biased. The focus changes from a fact-finding to fault-finding exercise.

External audits are a must for certificate maintenance. External auditors would look for internal audit findings and the corrective and preventive actions based on them.

I do not recommend external audits alone, as that may focus only on samples and real issues may not come to the fore. Focus should be on continual improvement and not on hiding behind loopholes.

V K Ramani President, IT, UTI Bank

On the survey finding that anti-virus and firewall still tops the chart: There exists an information security ecosystem and anti-viruses and firewalls form a part of that physical aspect of the security, which is visible and therefore they are on the top. But unless proper controls and implementation back them up, they will not be optimally used. 

On security policy and review: A security policy in short is a document which says how well an organisation’s information is stored. The most important people who frame the policy are from the top management and security committee. This is how it happens at UTI. The minimum review period that I would recommend is at least a year. But for critical applications, a half-yearly review is a must.

The major reason for documenting security policy is for creating awareness among employees. Its implementation and control are important in the later stages. What is needed is a will to enforce the policy and cooperation from employees. A lot of organisations just go for the frills as far as security is concerned. There is no essence.

Security issues getting discussed at boardroom level is a matter of educating all employees. At UTI we produce an internal newsletter and circulate it. It covers pointers such as consequences of an attack, various types of risks and so on. It is called InfoSec@UTI Bank. 

On physical threats: There are lots of ways in which an unauthorised employee can access data. The IT team can always provide passwords and user identification. But then there are ways such as maintaining copies of documents and so on at unsecured places, which we cannot do much about. 

Data security tops our list followed by storage security. Access controls and user/customer education are also important. As far as physical data thefts are concerned, we only have an advisory list of do’s and don’ts for our employees. 

On security audits: Organisations need different frequencies of audit. It depends on how the information legitimately flows and gets distributed. The idea of maintaining standards is that an organisation evolves to that level before upgrading itself. We follow a result-based policy, where the result of an implementation is considered rather than a set standard.

As a conscious policy at UTI, the process of conducting audit is not done by the IT team. It is done by the management. We support them in every way, but the final process of audit and report is done by a team other than IT. A copy of the report is first sent to the management and then to the IT team.

As far as the internal team is concerned, they might not be able to assess the potential or sometimes, even the existing risks in total view of the organisation. There might be some points, which may miss their view of things. So it becomes essential that some external hand also plays a part in the auditing of the security policy.