|
30 Minute Interview
Data Security in India
The recently held Nasscom Information Security conclave 2007
at Hyderabad was a brainstorming session about the one field where India has
not led. Anil Chakravarthy, VP , India Technical Operations, Symantec
was one of the speakers at the conference and he spoke to Satyam Pati
about Data Security.
Anil Chakravarthy |
Target India
“According to our research, 50% of security threats
in India are a result of Malicious Code” said Chakravarthy. The same figure
for the western world is around 20%. This points towards the distinct nature
of threats India Inc. faces and needs to address urgently.
He continued saying, “Even the most common threat propagation
methods in India are in the form of file sharing mechanisms, be it flash drives,
CDs or DVDs.” The overall level of IT security implementation in the country
is definitely low if compared to global standards.
“The botnet threat has not skipped India and the country
is home to a large number of botnets and at least two botnet servers that we
know of,” said Chakravarthy.
All this can have significant consequences for the IT industry.
“As a services destination, in spite of cost advantages and quality, Data
Security could become our greatest disadvantage,” he emphasized.
Though there has been significant increase in IT security
spending, IT security has not managed to keep up with the phenomenal growth
of IT sector in India.
Chakravarthy explained that the security world does not remain
static, threats keep on changing, motivations change and the need for caution
remains at all times, especially for India.
Threat Trends
Speaking on where the trend lay in terms of threats, Chakravarthy
had two major trends in mind. The first one is that the threat scenario has
changed from a mass effect-massive attack nature to surgical strike. In other
words, threats no longer aim to deliver crippling blows but disable security
in order to achieve specific objectives like stealing information. The second
trend is that attacks nowadays are directed more towards the individual system
components rather than a complete system or a change in the attack surface.
The level of technology today enables the targeting of specific system components
thus making detection even harder. “Most affected individuals do not even
realize that they are under attack,” said Chakravarthy.
IT Security has always incorporated principles of AI and
solutions enable the detection of threats by looking for abnormal behavior by
a program rather than just looking for the effects of an attack or obviously
malicious code.
The coming of Web 2.0 also has meant that IT security systems
need to evolve. With the coming of social networking and Wikis, security must
expand to adapt to the new generation of threats.
Another major development, has been that the quantity of
data in unstructured form as in e-mail, Word files, Excel sheets etc. is much
greater than those in structured form (databases). Defining rules around that
is rather crude today. Understanding unstructured data is critical today and
lessons can be learnt from the information retrieval world, basically, search
engines.
Chakravarthy feels that companies should incorporate a Risk
Management approach while looking at threats. Different companies, depending
on their activities and business models, would face varying degrees and nature
of threats and they need to determine their focus area for data security.
|
