How Secure is IT?

The benefits of managed security services are much higher than that of
traditional security architecture. They offer customized, processed and
real-time security infrastructure, wherein the client headache is minimal and
protection is maximum. In a nutshell, managed security services (MSS) are
nothing but the outsourcing of security infrastructure and management.

However, most of the CIOs believe that total outsourcing of security
management is not a healthy proposition, as by doing so one has to give away
axis to sensitive data to an outsider that can be dangerous. Also, there might
be lack of transparency on the vendors part in case any problem arises within
the infrastructure. To play it safe, they advice to embrace a policy to get the
best of both the worldsto outsource the hardware management aspect, while
keeping the policy-making and infrastructure control in-house.

Have a Controlled Approach

Vikas Guru, deputy GM, IT, MTNL

With the growing demand for telecom services in the country, service
providers are going all out in providing improved and effective connectivity
services to the customers. And with the advent of mobile and broadband
technologies, telecom services have become vast and more complicated. Further,
with increased value added services (VAS) offered by the telecom vendors,
security has become a vital area to be addressed.

With a wide range of services offered by MTNL through its landline, mobile
and broadband services, and a vast customer base, the organization has to
implement a robust security infrastructure and constantly upgrade the same.
Unlike before, when MTNL had mainly a well-defined password management and other
basic security management systems in place, today it has to install an advanced
security architecture complying with the various security regulations.

To meet the present day demand, MTNL has recently modified and consolidated
its security policies. As part of the development, MTNL has included third-party
audit system under its current security framework. We will be soon implementing
the same. Keeping in place the current scenario, it is very crucial to undergo
third-party audits as well as take expert consultation on latest threats and
security solutions to counteract them, explains Vikas Guru, deputy GM, IT, MTNL.
However, total outsourcing of security services is yet to be considered. MSS
has its own advantages and we have our plans to consider it in near future. We
are evaluating the probabilities keeping in mind all the security norms that we
have to follow, he says.

According to Guru, outsourcing security management services is important as
the entire process is handled by experts and hence, it eases out the job of
internal IT team who can focus more into strategic works to enhance the core
business competencies by deploying improved and cost efficient IT
infrastructure. However, as far as the policies and strategic management of the
security system is concerned, the control should be kept in-house.

Mix n Match

Srinivasan Iyengar, head, IT and change management, Aegon Religare

There are critical security issues that an insurance company CIO has to deal
with. And these issues only assume more magnitude if your insurance business is
as young as a year and unlike a majority of businesses, has two data centers up
and running.

And this is what has become a major challenge for Iyengar, who classifies
security into four basic areas: hardware infrastructure security, data center
support, user id related security, and customer security. Given so many crucial
security management points, Iyengar has adopted a mix and match approach.

While his primary data center is completely outsourced, his secondary data
center is hosted by his team in the head office and is managed by a third-party.
The same mix applies to the user id domain. While its creation is managed by a
third-party, the controls and management lies with Iyengars team only. When
asked the obvious question of why not go for a completely outsourced or in-house
model, Iyengar crisply gives a few pointers. Firstly, some activities are
routine for which resources/services are easily provided by outsourced vendor,
and more importantly, for all other checks and controls we would like our team
to personally monitor/review the work and hence full outsourcing is not
appropriate.

When it comes to the customers security, Iyengar has no taste for mix and
match. We automatically generate passwords including the ability of our
customers to create their ids based on real-time authentication, secured access
and certified websites. Besides, we dont store any financial details of the
customers. We direct all payments to the gateway site which makes the process
most secure, he says.

His take on managed security services is, It is something that every CIO
should look into, but with a lot of caution. A very strong governance and
evaluation process is required if you go the managed services way. But most
importantly, you should never lose control over any part of your organizations
security, he says.

Not a Childs Play

Amit Gupta, VP, IT, Fidelity Business Services

With increased sophistication of threats and growing enterprise networks,
security management has become a bigger challenge. The concern is higher when it
comes to dealing with critical customer data (financial). Although outsourcing
security services at enterprise level is gaining momentum in India, for Fidelity
Business Services, things work in a different manner.

Our core business area revolves around managing peoples money. Maintaining
security is the key concern in our business and cannot afford to play with
that, says Amit Gupta, VP, IT, Fidelity Business Services. Managing
securityboth data and investmentis of utmost importance for us. One breach
anywhere and our market credibility will be lost, not mentioning about the
financial loss and legal hassles that we have to undergo, he adds. To prevent
that, Fidelity has opted to continue with its in-house security management
system rather than going for managed security services.

Keeping various security regulatory compliances in mind, Gupta has
implemented required security system based on latest available technologies and
has hired experts to manage it. Its a big challenge for us since the
responsibility is huge. Hiring and retaining the best of breed techies and train
them to keep updated with the latest threats and solutions is tough, admits
Gupta. But he has been doing so with great success.

Therefore, outsourcing security management services is being kept at bay now.
MSS has its own advantages as well as disadvantages. As of now we have taken
only consultation services and third-party audits to revise our security
infrastructure, informs Gupta. Agreeing upon the benefits associated with MSS,
like cost-effectiveness and less headache, as well as the domain knowledge and
professional services offered by MSS providers, Gupta pointed out the key
drawbacks for which his company has refrained from total outsource of its
security system, Any third-party service provider offers its services to 100 of
clients. Despite having required skills and expertise, we feel nervous as in the
process we will give away axis to sensitive data to outsiders that might harm us
and our customers. Therefore, for Gupta, the best way is to go for a hybrid
model that should be a mix of both.

Partial Outsourcing, Full Control

Arun Gupta, CTO, Shoppers Stop

When it comes to managed security services, Arun Gupta, CTO, Shoppers Stop
is quite clear about having the processes as well as the policies under his
supervision. As a result, there are certain organizational tools, that are
completely in-house, while some like servers, data centers, applications,
networks, and customer services are outsourced.

Shoppers Stop has seen an evolution in its outsourcing and managed services
modules during the last couple of years. This is only set to advance in the
coming twelve to eighteen months. Says Gupta Although we plan to outsource
more and more, strategy is something that we would keep in-house.

For online security, the entire software and hardware is on a SaaS model.
Also Gupta says, that he made sure that his vendor was PCI DSS compliant, which
is the highest level of security. Gupta is clear about the point that there can
be absolutely no compromise on the customer data. Thus, as a policy Shoppers
Stop has decided not to store credit card data and direct payments to a bank
site. Besides this, its own site is certified using Verisign.

Virtualization is the key when it comes to storage of crucial data. All the
storage of the organization is done in a highly virtualized environment, a
process that was initiated almost three years back. Says Gupta, Rather than
storage, data security is a matter of policy and access. He has, therefore,
taken over himself to extensively define the rules of access at different layers
of the organization.

His advice for CIOs looking at the managed services way is to take
outsourcing as an evolution, and not as a big bang. His mantra is to start
exploring, because in-house, according to him, wont be possible forever. You
wont be able to retain the talent that can handle multiple threats that come
your way all the time. So, its wise to start exploring the outsourcing path,
because you shall certainly see value in the long-run.

Piyali Guha & Mehak Chawla

piyalig@cybermedia.co.in,
mehakc@cybermedia.co.in