Security is more complicated than buying a product

What kind of security compliance should businesses and industries need to
have?

Different industries have different requirements. If you are into
processing, transmitting, storing credit card information you have to observe
the compliance called payment card industry data security standards (PCI DSS).
If you are in financial industry like banks you have to observe Basel II
compliance. Basically, it includes operational and technological risks. So, I
think organizations and industries need to have to go for different security
compliances according to the industry s requirements and standards.

What is your view of the security compliance in Indian IT, and banking?

Lot of companies here understand the importance of information security and
management systems (ISMS), so they will have to document necessary controls to
adhere to the ISO27001 certification. However, I am a bit worried about those
Indian companies certified by ISO 27001 as there might be the forced perception
that they are secured but actually they are not. Security, unfortunately is more
complicated than buying an product.

What are your views on the global certifications and standards?

To a certain extent, ISO 27001 is a type of standard that is applicable
across different countries. But different industries behave differently. For the
payment card industry ISO 27001 is not sufficient for security of information.
So the card industry associations such as VISA, American Express and others have
built a new standard called PPI to specifically address the major concerns of
leaking of payment card data. Generally speaking, the ISO27001 would be a great
starting point but depending on specific industries and businesses you need
better security standards.

What is the awareness level about security compliance in India?

ISO 27001 certification is very big in India, about 450 companies are
certified. Its more matured than the US in terms of companies spending on
increasing security compliance and standards. But risk factors in different
countries are different. For instance in the US, you see huge number of hacking,
data losses or leakages. Whereas in India, companies are not viewing that kind
of risk exposures. Eventually the same risk exposures can be seen by Indian
companies. So its the matter of time, when Indian organizations wake up and say
that they need more protection than just ISO 27001.

Pankaj Maru/CMN

maildqindia@cybermedia.co.in