Security considerations for software procurement by the government

By: Yolynd Lobo, India Director, BSA

The Indian government has undertaken large scale digitization of citizen services for increased convenience, transparency, and last-mile connectivity. With this, the quantum of data and information residing with the government and its agencies has grown drastically. Protecting critical data that is generated over e-governance portals is crucial, especially given increasing risk of cyber threats.

In fact, Indian government establishments witnessed 126% increase in cyber threats and attacks in 2013 as compared to 2012. The Indian government’s procurement market, estimated to be more than $300 bn, already accounted for nearly 25-30% of the country’s Gross Domestic Product (GDP) in 2012, according to a study by Center for International Trade, Economics & Environment.

Of this a large percentage is spent on IT and software procurement. According to Gartner, the Indian Government IT spending stood at $5.95 bn in 2012.

However, software procurement by government agencies in India is not centrally governed, today. Central and state governments have evolved their own laws and regulations that treat the process of procurement differently.

The Indian Government must put in place a robust policy and legal framework that mandates incorporation of information security requirements in the procurement of software. Building awareness and sensitivity among government agencies and encouraging them to utilise existing resources such as e-Security Assurance Framework (eSAFE), model RFP and model Master Service Agreements (MSA) is also critical. Detailed security requirements in the RFI/RFP process must be included.

Additionally, procurement guidelines must be based on international standards and be consistent across the centre

and state levels.

For government agencies procuring software, it is

important to build relevant skills to fully understand

software supply chain issues, risks, solutions, standards,

guidelines and best practices, to strengthen security.

Government agencies should have skilled experts, to

properly evaluate software across its entire lifecycle from

a security standpoint.

The use of genuine software, procured from reliable sources is an essential first step towards strengthening cyber security. Properly licensed software use is essential for handling patch management while protecting against viruses. The use of unlicensed software not only makes data vulnerable to security

breaches but also poses grave risks and hinders

productivity.

As the security threat landscape continues to evolve, investment in software asset management (SAM) by the government is imperative. SAM, an ISO standard looks at the entire infrastructure necessary for effective management, control and protection of software assets and matches software assets to licenses. Importantly, it also establishes the need for future upgrades and purchases.

A FORMAL POLICY REQUIRED

It is crucial for the government and its agencies to adhere to globally recognized software asset management practices to avoid any leakage of citizens’ personal data due to malware in unlicensed software. The government should establish a formal,

written policy against the use of unlicensed software and

maintain a comprehensive log of all software deployed in their

agencies to have a full view of their software inventory.

Only an enterprise-level software asset management program that is aligned to ISObased SAM standards such as Verafirm can provide assurance on software compliance and help

manage software licenses better.

CONCLUSION

A robust SAM program helps define four key factors including

people, policies, processes, and infrastructure, essential

for maintaining proper controls in an outsourced project.

Implementation of SAM by the government, its agencies

and various line ministries and departments will facilitate

them in retaining strategic control over their software

assets. They will be able to manage all customized

software assets created for various projects. SAM will

also help them keep a track of all licenses procured by

third party vendors for any specific project. This will lead

to enhanced security.

We believe that this will lay the foundation for success

of the Indian government’s e-governance initiatives and

large scape adoption by citizens.