Need to Security Private Information - Requirement in India

Unique Identification Authority of India (UIDAI) data center in Bangalore is reported to have got a cover of 65 star guards from multi-skilled security agency, the Central Industrial Security Force (CISF) - Your identity is guarded by 65 armed men (article on times of India).

It indeed is a commendable step by the authorities, but my question here is - Is this measure enough to secure the Identity and avert the threat from identity theft? Actually Speaking NO and the reasons that attribute to the answer NO are -

1. The personal information of an average Indian is scattered across the Government Offices, Public and Private Banks and other Financial Institutions to a large extent.  More scary portion is the availability of this information on papers across the offices
2. There is no defined mechanism to destroy the paper work by the various organizations and agencies.  Many a times some or other people from various organizations sell of these as waste papers to the scrap dealers.  There have been various incidents in past where papers with critical and sensitive information have been located with the road side vendors (bhel puri and other chat senders)
3. There is no defined guideline by the Government of India on how to use / dispose / destroy the information whether in paper or on computers
4. There are no set standards in India with respect to destruction or recycling of magnetic / optical media that may contain sensitive / private / identity information.  Such media may be Hard-Drives, Pen-Drives, Backup Tapes, CDs, DVDs, SD Cards etc among others
5. Nasscom has also not worked to this effect to advice with any standard guidelines to be utilized to this effect

Saying all this, we should not actually be cheering the news as published as it is the least of the measures that is required at deployment.  Another aspect to look at is - Has Government also provisioned a DR site for the UIDAI Data Center? Is that location also guarded with similar set of Security Personnel?  Unless we get that information, I guess this news is just a hogwash,

If you feel I am trying to belittle Government's efforts, then well I am not.  But my effort is to sensitize that there are additional steps required by the Government to ensure that the information related to the Identity of Indians as well as tourists / visitors to India is treated as sensitive and private.  Adequate measures as detailed below need to be put in place to ensure that such information is treated in fair and just manner - 

1. Enact a Data Privacy Law - Government needs to take immediate measures to ensure that the Data Privacy Law is enacted and enforced to set the expectations on dealing with Private and Sensitive Data.  The Information that needs to be treated as private and sensitive should include - Aadhar Number (as part of the UIDAI effort), PAN Card numbers (from Income Tax Authorities), Voter ID (from election commission), Ration Card, Passports and any other similar set of documents and information that can help establish the identity of any individual
2. Define Data Handling Guidelines - As part of the Data Privacy Law, Government must define the treatment of information classified as Private and Personal in a manner cognizant to safeguard the Identity of person holding it
3. Define Data Destruction Guidelines - As part of the Data Privacy Law, Government must also define how the data no more needed is to be destroyed.  For the data on paper and optical media for that matter must be destroyed by using shredders. The data on magnetic media for that matter must be destroyed by using programs that would over-write the data multiple times using different algorithms and thus rendering data as unreadable
4. Define Consent Requirement - Often this is one of the most overlooked case where the private and personal information of any individual is circulated / shared for commercial benefits.  There are cases where the Customer Relationship Officers or the Marketing Staff carries over the contact and similar other information to the next organization without consent of the Data Owners.  It needs to be noted that the receiving Organizations / Agencies are Data Custodians and not Data Owners, meaning they can use data for their internal processing purpose only.  For sharing or using data for any other reason than intended reason should not be permitted without consent from the Data Owners (Data Owner is the person about whom the information is)
5. Define Agreement Forms - Government must ensure that the Agreement forms used for the purpose of providing services are defined only for those services for which the Information is obtained.  Such Agreements must not any Clause or Fine Prints like "Organization / Agency may use this information for any of the required processing as may be deemed required by the organization / agency.

These are the basic steps to be taken to ensure Data Privacy & Protection.  These needs to be enforced along with the Indian IT Security Act 2008 Amendment Act to ensure that adequate Information Security Risks are addressed including the identity theft and information compromise.....
-------------------------------------------------------------------
Post is also available on 

Tech Notes GuruCool - Security and More

$45 Million Heist with Prepaid Card Duplication

I had been following the entire development on the big heist that was cracked by the US law enforcement.  The news in itself as lead to an interesting assessment for me on the way the Data Theft and duplication was carried out at mass scale.  I read various articles written across multiple news sites and went through even the comments that were made by various set of readers.  Some were pretty interesting and others were made out of hate for India and Indian service Providers as there were two card processors from India whose systems were breached.  The world as it sees may see it as a lapse of security measure implemented by the two payment processors from India, but then why shouldn't they look at the lapse of overall Risk Management System at the Banks as well as the Card network System in general??

There were articles and comments that pointed on the Core Banking Software in use, but then both the writer of the article as well as the comments need to understand that Core Banking Application has nothing to do with the Payment Cards that were compromised in this case. Before we point out the responsibility at the Core Banking Application or System or the People at the three types of organizations involved, we need to actually understand the modus operandi of the Gang Spread Across 27 Countries and specific Target being made at two Banks in Middle East.  Making a general Comment otherwise would simply be because you hate someone or because you have no knowledge either of the Baking System or the Pre-paid Card System for that purpose...Also, those trying to relate the software to this heist must first understand the it doesn't have any relation to the pre-paid cards, that is a different system that interacts with CORE BANKING Application....

One interesting point that I noted in the entire set of developments is the Lack of Controls around the Payment Cards that were compromised.  Why is it that the Banks when deploy enough controls on the Debit and Credit cards, they miss to deploy controls around the pre-paid cards that are mostly used as "Travel Currency Cards" or "Gift Cards" in most cases?  I am still perturbed as to how and why the Banks let the Payment Processors manage the Data on their local database without enforcing right set of controls required? Some additional questions that crept up to my mind - 

1. Didn't the Payment Processor deploy layered security to ensure that the Database is in the most secured zone?
2. Weren't Host base IDS/IPS systems deployed?
3. Weren't transaction monitoring and logging systems deployed to create alert for fraudulent withdrawals?
4. Weren't alerting system put in place for changes in database?
5. Why would Visa and MasterCard let huge withdrawals go through multiple ATMs and that too from the same cards? Why were the patterns not monitored at their end?
6. Why didn't the Banks whose ATMs were used ever sounded an alarm in the Banking Community about the huge transactions? Were they enjoying withdrawals from their ATMs and raising bills to the target Banks??

There are many such questions that need to be answered and probably we might never get an answer to these questions...for we would just read the development and arrests...What happens at the Banks, what happens at Visa and MasterCard and other organizations involved would never come to light...but, then its our Money and we must know if it is safeguarded...

Related Post - $45 Million Heist with Prepaid Card Duplication: Lessons Learned