- DSCI
-
The Data Security Council of India (DSCI)[1], which was set up by NASSCOM in August 2008, has recently announced its best practices framework for data security and data privacy in Indian enterprises.
DSCI is a self-regulatory and not-for-profit organization, with a sole mission to promote India as a secure destination for outsourcing. DSCI wants to promote these best practices among IT business process outsourcing (BPO), service providers, banking and financial services, manufacturing, e-governance, telecom, public sector units (PSU) and e-commerce verticals.
Many Indian IT BPO and knowledge process outsourcing (KPO) organizations serve clients from across various locations such as the U.S., U.K. and Australia. Hence these organizations are subject to these countries' data security and privacy protection regulations. According to DSCI, IT BPO players face major challenges when it comes to meeting multiple regulatory requirements and establishing the corresponding security controls. "After deep analysis of these compliance requirements and other emerging security risks, we decided to develop comprehensive best practices framework," says Kamlesh Bajaj, the CEO of DSCI. The IT amendment act 2008 also now necessitates that Indian enterprises implement reasonable security practices to protect personal data.
DSCI has developed separate frameworks for data security and data privacy. The security framework comprises 16 best practices organised in four layers which are basically an extension of the ISO 27001 standard. The privacy framework comprises 9 best practices organised in 3 layers.
Although several large Indian companies have already adopted the ISO 27001 standard, Bajaj feels that these organizations need more when it comes to data security and privacy. "The security threat landscape has changed over past few years, which calls for special attention. For example, ISO 27001 covers only a few aspects of application security. However, application security threats have become very sophisticated, and organizations need to evolve their security practices. DSCI's security framework tries to address such new threat areas with detailed understanding." says Bajaj. It consists of best practices in various areas like application security, business continuity, disaster recovery, threat management, infrastructure security, risk, compliance and access management.
The DSCI framework tries to guide organizations on how to create application security strategies, architecture, intelligence mechanisms, integration of applications security in the overall application life cycle management, testing of applications and vulnerability assessment. The DSCI privacy framework is specially aimed at data protection practices for companies engaged in outsourcing. DSCI has developed nine best practice areas for protection of personal data, which include creating visibility over personal information, privacy policies, regulatory compliance intelligence, privacy contract management, and information usage.
DSCI is conducting pilot tests with Indian organizations and plans to have publicly available case studies by December 2009. Since the framework only covers best practices, DSCI plans to develop an implementation methodology that provides information on the technical and operational aspects of security best practices.
External links
This computer security article is a stub. You can help Wikipedia by expanding it.
