Tech to Terror Proof Your Organization

Anil Chopra and Anindya Roy

By now, there's been ample media coverage of the terror attacks in Mumbai,
and how terrorists managed to use the loopholes in our system to achieve their
objective. Never before was there such an uproar from the entire nation over
this episode, which clearly reflects that we've run out of patience at the lax
attitude of the govt. toward the country's security. While we wait for the govt.
to do something about it, it's time we also did something to combat this menace.
After all, security is everyone's responsibility, if we don't want any further
loss of lives, property, business, and market reputation. We received lots of
queries from many CIOs on how should they use IT to protect their
infrastructure. Considering that IT systems are the backbone of most businesses,
the CIOs obviously have a reason to worry.

So in order to understand what Indian enterprises are doing to secure their
infrastructures, we did a small survey of around 30 CIOs from leading
organizations across the country. By and large, everyone's definitely worried. A
majority of the CIOs said that their organization was very worried about the
security of their infrastructure, and were quite serious about doing something
about it. Some of them had even gotten special budgets sanctioned for
strengthening their IT security.

The right way to deploy IT security

But before you scramble to deploy high-tech equipment like DFMDs (door frame
metal detector), surveillance systems, etc, you need to understand the scope of
the problem and the role IT can play in combating terror. Technology can
certainly help combat terror, but its usage has to be clearly understood in
order to choose the right equipment. For instance, even if the surveillance
system detects a terrorist, or the DFMD detects heavy metallic objects being
brought into the premises, they can't really stop them. Their objective is to
detect and monitor, and not protect. That doesn't mean you shouldn't deploy such
systems. You need to understand their effectiveness in combating terror. For
instance, the US has deployed video surveillance cameras at many of its
airports, which can identify baggage that remains unattended for some time.
Similarly, video monitoring technologies have been deployed to check if a
vehicle circles a high-rise building more than required, or if a person makes
multiple trips to the shopping mall within a specified period of time. All of
these technologies can certainly help in raising an alert if something goes
wrong.

Unfortunately, that's not how technology has been used in India. For
instance, the Taj hotel in Mumbai had also deployed CCTV, but when the
terrorists attacked it, they took over the control room because it was located
within the hotel's premise itself. Since the terrorists knew the hotel inside
out before attacking, they made the control room inaccessible to the security
forces. Had the hotel used IP Surveillance, then the entire hotel could have
been monitored from outside, and many more innocent lives could have been saved.

In another incident, which was much more mild than this, but puts the point
across, is of a close acquaintance of mine who lost her bag in a shopping mall.
The bag contained all her cards (credit, ATM, etc), as well as cash. She
immediately informed the mall's security personnel about the incident.
Thankfully, the mall had CCTV installed at its entrance, and had recorded all
movements in that area. Upon playing back the video, they were able to spot the
thief (apparently a small boy), walking away with the bag out of the mall. This
sounded like good news, but only for a while, because they soon realized that
they couldn't identify the thief. The cameras were just not powerful enough to
zoom close enough to recognize the thief.

Both of the above cases are examples where technology has been used just for
the sake of it, without serving any real purpose. Had the mall used CCTV cameras
with better optical zoom, they could have identified the thief and nabbed him
later. Had IP Surveillance been used, operation Taj would perhaps have ended
much faster. You might say that the Taj group would never have imagined in their
wildest of dreams that such an episode could ever happen to them. But then,
that's how disaster strikes!

So, it's important to understand that IT security goes much beyond
surveillance systems. It needs to ensure that the business can spring back into
action quickly a fter a terrorist attack. Essentially, a terror strike is an
unpredictable disaster, so you need to ensure that your business is able to
spring back into operation as quickly as possible after it happens. For
instance, post the Sep 11 attack on the world trade center towers, many
companies that had offices in those buildings managed to get back to business
because they had an effective DR and BCP strategy.

Which security technologies to deploy?

Security is no longer about protecting your data against virus and malicious
software attacks, nor is it about protecting it against hacking attempts or
against preventing disgruntled employees from stealing information. These you
need to do anyways. Today, security also means protection against infrastructure
mis-use and information leakage. How do you know that the person you've recently
recruited is the person who he/she claims to be? Maybe it's a terrorist. In
today's world, it doesn't really sound that absurd. How do you know that your
network is not being mis-used by terrorists for communication?

The moment you add this dimension, you see security in a whole new light. For
infrastructure mis-use, you need to put stringent access controls in all places,
like WiFi networks or in sensitive areas like data centers. For keeping a tab on
you employees, you need to put in stringent identity management systems,
possibly backed up by police verification.

There would be some measures that would be specific to different types of
verticals. The govt. for instance, needs to secure all its websites against
information theft, and from being hacked. Large buildings infrastructures like
commercial towers, shopping malls, railway stations, etc would need to put in
surveillance systems that can monitor specific things like how many times is an
unknown person making trips, or report suspicious unattended items lying around
for too long, etc.

When we asked our respondents, 45% of them said that they planned to deploy
information leakage prevention solutions. Another 34% had plans to deploy
biometric access in their data centers and soup up their wireless LAN security.
You can see the rest of the security measures in the chart.

There are many other things that can be done besides the above to secure your
IT infrastructure, depending upon your setup. For instance, if you're in the
power business, then you might also need to deploy video surveillance of all
installations and devices for distribution, transmission and generation.

IP Surveillance

At a time, surveillance was something which had nothing to do with IT. Then came
the IP cameras making IP Surveillance a major part of IT Security. And now
things have gone much more sophisticated through the use of IT and we have
something called Video Intelligence or Vi. With a huge market in US and UK, this
is spreading its wings into developing countries like ours. Vi has emerged
because of a problem which was there in legacy Surveillance systems, where the
real-time monitoring was a complete manual task. And imagine a scenario where
one has a video control room with two people sitting and watching the feeds from
200 odd cameras.

This is physically not possible for a human to pay 100% attention to the
video feeds throughout his working hours, and if he misses a small incident, it
can cause a havoc. And that's where Vi plays its role. With Vi solutions, one
can automate alerts based on a veriety of events, and in case of an alert it can
push the feed to the concern person's laptop, PC or even smart phones.Some key
features of Vi are as follows

Tracking movement: These devices can not only highlight suspicious
activities but also can track movements. So let's say, someone is trying to
enter a restricted area and he gets caught by the motion detection feature and
the alert is generated. Now the system will not only highlight the person in the
video but will also track and map his movement.

Car tailgating: With this feature, the camera automatically captures
the stream of a car trying to enter a restricted area by tailgating an
authorized car. And of course generates an alert.

Grouping of people: This is a customizable feature where one can
select an area in the video stream and set a threshold of how many people can be
there at a point of time in a group. If the group exceeds the number of people
it raises an alarm. Systems are now sophisticated that they can easily
differentiate between persons and their shadow and overlook the shadows while
counting the people.

Tracking objects: This is a great feature and can be used to protect
our railway stations and other public places such as malls to protect against
bomb scares. With this feature either one can set alert on any object which is
lying unattended and can raise an alarm on such event.

The same feature can be also used to raise an alarm someone forgets his
belongings somewhere and someone else tries to go near it or pick it up.

NightVision/Thermal Vision: Night vision and thermal vision is another
great feature of new age surveillance solutions. This is not exactly a software
feature, but rather a feature of the camera. But if used along with good
intelligent software can be very helpful. So for instance, if you are trying to
set a motion detection near a railway line, it is nearly impossible for the
system to differentiate between the motion caused by the trains and the motion
caused by a human intruder.

But with a thermal vision camera, the system can measure the heat level of
different objects and can actually differentiate between a moving train and a
moving intruder.

Security & Corporate Resilience: Urgent Memo to CEOs

Ashish Sonal, CEO, Orkash Services

If at all, there exists a silver lining to the very dark clouds of Mumbai's
26/11 events, it is that these seem to have triggered a key psychological shift
in how security is perceived. The question regarding the 'relevance' of security
would hopefully no longer need contrived answers in this country. For the
corporates, the challenge of achieving operational resilience in the face of
increasing complexity of security risks (both external and internal) is becoming
a defining factor. Terrorism, cyber attacks, online threats, major frauds,
likelihood of global epidemics, impact of global warming, the operational risks
arising from the current global financial crisis, are like 'Tsunamis' in the
waiting, their impact amplified by the interdependent business and economic
environment. Very few companies are doing a good job of taking the
responsibility to create a management-level of understanding of such security
risks. Business leaders, as decision makers who set the priorities and steer the
strategy of their companies, must acquire this understanding because many such
events are statistically unpredictable. Security is a big challenge in itself,
but what creates resilient organisations is not merely this. It requires
something that I term as building an 'Assurance Layer' around security risks. In
reality, all corporates commit fairly large amounts of resources and money on
security and internal controls. Yet, often fail to be resilient to even routine
threats because they miss putting this assurance layer in their systems and
processes.

What constitutes this Assurance Layer? It is accurate intelligence (and in
the absence of actionable intelligence, a capability for anticipation) and good
incident response. The first line of incident response capabilities and
intelligence creation encompass mainly tactical and operational level processes
and systems in an enterprise. There are many things that must change in how
corporates manage security risks. The Mumbai attacks are an immediate
psychological drivers for this. But, so should be the impending threat of cyber
attacks, the likelihood of epidemics like avian influenza, and the operational
uncertainties that went unmonitored. The best security can only be achieved
through the involvement of every employee and every business process. This is
not as difficult a proposition as it may seem. A similar management challenge
was successfully met by the corporates in the decades of eighties and nineties.
It led them to devise ways to embed quality management as a key performance
parameter for every employee, every function and every process in their
day-to-day working, enterprise wide. Security and the concept of Assurance
Laycer are indeed very much like Quality from a management perspective; these
must be part of the DNA of the functioning of a company. To make this happen, we
require change-management as an agenda that is driven from the top; remember it
took someone of the stature of Jack Welch to demonstrate that (six sigma)
quality management can be embedded seamlessly down to the minutest level across
even as massive an enterprise as the GE.

Whether it is physical security or information security, the enterprise level
systems that exist in companies focus disproportionately on building static
controls at the physical and logical/IT perimeters of an enterprise. When these
fail, or when the threat just materializes as a random event, what truly matters
is incident response in terms of speed, in real time, for containment and
recovery. This requires speedy defensive response and investigative intelligence
capabilities, particularly when the threat arises as an event that occurs
through or impacts the information technology infrastructure. Beyond the larger
aspect of integrating and aligning security risk management with the other
day-to-day business processes that run in a company, another challenge is about
the ramifications of the convergence of security risks in physical and IT
infrastructures of companies. An alliance and interconnect between the physical
security and logical/IT functions is a great value-add. For example, alerts can
be triggered based on IP enabled surveillance systems and access control logs,
even as the IT security team's cyber forensics tools investigate in real time an
internal intrusion/anomaly indicative of an employee attempting data theft.

For the role of incident response, investigative intelligence and cyber
forensics based evidence chain creation is the key -an area where very few
companies have created capabilities that can provide real time response. The
world remains full of random variability from a management perspective. The
defining events that bring radical changes in the business environment,
generally tend to be unforeseen and massive. Business leaders must focus beyond
business efficiencies. An assurance layer comprising capabilities for
intelligence and incident response for security risks is increasingly the key
characteristic of successful companies.