Category: Article

Because information technology (IT) deeply affects privacy at individual and societal levels, systems should be built in a trustworthy manner, consistent with widely recognized, high-level privacy principles such as the Fair Information Practice Principles (FIPPs). The National Institute of Standards and Technology (NIST) regularly conducts research into technology, aiming to improve innovation and competitiveness, thereby advancing U.S. national and economic security and quality of life. Much of NIST’s previous guidance into the trustworthiness of systems in various technical areas – including cybersecurity, cloud computing, big data, and cyber-physical systems – has focused on the security objectives of confidentiality, integrity, and availability (CIA). While unauthorized access to personally identifiable information (PII) is a subset of information security and a critical aspect of privacy, there is a less-developed understanding of other ways in which a system impacts individuals’ privacy and how to identify and address risks that extend beyond unauthorized access. Thus, there is a need to bridge cybersecurity and privacy as two different attributes of trustworthiness. NIST’s Information Technology Laboratory has developed a new Internal Report (NISTIR) 8062, Introduction to Privacy Engineering and Risk Management in Federal Systems – building on several years’ collaboration with public and private sector partners – including two public workshops and a webinar. While all organizations benefit from effective privacy engineering, NISTIR 8062 will be particularly helpful for U.S. federal agencies. Federal privacy protections have been in place for more than four decades, and the need to protect individuals’ privacy remains as critical today as ever. The U.S. Office of Management and Budget’s recent update to Circular No. A-130 includes a new emphasis on managing privacy risk, so federal agencies will need guidance on repeatable and measurable approaches to bridge the gap between privacy principles and effective implementation. To that end, NISTIR 8062 will: Lay the groundwork for future guidance on how federal agencies will be able to incorporate privacy as an attribute of trustworthy systems through the management of privacy as a collaborative, interdisciplinary engineering practice; Introduce a set of objectives for privacy engineering and a new model for assessing privacy risks in federal systems; and Provide a roadmap for evolving these preliminary concepts into actionable guidance, complementary to existing NIST guidance for information security risk management, so that agencies may more effectively meet their obligations under Circular A-130 and other relevant policies. NISTIR 8062 is an introductory report intended to foster further discussion. To better support the operational needs of agency privacy programs, and to help develop guidance that is comprehensive enough to promote compliance with policy directives, NIST will continue to collaborate with the privacy community through open processes. An Engineering Approach to Privacy A significant body of work already addresses security in federal systems. Recently, the term ‘privacy’ has begun to be added to these security documents. This addition implies that privacy shares enough characteristics with security that the guidance should be applicable to address privacy. However, even the fact that ‘privacy’ is used as a separate term confirms that privacy has a separate meaning and brings with it issues distinct from security. That is why it is important to understand the relationship – particularly the distinctions – between information security and privacy. Doing so will improve understanding of how to apply established systems engineering and risk management processes to address privacy concerns. As noted in Circular A-130: “Federal information is a strategic asset subject to risks that must be managed to minimize harm. Protecting an individual’s privacy is of utmost importance. The Federal Government shall consider and protect an individual’s privacy throughout the information life cycle. While security and privacy are independent and separate disciplines, they are closely related, and it is essential for agencies to take a coordinated approach to identifying and managing security and privacy risks and complying with applicable requirements.” At the same time, throughout the Circular, there is clear recognition that privacy and security needs require separate leadership with unique skills, and that a coordinated approach does not necessarily mean an identical approach. Public discourse on the relationship between security and privacy often includes colloquial phrases such as ‘Security and privacy are two sides of a coin’ and ‘There is no privacy without security.’ Clearly, confidentiality of PII plays an important role in the protection of privacy. However, there are security issues unrelated to privacy (e.g., confidentiality of trade secrets), just as there are privacy issues unrelated to security. For example, some communities have responded negatively to smart meters due largely to concern that the information being collected can reveal behavior inside a person’s home, and less so from concerns that the utilities cannot keep the information secure. Even actions taken to protect PII can have privacy implications. For example, security tools such as persistent activity monitoring, can create concerns about the degree to which that monitoring reveals information about individuals that is unrelated to cybersecurity purposes. These cases illustrate that systems designed to achieve beneficial objectives (e.g., improved efficiency of the electrical grid and increased security) can adversely affect individuals’ privacy as an unintended consequence or byproduct of the system as it is collecting and using information about individuals. This by product risk model is conceptually distinct from the security risk model. In the security risk model, concerns focus on unauthorized activity that causes a loss of confidentiality, integrity, or availability of information or systems. In the by product risk model, the processing of PII is planned and permissible (i.e., authorized), but it creates implications for individuals’ privacy. So, while some privacy concerns arise from unauthorized activity, privacy concerns also can arise from authorized processing of information about individuals. The below figure shows a non-proportional representation of the relationship between the privacy and security domains. Recognizing the boundaries and overlap between privacy and security is key to determining when existing security risk models and security-focused guidance may be applied to address privacy concerns – and where there are gaps that need to be filled to achieve an engineering approach to privacy. For instance, existing information…

India is hosting the 92nd Annual Conference of World Association of Detectives (WAD) and a Roundtable Dialogue on Anticorruption Partnership during 10-14 October 2017 in Shangri-La, New Delhi. It is an impressive assembly of global leaders in Cyber Security and Corporate Intelligence who will discuss and develop tools to deal with internal and external corrupt practices, and launch a well-coordinated corporate campaign against corruption to support agenda of good governance of the Prime Minister of India. World Association of Detectives (WAD) is a global alliance of investigators and security professionals from around the world. WAD aims to promote and maintain the highest ethical practices in the profession of private investigation and security service, and to establish and further a mutual feeling of trust, goodwill and friendship among agencies throughout the world. WAD has members from more than 80 countries across the world, where India has one of the largest representations of 71 members. Coincidently, Kunwar Vikram Singh who is the current Global President of WAD, is also from India. He joined WAD more than 30 years back, and was elected President at its 91st Annual Conference held at Bucharest, Romania last year. Kunwar Vikram Singh is the founding Chairman of Lancers Network Ltd. which is South Asia’s leading Risk Consulting firm, operating in the high-on-risk countries of the region and the other parts of the world including Europe and CIS countries. Equipped with a highly experienced operational team drawn from the financial sector, armed forces, police, security services and industry professionals; the company has developed a reputation for providing quality driven, customer focused and highly successful actionable intelligence solutions. He is also the founding President and Chairman of Central Association of Private Security Industry (CAPSI), a leading organization for security professionals in India which has emerged as an ‘elite association’ nationally and internationally. It is an association of renowned security professionals managing the world’s largest workforce of 7 million guardsmen and women engaged in providing private security cover to the nation. The unique bouquet of experience and entrepreneurship has taken CAPSI to new heights, especially after the enactment of the Private Security Agencies (Regulation) Act 2005. Mr. Singh is also the founding President and Chairman of the Association of Private Detectives & Investigators (APDI), a preeminent national association of professional investigators in India. In addition to free-lancers, other investigation personnel as well as students are offering their involvement with APDI to better understand the constant changes in investigation issues and solutions. The members of the APDI work in compliance with the code of ethics of the Association. A majority of members of APDI are also members of WAD and the Association is actively involved in the hosting and organization of the upcoming WAD Annual Conference in India. SecurityLink India spoke to Kunwar Vikram Singh about the World Association of Detectives and the WAD 92nd Annual conference to be held in New Delhi. Some excerpts: SecurityLink India: Kindly give a brief about the global entity WAD. Kunwar Vikram Singh: World Association of Detectives (WAD) is the foremost international association of private investigators, security professional and security service organizations which was founded in 1925. It is the world’s largest and oldest association of its kind. It was formed as a joint venture by the combined membership of the World Association of Detectives, and the International Secret Service Association which was founded date back in 1921. The purpose of the establishment of WAD were primarily to promote and maintain the highest ethical practices in the profession of private investigation and security service; to grant membership to only those individuals whose personal and professional backgrounds and business affiliations are based on the precepts of truth, accuracy and prudence; to eliminate unreliable, incompetent and irresponsible members of the profession; to foster and perpetuate a spirit of cooperation among its members and with all those engaged in law enforcement; and to further and establish a mutual feeling of trust, goodwill and friendship amongst agencies throughout the world. WAD is registered in Colorado, USA. SecurityLink India: How was WAD conceptualized? Kunwar Vikram Singh: All nations, around the globe, have their own internal intelligence organizations such as RAW, CBI, FBI, KGB, or CIA and so on. However, their investigations and related activities are focused and dedicated to the government, government organizations and the safety of the country. Especially during those days, the private corporates and economic leaders across the globe who generally generate finance and employment, and who have the major contribution in making the nation’s economy, did not avail adequate facility and infrastructure to protect them. They lacked proper assistance and support in procuring intelligence either about the rivals or about the internal and external frauds caused especially in banking and financial sectors, or about any other private crimes for that matter. That caused huge economic losses to them and consequently to the respective nations. That conspicuous vacuum germinated the seeds of organizations like WAD. Retired police officers and intelligence professionals all over the world conceptualized and set up a pan-world organization called WAD to work together and exchange relevant information to settle the issues and help establish an environment of ease of doing business. Over the period, the flavor of the crime has drastically changed. For example, corporate, cyber, IPR crimes, financial frauds etc., were not there earlier. Several banks, companies and corporations have failed owing to internal frauds. For last three conferences, I impressed upon them to start a certificate course for young people who may even not essentially be an investigator. Several other professionals such as chartered accountants, lawyers may also opt for this field and become an investigator, as they are the experts of finance and laws respectively. Today we need huge number of young investigators, but that needs training and training facilities which are available only for the government personnel. – Kunwar Vikram Singh Global President, WAD  Today the world has shrunk and become one village. People have multiple operations in various countries including import, export, banking and all kinds of…

India is well on the way to digitisation helped along by consumer adoption of mobile devices and technologies, availability of high speed internet, and a strong push from the Government. Unfortunately, this comes at the cost of cybersecurity. With the country becoming a favourite target of cyber criminals, it is imperative that Indian enterprises and institutions secure themselves against cyber attackers who are becoming smarter and bolder with days. Although most business organisations have made some provision for security, it usually exists as a complex maze of vendors and solutions that rarely integrate or even communicate with each other. Managing overall security in such an environment is challenging, expensive and not fully effective. What Indian organisations need to aim for is an integrated security solution that is open, automated and simple. Perceptions Despite escalating threats, confidence in security technology is riding high in Indian organizations. In 2016, 69 percent of CISOs and security operations professionals in India said that their security infrastructure is very up to date and is constantly upgraded with the best technologies available; in the previous year, this figure stood at 61 percent. Note that the number is also significantly higher than the 58 percent of respondents in the global Cisco 2017 Security Capabilities Benchmark Study who said the same thing. Only 26 percent of respondents from India, compared to 37 percent globally, said that they replaced or upgraded their security technologies on a regular cadence but were not equipped with the latest and greatest tools. Constraints Despite being equipped with the right solutions to detect threats and minimize their impact, security professionals in India find it a challenge to fulfil their agenda. Contrary to the global situation where budget is the primary constraint, in India, budget is no longer a key issue, having slipped to the joint 8th position in 2016, from 2nd place in the previous year. In 2016, the biggest barrier to adoption was organizational culture and attitude to security, closely followed by compatibility issues with legacy systems, and certification requirements and competing priorities in equal measure. Lack of knowledge about advanced security processes and technology was in fifth place. In 2016, 30 percent of security professionals in India said that organisational culture and attitude to security was the biggest barrier to adopting the latest security technology and processes. This is sharply up from the 2015 figure of 21 percent, when organizational culture issues ranked a low 9th among 10 obstacles. Incompatible legacy systems came 2nd, named by 28 percent of respondents. Last year, this was the top barrier, named by 36 percent of security professionals in India. Globally too, incompatible legacy systems were voted the 2nd biggest barrier in 2016 after budget constraints. Although they realize the importance of securing the business, Indian organisations seem to view security as an  impediment to business growth, which creates some amount of resistance to adoption. The presence of a large number of disconnected legacy security solutions makes it hard to implement a cohesive security policy. Having to meet the certification requirements of so many solutions is another challenge. Last but not least,organisations find it hard to stay abreast of the rapid advancement in security processes and technology. Ironically, too many point solutions can increase an organization’s vulnerability to attack if they don’t communicate and integrate with each other. Unfortunately, most security professionals in India, like their counterparts in other countries, have a tendency to juggle products from many vendors. This opens up gaps in time and space that cyber criminals can exploit, and prevents organisations from presenting a seamless defense to attack. A sizeable majority of companies – 56 percent of the total – use more than 5 vendors, and 69 percent use 6 or more products; these proportions are very similar to the global figures, which stand at 55 percent and 65 percent respectively. However, when it comes to using a very large number of vendors and products, Indian organisations are ahead of their global counterparts – about 19 percent use 21 or more vendors and almost 30 percent of companies have at least 26 security products, compared to 10 percent and 17 percent respectively, globally. A cause for concern is that the strong security infrastructure of Indian organisations is not translating into strong governance. The reasons include incompatibility of solutions, unavailability of trained staff, and a lack of knowledge about the latest advances in security processes. Only 63 percent of alerts are investigated, of which 39 percent are deemed legitimate. Finally, only 47 percent of legitimate alerts are remedied. This is only marginally better than the global performance – globally, 56 percent of security alerts are investigated, of which 28 percent are legitimate. Only 46 percent of legitimate alerts are remedied. The following hypothetical example illustrates the seriousness of the issue. If an organisation in India records 5,000 alerts every day: It investigates 3,150 alerts (63 percent) and ignores 1,850 (37 percent). Of the 3,150 alerts that are investigated, about 1,229 (39 percent) are found to be legitimate, while 1,921 (61 percent) are not. Of the 1,229 legitimate alerts, the organization remedies only 578 (47 percent) and does not remedy the remaining 651 (53 percent) alerts. It is worrying that approximately 1 in 3 security alerts go uninvestigated. Organizations must introspect to understand what types of alerts are ignored and why. Do these alerts signal relatively trivial threats that might only spread spam, for instance, or do they pertain to much more serious issues such as a possible ransomware attack or critical damage to a network? Clearly, there is a need to raise the level of investigation. However, given the large number of alerts a typical organization receives every day, it would not be possible for an already burdened security team to investigate them all manually. The solution is to use automation and properly integrated security solutions to probe and analyse a greater area of the threat landscape. The fact that Indian organisations ignore so many threats each day creates doubts about their…

The brutal murder of seven year old Pradyuman Thakur at Ryan International School, Gurgram has left the Nation shocked and horrified. While the entire country is sharing grief with Pradyuman’s family, parents are raising concerns about the security and safety of their children in schools and other academic organisations. Frequent similar cases of security and safety lapses substantiate that institutions are not able to carry out due diligence in their premises on their own, and they need the assistance of expert agencies/ individuals to guide them in this endeavour. Security Sector Skill Development Council (SSSDC) has sought to engage with the Central Board of Secondary Education (CBSE) to educate school management and administrators to provide them with the objective and expert based school safety and security principles, and help them become ‘a designate safe and sound school’ as enumerated in CBSE safety guidelines. SSSDC works under the aegis of National Skill Development Council (NSDC) and Ministry of Skill Development & Entrepreneurship (MSDE) in the security domain. Maj. Gen. K. Sakhuja (Retd.), CEO, SSSDC said, “The Council is responsible for standardization of security training across the country. It has the expertise in training ‘security risk management auditors’ for both physical and electronic security systems. The auditors so trained are professionally competent to identify the gaps in security and advise the stakeholders on optimum solutions. They are fully aware of the statutory guidelines enumerated in Government directives, thereby contributing in the national focus of crime prevention.” The Council offers to help schools in identifying security gaps, upgrading their safety and security mechanisms and systems, and creating, updating and exercising emergency preparedness and crisis management plans. This is done through security audits, deployment of security guards through PSARA licensed private security agency, training and assessment of presently employed security guards under Recognition of Prior Learning (RPL) program, and psychometric testing of the deployed workforce, if necessary. “SSSDC has devised a two day special audit module for security auditors whereby experienced security personnel will be taught about specialized ways of dealing with safety and security of school children,” said Kunwar Vikram Singh, Chairman, SSSDC. The Ministry of Human Resource Development, Govt. of India has issued a comprehensive set of guidelines vide D. O. letter No. 10-11/2014-EE.4 dated 09.10.2014 (Annexure-1) regarding preventive mechanisms and procedures for institutionalizing a system to ensure safety and security of children in schools. From time to time the CBSE Board has also issued instructions to the affiliated ones to implement and sensitize the schools towards ensuring the safety and security of students during school time and while in transit to school and back home. It is a fundamental right of a child to engage and study in an environment where he/ she feels safe, and is free from any form of physical or emotional abuse or harassment. As the children spend most of their time in school, the concern of parents about their safety in schools is obvious. Growing incidents of child abuse are increasing their anxiety day by day and they are more concerned about the physical safety, and mental & emotional health of their children. The onus for safety and security of children in school campus solely lies upon the school authorities. Schools should strive to promote a better understanding amongst their teachers and staff on the laws protecting the safety, security and interests of the students, and devise means to take immediate remedial and punitive action against such violations. The staff members should be educated to recognize their protective obligation towards students and to ensure safety and well-being of children in schools. The Board has recently reiterated to all schools affiliated with CBSE to strictly adhere to all the guidelines issued by MHRD and Board from time to time. Any violation/ lapses with regard to safety and wellbeing of children in school campus would invite appropriate action including the disaffiliation of the school as per the provisions under Affiliation Bye-Laws of the Board. Guidelines Get the security/ safety audit done of their premises and personnel from their respective local police station, and follow the security related advice for the safety of school children. This may be compiled and reported online on CBSE website www.cbse.nic.in within 2 months of receipt of the circular. Install CCTV cameras at all vulnerable areas/ points in the school premises and ensure they are functional at all times. They must get the police verification and psychometric evaluation done for all the employed staff. Ensure that supporting staff is employed only from authorized agencies, and proper records are maintained. Constitute a parent-teacher-students committee to address the safety needs of the students and to take regular feedback from parents in this regard. The access to school building by outsiders should be controlled and visitors monitored. Provide training and development for staff to address their responsibilities to protect children from any form of abuse. The school shall constitute separate committees for redressal of public/ staff/ parents/ students grievances; internal complaints committee on sexual harassment, and committees under POCSO (Protection of Children from Sexual Offence) Act, 2012; and details of the these committees along with contact details shall be displayed prominently on school notice board and conspicuously on the school website for information of all stakeholders. After the unfortunate incident of the death of Pradyuman, many schools have approached us to help them carry out security audits of their institutions. Since SSSDC supervises and guides the government approved institutes where security guards are taking trainings today, we decided to collaborate with the CBSE to help schools strengthen their safety and security apparatus Kunwar Vikram Singh Chairman, SSSDC  

Safeguarding outdoor assets in a reliable and cost-effective manner often comes down to a single requirement – accurate intruder alerts and timely information about the unfolding event. While there are many technologies available for outdoor security, smart cameras with video analytics have emerged as the solution of choice for detecting intruders in real time outdoors. Yet the best technology will be handicapped if the alerts generated cannot be trusted. Repeated false alarms can eventually condition security operators to ignore real intrusions, undermining trust in the perimeter security system. In most cases the shortsighted response is to single out the security force as scapegoats, which ignores the real problem – alert fatigue. After responding to hundreds of perimeter breach alarms that turn out to be nothing more than small animals or windblown branches, even the most conscientious security guards lose confidence in the system and start to ignore its warnings. There is no longer any reason for this situation to exist. This design guide relates how smart video security technology, when properly deployed according to best practices, can cost-effectively protect outdoor assets with high accuracy and low nuisance alerts to help security forces stop intruders before they act. Start with the best detection: Use smart thermal cameras Viable outdoor security must start with a sensing system that is accurate, 24-hours per day. For this reason, conventional wisdom asserts that smart thermal cameras are the best system for detecting intruders outdoors. This is because thermal cameras see heat rather than light, so they are a perfect ‘human detector,’ and will ignore headlights, reflections off water, and other light-based activity, expanding their usefulness from their traditional role as night vision cameras to 24-hour intrusion detection solutions. Smart thermal cameras with built-in video analytic software offers several advantages: They detect in the dark with no need for costly artificial lighting. They work 24 hours/ day. They ignore reflections, shadows, moving headlights, direct sunlight, and other light-based phenomena that can trigger alarms in a visible camera detection system. Because humans give off heat, thermal sensors are far more effective in spotting a person than visible cameras. They detect body heat as far away as 600 meters – a third of a mile. A single thermal camera can protect an area the size of a football field. Proper physical design makes them immune to the effects of weather and other environmental factors. In the past, the higher price for thermal technology limited their use in commercial applications, but as costs continue to fall, many organizations are now able to choose thermal cameras as the foundation for their outdoor detection applications. Geo-registration and detection accuracy Smart thermal cameras are designed to detect movement, but outdoors, everything moves. A smart camera must be able to tell the difference between small objects such as leaves or debris and a person entering a secured area. One of the best ways for a camera to make this determination is through ‘geo-registration’ which provides the actual location and true size of all pixels in the camera’s field of view. Consider how human vision works: Our eyes give us depth perception – we can tell which object is close and which is far. But a ‘one-eyed’ camera can’t, unless it’s geo-registered. For example, a small animal near the camera will look much larger than a man at 300 meters away. (Figure 1) A smart camera needs to ignore the animal at right while alerting on the distant person, even though the animal will cover more of the camera’s field of view. The same approach applies to blowing trash, clouds, and other moving things which are always present outdoors. With a camera that is geo-registered, such non-security related movement will be ignored and will not send alarms. Essentially, geo-registration enables a three-dimensional capability for a smart thermal camera. From this information, geospatial analytic rules can be used to eliminate movement based on size while still detecting human-sized intruders under all conditions. Geo-registered analytics in action: From-to Zones Motion zones are often used by video analytic systems to detect the movement of objects and to send an alert to notify security that an intruder has been detected. By default, any object moving within a motion zone triggers an alarm. However, when used for outdoor applications, motion zones can lead to an abundance of nuisance alerts because they lack the discriminating intelligence to recognize the difference between ‘unimportant’ movement caused by the natural environment and ‘relevant’ movement that represents a security threat. Cameras that are geo-registered can create more intelligent rules called From-To Zones, an important tool for reducing nuisance alerts while maintaining a high probability of detection. Targets detected in a From-To Zone will only trigger an alarm when a specifically sized object – such as a person – moves from one zone into another defined area of the camera’s field of view. Correspondingly, objects that are not detected coming from one zone into the other are ignored. From-To Zones are a very powerful method for reducing unwarranted alarms. Importantly, they can be configured to detect zones that are geo-registered to the ground. This means From-To Zones will only alarm when a person’s feet have been in the ‘From’ and then enter the ‘To’ area, while ignoring detections that only show a part of a person such as their head. This is particularly useful when the security area includes a fence, and you only want to detect pedestrians who have crossed over the perimeter into the security zone. To see how From-To Zones work in the real world, consider an application where you need to detect pedestrians approaching the perimeter, but are not concerned about people leaving the building. With From-To Zones, the camera will only trigger an alert when intruders move towards the facility – ignoring everyone else, and greatly reducing unnecessary alarms. For another example, consider a windy perimeter around an active construction site where trash blows around the scene. Inevitably, the trash will collect along the fence and grow in size…