Latest - securitylinkindia

Security Considerations for Code Signing

MassMediaLink India LLP SecurityLink IndiaMarch 4, 2018November 14, 2024035 mins

Recent security-related incidents indicate the need for a secure software supply chain to protect software products (also referred to as code) during the development, build, distribution, and maintenance phases. Of particular concern is provisioning and updating software that plays a critical role in platform security. A wide range of software products including firmware, operating systems, mobile applications, and application container images must be distributed and updated in a secure and automatic way to prevent forgery and tampering. An effective and common method of protecting software is to apply a digital signature to the code. Digitally signing code provides both data integrity to prove that the code was not modified, and source authentication to identify who was in control of the code at the time it was signed. When the recipient verifies the signature, he is assured that the code came from the source that signed it, and that it has not been modified in transit. “NIST plans to develop further guidance to help organizations evaluating, deploying or managing code signing systems. The high-level recommendations described in this document are expected to form the basis for more detailed recommended practices for code signing” This white paper targets software developers and product vendors who are implementing a code signing system or reviewing the security of an existing system, with the goal of achieving improved security and customer confidence in code authenticity and integrity. System integrators and administrators who are concerned about the trustworthiness of the applications that are installed and run on their systems will learn the properties they should expect from a code signing solution to protect their software supply chain. This white paper describes features and architectural relationships of typical code signing solutions that are widely deployed today. It defines code signing use cases and identifies some security problems that can arise when applying code signing solutions to those use cases. Finally, it provides recommendations for avoiding those problems, and resources for more information. Properly applied, these recommendations will help to ensure that the software supply chain is resistant to attack. NIST plans to develop further guidance to help organizations evaluating, deploying or managing code signing systems. The high-level recommendations described in this document are expected to form the basis for more detailed recommended practices for code signing. The basics of code signing This section provides high-level technical details about how this process works. There are multiple roles in the process: developer, signer and verifier. Developer The developer is the entity responsible for writing, building, and/ or submitting the code that will be signed. This entity maintains a secure development environment, including the source code repository, and will submit code to the signer after it has completed the organization’s software development and testing processes. Signer The signer is the entity responsible for managing the keys used to sign software. This role may be performed by the same organization that developed or built the software, or by an independent party in a position to vouch for the source of the code. The signer generates the code signing private/ public key pair on a device that is sufficiently protected, as the security of this process relies upon the protection of the private key. In many cases, the signer then provides the public key to a certification authority (CA) through a certificate signing request. The CA will confirm the signer’s identity and provides a signed certificate that ties the signer to the provided public key. Anyone can use the public key associated with this certificate to validate the authenticity and integrity of code signed with this key pair. If no CA is used, the public key must instead be distributed using a trusted, out-of-band mechanism. The signer ensures through technical and procedural controls that only authorized code is signed. When code is submitted by developers for signing, the signer verifies their identities and their authority to request a signature. The signer may also take additional steps to verify the code is trustworthy. Ultimately, two or more trusted agents of the code signing system may be needed to approve the request and generate a digital signature. In some cases, the signed code may also be provided to a time stamp authority to indicate when the code was signed. Verifier The verifier is responsible for validating signatures on signed code. The verifier may be a software component provided by the same developer as the signed code (e.g., for a signed firmware update), or it may be a shared component provided by the platform (e.g., the operating system). Architectural components The code signing architecture is composed of a set of logical components that are responsible for different aspects of the code signing process. The code signing/ verifying architecture represented in Figure 1 potentially has four distinct components: the code signing system (CSS), the certification authority (CA), the time stamp authority (TSA), and the verifier(s). Code signing system (CSS) The first component, the CSS, receives code submitted for signing, authenticates and authorizes the submitter, and generates the signature. To generate these signatures the CSS has one or more private signing keys, which need to be carefully protected from extraction or unauthorized use. Certification authority (CA) Typically, a CSS utilizes a CA to enable authenticating the identities of signers. CAs issue certificates to signers in accordance with certificate policies, which specify the security controls and practices the CA follows when issuing certificates, and impose requirements on the subjects of the certificates. NIST Interagency Report 7924 is a reference certificate policy that specifies most of the requirements for a CA that issues code signing certificates. There are also industry groups such as the CA/ Browser Forum and the CA Security Council, that have published requirements documents for the issuance of code signing certificates. Time stamp authority (TSA) Some code signing architectures use a TSA to demonstrate when a particular piece of code was signed. When a TSA is used, signatures are sent to the TSA which applies its own signature and signing time to the package….

Traditional Switch Port Security

MassMediaLink India LLP SecurityLink IndiaMarch 3, 2018November 14, 2024012 mins

With Cybersecurity becoming an increasingly important factor in designing modern Ethernet networks, ComNet have launched an industry first edge security feature that is both simple, secure and easy to configure and use. The ComNet exclusive Port Guardian feature has the capability to physically disable a port if unauthorized access is detected. The value in Port Guardian comes in situations where network intrusion is attempted by disconnecting an IP addressable device at the edge to connect to the network. When Port Guardian senses this disconnect, an SNMP notification is sent to the head end and the affected port is physically locked out, preventing access. The network administrator can re-enable the port once the threat is eliminated. This feature also thwarts access through ‘Spoofing’ by disabling the port as soon as an interruption is sensed. Layer 2 managed switches can typically implement port security which consists of checking incoming packets for a matching MAC address. If a packet with a valid MAC address is received on a particular port then the switch will allow that packet to pass through the switching fabric of the switch as normal. If a packet with an invalid MAC source address is received on the switch port then that packet is dropped by the switch and is not allowed to proceed any further and therefore, this provides a basic level of security as only traffic from the user defined MAC address is allowed on that port. With this method it is therefore possible to easily implement basic port security against a potential intruder from removing the original device and replacing it with a device designed for network intrusion or from cutting the cable that went to the original device and connecting this cable to their own network intrusion device to gain access to the network. This level of protection is common amongst most layer 2 managed switches on the market today and indeed all ComNet managed switches support this capability as standard. This feature is referred to by many names including (but not limited to) the following: Port locking. MAC locking. Port security. MAC filtering. What’s wrong with traditional switch port security? The issue with the traditional Layer 2 MAC filtering/ locking as previously described is that it can be defeated with relative ease in a matter of minutes by using readily available software which can artificially alter the MAC address of the sender to match whatever the potential intruder wants. In the example below the intruder will alter the MAC address of their laptop to use the same MAC address of the authorised camera and gain access to the network. How would the intruder know what MAC to spoof? So how would a potential intruder know the MAC address of the camera (in this example) in order to be able to spoof that address from their laptop and gain network access? This could be done in several ways but one simple way could be to use a low cost network tap device so the camera is briefly unplugged and then connected to the tap and then quickly re-connected to the network again. The operator would see video loss for some seconds but would unlikely put this down to a potential intruder if it was even noticed at all. How does port guardian prevent such intrusions? At the basic level Port Guardian works as a layer 1 protection system so the actual data being sent on the port is not important and the switch does not need to know anything about it. Port Guardian constantly monitors the enabled ports and as soon as it detects that a cable has been unplugged or there is a link down event that port will be immediately disabled and the network administrator notified via an SNMP alert (and optionally by a local contact relay if supported on the particular switch model) to the potential intrusion. What happens after Port Guardian locks out a port? Once Port Guardian has been triggered on a certain port then that port is in a permanent lock out condition and will appear to be dead to the potential intruder (no LEDs or anything will work on that port). The port will remain in this lock out condition even if the original legitimate device is re-connected. The lock out state can only be cleared by the network administrator through one of 4 possible methods as outlined below SNMP reset command issued. Reset via Web GUI. Port Guardian reset command issued from the local USB serial port CLI. A contact input is closed (only available on models that have contact inputs). The contact input method is user configurable and is not enabled by default. What about cycling power to the switch? This is another user configurable option. The port lock out states can be set to clear on a power cycle or they can be set to go into lock out condition in the event of a power cycle (this would be the most secure option). So how can Port Guardian be used in networks? There are really two distinct ways to use the Port Guardian feature and the correct implementation depends on how secure the location is where your remote ComNet edge switch (with Port Guardian feature) is located. An outline description and visual example of both scenarios follows. Edge switch in secure location scenario I f the ComNet edge field switch is installed within a secure location then there is no concern about an intruder gaining access to the physical switch itself so one could enable Port Guardian just on the ports where he has edge devices connected that are physically located outside of the secure location and not enable Port Guardian on the uplink port(s) which are part of the secure network. In this scenario one could also set the option to have a power cycle clear any locked out ports as again he would not be as concerned with a potential intruder being able to power cycle the switch itself. Edge switch in…

Synology Strengthening NAS Portfolio in India

MassMediaLink India LLP SecurityLink IndiaMarch 2, 2018November 14, 202404 mins

Synology® the global leading provider of network attached storage (NAS), IP surveillance and network equipment solutions, forays into India market with the rollout of its cutting-edge series of NAS solutions in the country. With a proven history of transforming the way users manage data, perform surveillance, and manage the network in the cloud age, Synology has set new benchmarks in the enterprise IT space, leveraging latest technologies and unprecedented innovation coupled with an exceptional customer service. The company has announced strategic partnerships with both online as well as offline channels to make its solutions available in the country. Synology’s offline distributors in India include Supertron, EBM, while Amazon will serve as the company’s online retailer. Four complete product lines of industry-leading NAS that are designed to meet different requirements and needs from personal users, small offices, SMBs, and enterprises (including XS/XS+ series; Plus series; Value series and J series) provided by the company are now available in India. The company will also be unveiling the latest DiskStation Manager 6.2 (DSM6.2) OS update along with new applications and services in the country soon. The company has registered a historic 30 percent CAGR growth in India since the year 2015 with SMBs contributing to a major chunk of this growth. Synology will also ink new partnerships in the country in the year 2018 along with organizing reseller events and trade shows as well as studying consumer behavior to ensure last mile market presence in the ongoing year. Synology creates network attached storage, IP surveillance solutions, and network equipment that transform the way users manage data, conduct surveillance, and manage network in the cloud era. By taking full advantage of the latest technologies, Synology aims to help users centralize data storage and backup, share files on-the-go, implement professional surveillance solutions, and manage network in reliable and affordable ways. Synology is committed to delivering products with forward-thinking features and the best in class customer services. “India is aggressively marking its presence as a growth engine in the global economy, owing to an unparalleled growth in the SMB segment as well as ambitious government initiatives like Smart City Programme. We at Synology are committed to aiding this growth in the country with our industry-leading NAS solutions which help organizations gain more agility and streamline their work processes” – Mike Chen Marketing Director, Synology

Banker’s Legal Guide to Deal with Phishing Scams and Cyber Crimes in India

MassMediaLink India LLP SecurityLink IndiaFebruary 9, 2018November 14, 2024014 mins

Online banking has revolutionized banking transactions whereby money could be transferred at a single click. It has been a time saver and has been an extremely convenient method to undertake commercial transactions. However, it has led to litigations against banks as well, as with online banking also come phishing emails. Phishing emails in these cases are those which purport to have been sent by the bank with the look and feel of a legitimate email. They ask the user to enter their username and password to reconfirm their accounts, with invariabe threats that if the confirmation is not made, the account would be frozen immediately. In many cases these emails are spoofed also whereby a third party sends an email using the email id of the bank, but that can be easily identified by reading the complete header of the email. Many users panic on receiving such emails and immediately give out their personal sensitive data like banking passwords to third parties purporting to be representing the bank. They realize that they have been duped only when money is withdrawn by such third parties from their bank accounts. There has been a slew of litigation against banks whereby the victims of phishing scams file complaints against the banks under the Information Technology Act, 2000. The grounds on which such complaints are filed attracts Section 43, Section 43A and Section 72A of the Information Technology Act. Section 43 deals with unauthorised access, and the complainant in most of the cases alleges violation of Section 43A which is for accessing or securing access to a computer, computer system or computer network without permission of the owner or the person in charge. However, banks have a very strong legal defence to this cause because the unauthorised access is done by a third party and not by the bank. The banks on receipt of any information from an online banking services user that his account has been wrongfully debited, must ask him if he responded to any email asking for his password, and also asks him to submit documentary proof of that email to the bank. If the user admits that he has replied to such phishing email, the bank requires him to submit a letter to the bank to that effect in order to enable the bank to freeze his account, whereby further unauthorised money transfer from his account could be stopped. The bank should intimate the user by an official letter to file a complaint with the cyber crime cell, and the bank should also file an FIR against the beneficiary account holders in whose accounts the money has been unauthorisedly credited. This is important to prove the proactive efforts of the bank in a litigation by a victim against the bank under the Information Technology Act. Section 72A of the Information Technology Act for punishment for disclosure of information in breach of lawful contract reads as under: Save as otherwise provided in this Act or any other law for the time being in force, any person including an intermediary who, while providing services under the terms of lawful contract, has secured access to any material containing personal information about another person, with the intent to cause or knowing that he is likely to cause wrongful loss or wrongful gain discloses, without the consent of the person concerned, or in breach of a lawful contract, such material to any other person shall be punished with imprisonment for a term which may extend to three years, or with a fine which may extend to five lakh rupees, or with both.” The main contention of the complainant would be that the bank has access to his password and misused it. However, as per RBI norms all banks have 128 bit encryption of passwords and the bank does not have any access to the same. The complainants in most cases attempt to bring the bank within the definition of an ‘Intermediary’ under the Information Technology Act; however, the exceptions to intermediary liability under Section 79 of the Information Technology Act, 2000, apply to a bank in this case because of the following reasons: The function of the bank is limited to providing access to a communication system over which information made available by third parties is transmitted or temporarily stored. The bank does not- i) initiate the transmission, ii) select the receiver of the transmission, and iii) select or modify the information contained in the transmission The bank observes due diligence while discharging his duties under this Act and also observes such other guidelines as the Central Government may prescribe in this behalf. The banks are required to maintain ISO 27001 standards because they handle confidential and sensitive personal data of users of their services. In brief, the banks need to undertake the following steps in order to be able to succeed in any litigation against them: They should provide a handbook to the online banking services users at the time they apply for such services. The handbook should mention directions for safe use of online banking and should also contain complete information about phishing emails and scams, including information on how users can protect themselves from such phishing attacks. The online banking services application should have an Indemnity clause, whereby the user indemnifies the bank. The terms and conditions of online banking should contain Indemnity clauses with respect to password of the user, online transactions and use of bank’s services. There should be a security tips page which warns users of phishing emails each time they log in for online banking. Customers/ users should be proactively informed about all the Cyber threats. There should be Cyber security and Cyber law compliance panel. This panel should comprise of cyber security experts who should ensure that proper cyber security measures are always in place and the cyber lawyer in the panel should ensure that the online banking user agreement clauses are up-to-date to restrict the bank’s liability in an environment where new cyber crimes get…

Biometrics at the ATM

MassMediaLink India LLP SecurityLink IndiaFebruary 6, 2018November 14, 2024010 mins

In the quest to secure our identity in an increasingly connected digital world, biometrics is flourishing throughout the globe. According to a TechSci Research report, India’s biometrics market is projected to grow at a CAGR of around 31% during 2016 – 2021. Government, banking & finance, energy & power, and consumer electronics are the key end user segments where deployment of biometric systems is witnessing an increase, and this trend is expected to continue over the next five years. In many banking services markets, biometrics is successfully authenticating millions of users at the ATM while improving the user experience, increasing transaction security and delivering trust in transactions. Accelerated adoption of biometric authentication at the ATM and related banking solutions (such as securing government pension payments, teller transactions and the opening of new accounts) are in large measure because biometrics is the only authentication method that ‘binds’ a user’s digital credentials to a person – a critical capability for eliminating digital identity theft in an environment that has become increasingly complex and vulnerable to security threats. Increasing security can create barriers to legitimate access, but biometrics bring security and convenience together, simplifying authentication while making it more robust and reliable. The technology has now advanced to the point that today’s fingerprint sensors can distinguish between legitimate and counterfeit biometric characteristics, a capability known as liveness detection. Another innovation allows the deployment of intelligent encryption-enabled and tamper-resistant fingerprint devices that further strengthen secure authentication and protect user privacy. Biometrics authentication will only grow in importance moving forward. We live in an environment where each of us has a growing list of digital identities for an expanding set of applications, stored on a variety of ID cards, tokens, smartphones and other mobile smart devices. Again, biometrics has the unique ability to bind this multitude of digital identities to an individual’s single, true identity. The challenge is how to verify this true identity in a manner that is private, secure and non-intrusive. Biometric authentication solves this challenge, creating a more satisfying and convenient user experience while ensuring that transactions are trusted and secure. The challenge of authentication at the ATM Worldwide, ATMs generally require that users validate their identity with something they have such as a card, and something they know such as a PIN. This has been in practice for decades, but is increasingly vulnerable to fraud; the more digital credentials and identities we store on ID cards, tokens and smart devices, the worse the problem turns into. According to the Norton Cyber Security Insights Report 2016, 49% of India’s online population, or more than 115 million Indians, are affected by cybercrime at some point with the country ranking second in terms of highest number of victims. Only biometrics can securely bind these digital identities to the actual person with whom they are associated. Plus, every new digital identity is just one more element to manage, and one more threat to someone’s one, true identity. In the last three years, public sector banks (PSBs) in India have lost a total of INR 22,743 crore, on account of various banking frauds. Banks are tackling the fraud problem with approaches like EMV cards. But only biometrics can confirm ‘who’ is actually transacting, and whether that person is a legitimate bank customer or a fraudster. To do this while protecting privacy and combating identity fraud, the biometric solution must use liveness detection to distinguish live fingerprints from fakes while ensuring that ATMs aren’t difficult to use. Biometrics binds a unique individual to his or her true identity, and determines ‘who’ is actually using the system, while eliminating the hassle and security risks of PINs and passwords. Biometrics also eliminates the need to carry or remember anything, allowing access and transactions with the touch of a finger. It is the only true means of making security more convenient while also linking or binding digital identities to the individual. Moving forward, using biometrics to authenticate mobile payments and other bank transactions will likely become a very big market driver. As Gartner predicted, by 2016, 30% of all organizations would be using biometrics on mobile devices and has long upheld the conviction that biometric solutions are the must-have for enterprise mobile authentication. With applications like Apple Pay and initiatives from the FIDO Alliance and others, biometric authentication is becoming more prominent in consumer-facing applications. Meanwhile, with new technology adoption comes new risks: as biometric applications become increasingly widespread, and are relied upon for securing personal transactions, deployed solutions are likely to be targeted for attack. Consequently, it will be increasingly important for those deploying biometric authentication to understand that not all biometric devices and solutions are created equal. For example, many ATMs are outdoor; in that case the biometric device at the ATM should be able to obtain high quality image under the conditions that are common in ATM environment such as dry, humid, ambient light, with large population and wide demographics. Considering major challenges such as high quality image acquisition, fake finger attacks, man in middle/ replay attacks, a thorough evaluation of biometric technology in target environment with target population is strongly recommended. ATM transactions must be convenient, and all identities used to conduct them must be protected. Banks must balance and even combine security and convenience as they manage risk, and biometric authentication makes this possible. It enables us to protect our one true identity in a way that is balanced, reasonable and efficient. Nothing in life is without risk but there are no longer valid technical or business reasons to rely on outdated security systems and practices. With biometrics, we can securely and conveniently use a myriad of digital credentials, knowing that our true identity is protected. We don’t have to forfeit security for convenience or vice-versa – we get both. Sujan Parthasaradhi Director of Biometric Applications, APAC, HID Global

FSIE 2018 : Brings the Entire Fire Safety & Security Industry to Bengaluru

MassMediaLink India LLP SecurityLink IndiaFebruary 5, 2018November 14, 202407 mins

The second edition of the leading trade event for fire safety and security – Fire and Security India Expo (FSIE) is to be held at Bangalore International Exhibition Centre (BIEC) in Bengaluru during 22-24 February 2018. The fair will witness over 150 leading brands displaying their technological advancements, and products and solutions catering to the wide demand of the industry. With over 10,500 square metre of exhibition space, FSIE 2018 will have live product demonstrations along with conferences and workshops addressing key topics related to fire safety and security. Buyer-seller meetings, trade delegations are some of the other concurrent events to be a part of the expo. The Finest India Skills & Talent (FIST Awards) 2018 in the field of fire safety and security will recognise the achievements of the most innovative, reliable and cost-effective products, services and solutions spanning a wide range of fields across the fire safety and security industries. The three-day trade fair will be a part of the Build Fair Alliance, a consortium of co-located events that are proposed to be conducted at the same venue coinciding with FSIE, thereby ensuring maximum number of footfalls from stakeholders of building automation and construction industry. This year the event will be co-located alongside ACREX India – leading exhibition on HVAC technology, and ISH 2018 – leading exhibition showcasing plumbing systems. The alliance of the three events together is expected to attract over 50,000 business visitors during the three days. In India, awareness about fire safety and security has grown exponentially. It has intensified over the last decade as a direct result of the country’s economic evolution. As IT and retail markets rapidly expand coupled with an increase in setting up large commercial factories, the stakes in terms of assets, investments and resources are too huge to be put at fire and security risk. Continuing to drive the demand for fire safety and security is also the government’s focus on infrastructure development, especially with initiatives like the Smart City Mission. Pankaj Dharkar, President, Fire and Security Association of India shares, “Fire & Security Association of India (FSAI) and NuernbergMesse India joined hands together to organise the Fire & Security India Expo earlier last year, and this is the second edition of the annual trade event. The event is poised to attract the largest gathering of trade professionals witnessing product demonstrations and latest innovations by the leading brands participating at FSIE 2018 from world over.” By being the wide platform forum that it is, FSIE will bring to the fire safety and security industry, a uniquely concentrated market overview of integrated solutions for fire protection and security, especially those that intelligently combine innovation and technology. As part of exhibits, installations and discussions, the latest technology in fire safety & security will be on display during the expo, along with their uses, advantages and ways of deployment. This will empower decision-makers with first-hand information, as well as open the stakeholders’ eyes to new possibilities. Sajid Desai, CEO, NuernbergMesse India shares, “The second edition of Fire & Security India Expo (FSIE) is a multi-dimensional platform that combines solutions for passive, active and organisational fire safety and security management. Here, official experts, architects and developers, MEP consultants, OEMs, security experts, building engineers, members of leading security and fire prevention bodies as well as fire safety & security representatives from retail, hospitality, healthcare, real estate, facility management, IT-ITEs industry and other stakeholders will gather to disseminate information, gather knowledge, exchange ideas, exhibit, debate innovative perspectives, solutions and products for fire safety and security.” Leading players including IDEX Corporation, A.D.N. Fire Safety Pvt Ltd, Advanced International, Apollo Fire Detectors Ltd, Arihant Fire Protection Services Pvt. Ltd., Bharti Fire Engineers, Coopro Safety India Pvt Ltd, DDS Limited, FFE Ltd, IDEX India Pvt Ltd, Lubi Industries LLP, Naffco India Pvt Ltd, New Age Firefighting Co Ltd, Nohmi Bosai (India) Pvt Ltd, NSC Sicherheitstechnik GmbH, Prama Hikvision (India) Pvt. Ltd., Rapidrop India Pvt Ltd, Ravel Electronics Pvt. Ltd., Safex Fire Services Ltd, Securiton AG, Shah Bhogilal Jethalal & Bros, Topaz Fire Systems Pvt Ltd, Winco Valves Pvt Ltd among many others are ensuring that the event is the standalone platform for business excellence in the fire safety & security domain. “The Indian fire and safety equipment market is expected to reach USD 4.94 billion by 2019. With the increased growth of the economy coupled with the government rules and regulations, the future of the Indian fire safety & security market is very bright.” – Pankaj Dharkar

Videonetics Partners with Kolkata Traffic Police To Celebrate Road Safety Week 2018

MassMediaLink India LLP SecurityLink IndiaFebruary 4, 2018November 14, 202402 mins

Videonetics, one of the world-leading visual computing platform development companies, partnered with Kolkata Traffic Police by showcasing its complete suite of intelligent traffic management system (ITMS) at the exhibition held from 10th to 12th January 2018 at Kolkata, in celebration of Road Safety Week 2018. The exhibition was organized with an aim to propagate Kolkata Police’s mission of ‘Safe Drive & Save Life.’ The exhibition was well attended by Sr. Police Officials, engineering and technology firms, road engineering, traffic management experts and urban planners from all over India, Bangladesh, Nepal, and other SAARC countries. Videonetics ITMS comprises automatic number plate recognition (ANPR), red light violation detection (RLVD), no helmet detection, overspeed detection, no parking detection, wrong way detection, traffic congestion detection and automated e-challan system. “As our country’s mission is to build safe & smart cities and creating safer environment for all, we at Videonetics have been innovating state-of-the-art technologies to meet challenging requirements of traffic management, aiming to deter traffic violations, reduce accidents and provide road safety to all. We congratulate Kolkata Traffic Police for the tremendous success of the exhibition which successfully brought all stakeholders under one common platform and helped create much needed public awareness towards road safety,” expressed, Avinash Trivedi, VP at Videonetics.

Allied Telesis Non-Stop Network for Netmagic

MassMediaLink India LLP SecurityLink IndiaFebruary 3, 2018November 14, 202406 mins

Netmagic Solutions Pvt. Ltd., an NTT Communications Group company, is a leading data-center and Cloud service provider in India, which has grown to support the increasing requirement for always-on access to online digital data, video surveillance and other cloud-based services. Netmagic has 7 world-class data-centres situated in major business districts in Mumbai, Bangalore, Delhi and Chennai, with more than 10,000 servers and other communication devices to manage. They support the data storage requirements of over 2,000 enterprise customers spanning a wide range of industries including banking and financial services, e-commerce, healthcare, manufacturing, hospitality, education and more. Challenge Netmagic uses a combination of self-developed open-source tools to provide advanced data storage and management services to its customers, and needs a highly-available, scalable and dynamic IT infrastructure. So when the company decided to renew its datacenter networks in Bangalore and Mumbai, only a feature-rich, cutting-edge solution could do. The data-centers in Bangalore and Mumbai, named Bangalore3 and Mumbai5 respectively, required major network redesigns. Netmagic had three major requirements for the winning proposal. The network had to be non-stop because data centers operate 24 hours a day, 365 days a year; second, the chosen products are capable of processing large amounts of IP CCTV data for security and surveillance, building management and access control; and lastly, Netmagic wanted the total solution from a single vendor who could provide the design of the new networks, industry-leading products, and top-notch support for the installation and commissioning of the new networks. Netmagic appointed NK Jain and Epsilon Design for physical security consultancy. After careful consideration of proposals from several network vendors, Netmagic selected a complete Allied Telesis network solution. Solution Allied Telesis designed highly-reliable data-center networks and installed feature-rich products to create a resilient solution that Netmagic needed. x510 series stackable Gigabit switches are installed in both networks’ core and distribution layers of Bangalore3 and Mumbai5 Data-centers. These switches provide powerful resiliency, security and management features in a compact and highly-reliable package. The x510 switches are deployed in pairs using Allied Telesis Virtual Chassis Stacking (VCStack™), allowing them to function as a single virtual device, providing load balancing and redundancy. Using VCStack in both the networks’ core and distribution layers provides Netmagic with a high-performing solution with the capacity to support large amounts of IP CCTV data that is processed and stored in their data-centers. The x510 switches also have dual power supplies for high reliability. Coupled with the resilient network design, the new solution guarantees always-on access to online information. Several Netmagic support engineers are now certified by Allied Telesis, and manage the ongoing needs of the datacenter networks. Success The network renewal was smoothly completed without any trouble, and has been operating without issue ever since. The new network was constructed in managed phases, and was carried out with hands-on technical support from Allied Telesis every step of the way. The new data-center networks support Netmagic in supplying world-class data and CCTV storage, as well as Cloud-based services to their many valued customers, 24 hours a day, every day. “We needed a totally redundant, non-stop network capable of processing large amounts of IP CCTV data. We also wanted a complete solution that included both network design and products. Allied Telesis provided excellent support during installation, and we were very happy with both the service and solution we received ” – Mahesh Kumar Patil Assistant General Manager, Netmagic Solutions Pvt. Ltd.

Technology Laws & Cyber Security Essentials in New Age India

MassMediaLink India LLP SecurityLink IndiaJanuary 10, 2018November 14, 2024018 mins

Technology laws exist in India since 2000; however, with the advent of smart phones, and with wide internet penetration, the awareness and development of these laws have gradually increased. When I started practicing in cyber laws, smart phones were very new in India – a very few people owned them. But we have seen how during the last decade, society has changed and adapted to the technology, and also how technologies are being misused for committing frauds, thefts and other crimes. Over a few years, there has been an exponential rise in cyber-crimes – about 300% in the last one year in India alone. Today, there is a digital element everywhere. We find cyber-crime all around us, in various forms. Hacking, data theft, unauthorized access and cyber pornography are the most happening crimes. Besides, Internet has become a medium to commit conventional crimes such as theft, fraud and adultery. For example, most matrimonial offenses in divorce cases lie in the whatsapp chats, facebook posts and e-mails, which contain the evidence of adultery and cruelty. Online matrimonial portals have become the playground for fraudsters which are out to dupe gullible people seeking life partners. Social engineering is another way of phishing and vishing scams. I believe, almost every reader of this article must by now have received one or the other phishing/ vishing email with the subject ‘a beautiful woman is seeking a partner’ or an e-mail ‘proclaiming you have inherited a fortune,’ or a call ‘asking you to reset your debit card PIN number’ – all these clearly show how criminals have evolved from pick pocketing to committing credit/ debit card frauds and ATM skimming. Information Technology Act The Information Technology Act, 2000 (also known as ITA-2000, or the IT Act) is the primary law in India dealing with the cybercrime and electronic commerce. A brief outline of some of the provisions of the Act as amended in 2008 read with the Rules thereunder are elucidated hereunder. Section 66A This section was the one of the most controversial ones. It came in the limelight because under this section, arrests could be made for anything that caused annoyance or menace to another on the internet. It was struck off by the Supreme Court as the terms ‘menace’ and ‘annoyance’ are ambiguous and there can be no standard to define what is menacing or annoying for every individual in society. Section 43A This Section of the Information Technology Act imposes a liability of upto INR 5 crores on a body corporate who fails to secure the sensitive personal data of any individual which would include clients, employees and any other third parties whose data is stored by them. This is a very huge penalty and no other law in India imposes such a high penalty. There is a clear distinction between sensitive personal data and information (SPDI) and personal information (PI). SPDI includes, but is not limited to biometric information, sexual orientation, credit/ debit card data, and bank account details and passwords; whereas personal information (PI) includes any information which can be used to identify an individual like age, name, telephone number, address etc. The Intermediary Guidelines of 2011 render for an intermediary liable for failure to protect both SPDI and PI. Indian law is clearly very comprehensive that covers PI as well, unlike the laws of many countries which offer protection to SPDI only. There are provisions for penalizing for theft where any person receives or and retains a stolen computer device including smart phones (Section 66B); for identity theft where one uses the identity of someone else on the internet (66C); and for cyber impersonation where one impersonates as someone else on Internet (66D), including offenders who make fake social media profiles. Section 67, 67A and 67B deal with Cyber Pornography that do not render online pornography illegal. Creating and distributing pornography online is an offence however, downloading the same for private viewing is not an offence, with an exception of child pornography where even downloading is an offence. Duty of companies (Section 72A) Companies have a duty to protect the data of their clients and users especially if the same is contractually agreed. In case of failure, they are penalized under Section 72A of the Act. The Act defines an ‘Intermediary’ as any person who on behalf of another person stores or transmits a message or provides any service with respect to that message. This definition includes telecom service providers, internet service providers, web-hosting service providers, search engines, online-payment sites, online auction sites, online market places and cyber cafes. Section 79 of the Act is very crucial and provides respite to Intermediaries to some extent from an absolute liability. The requirement for liability under this section is the receipt of actual knowledge of offence by Intermediary and has been combined with a notice and take down duty. There is a time limit of 36 hours to respond to such a request and if an intermediary refuses to do so, it can be dragged to the court as a co-accused. These safe harbour provisions are available under the Amendment Act of 2008 only to an intermediary whose function is limited to giving access to a communication network over which information, made available by the third party, is transmitted or temporarily stored or where the intermediary does not initiate the transmission, does not select the receiver of the transmission and does not select or modify the information contained in the transmission. Authorities under the Act Cases of violations of the Information Technology Act are filed before the Adjudicating Officer appointed under this Act – one for each State. Appeals from the orders passed by Adjudicating Officer are filed before the Cyber Appellate Tribunal in New Delhi. The Court of the Adjudicating Officer is bound by the Rules of the Civil Procedure Code. An appeal from the Order of the Cyber Appellate Tribunal lies before the High Court, and appeals from all matters of the High Court lie before the Supreme…

Unraveling the Dynamics – Does AI Complicate or Simplify Cybersecurity?

Category: Latest