Some economists (refer to Ajay Shah, ajayshah@igidr.ac.in) have pointed out that the Indian industry has a short-term focus. They have justified this focus as being natural in an environment where the cost of capital is high, thus forcing industrialists to look for short recovery periods for their investment. This makes us take to trading more easily than manufacturing, for instance.I cannot comment on the economic theory, but it is a fact that Indian industry has a short-term perspective. And like insurance, security systems are a low priority unless you have a long term perspective.
These are the real cultural issues due to which Indian organisations have poor information security systems and processes.
Flynn Remedios: While it is true that even abroad, most websites aren't secure, the commercial ones do have some levels of security. Secondly, since most Indian sites are hosted abroad, they are at the same security levels as their counterparts. However, intranets and corporate LANs (WANs etc) abroad do have reasonably good security. Many airlines and other big multinational corporates have implemented some kind of firewalling system that serves as a basic security barrier.
However, security is not just implementing a firewall. A comprehensive internet/Intranet security blanket would also include a set of processes, systems, and practices that have to be followed. It also includes security audits, risk management and analysis, a disaster recovery plan and lots more. It requires back up servers housed at different locations that can run even if one of them gets broken into. Unfortunately in India, Indian companies have not as yet begun to allocate resources for adequate network security. It is still not priority number one.
Kumud Goel: Security on computer systems and networks even in large organisations in India is very poor.
There are people who can hack VSNL or any other major server in India. We need a fiasco before people will wake up and organisations will spend money on security. Senior managers know nothing of the dangers and don't want to spend a dime. Remember it took a Bhopal Tragedy in this country for people to wake up to safety.
K Vaitheeswaran: I think the security levels in India are quite good. This is the power of the web where you cannot have significantly different levels across countries, since the whole web is one global network. Of course, the USA is ahead in this area by a year or so.
How much is the credit card option on the Web secure in India?
Vaitheeswaran: Credit cards transactions over the web need to be secure in three different ways. Firstly, the store must offer SSL (Secure Socket layer) links to ensure encryption and decryption.
This eliminates third party misuse. Secondly, the store must ask personal details beyond what is available on the card itself - this reduces the threat of someone stealing a card and using it over the web. Thirdly, the online merchants themselves must build up credibility and loyalty with the customers, by securing their internal systems and processes.
There are no payment gateways available. Some banks are working on this and we feel in a couple of months, online authorisation and verification of credit cards will be a reality in India.
Goel: Without trying to sound as if I am crying wolf; US and foreign laws have been effective where a credit card number is enough to get people to sell goods. In India this will not work.
Shuvam: This is made out to be bigger than it really is. The following steps are taken to reduce this risk, which many of your readers probably don't know about:
Some credit card companies are allowing you to set spending limits, thus reducing your exposure temporarily. This is being offered by ICICI Bank in India, I believe.All in all, I believe it is as risky to use a credit card in a restaurant as it is to use it on the Internet, given a little care. Some of the real risks of credit card fraud are not related to the Internet.
Flynn: I would view it as a major threat. Even those sites which use digital certificates, certification authorities etc including encryption or some other means of secure transaction are not completely immune to hackers.
It is a major risk and like all risk factors needs to be addressed. This does not mean that consumers should be scared into not transacting on the Net. Instead, online commerce sites should augment their security, including getting a security risk audit and analysis done. This could help minimise the risk factors.