Naavi.org

E Mudhra consumer Services, a company associated with the certifying authority, E Mudhra, has announced launch of what it calls as an online banking security protocol. The product named “TRUSTFACTOR” is a combination of an authentication server solution, digital signature certificates, customized crypto-tokens and a secured process for issuance, The Company is also setting up certain dedicated centers which will provide a customer interface for issuance of digital certificates.

(See report here)

The initiative appears promising.

Naavi

In recent days the media has highlighted some statements from the Central Government about the need of 5 lakh Cyber Security professionals in India. In order to address the skill gaps in Cyber Security professionals  that India may require in the future, EC Council (International Council of E-Commerce Consultants), a provider of certifications and training on information security has launched a publicity drive  to market its services.  In association with its training partners in India, the US-based company is expecting to offer training to about 40,000 people on areas such as Ethical Hacking, Computer Hacking Forensics Investigation, Security Analysis and Penetration Testing.

EC Council has been in business in India for quite some time and has been focussing on its “Ethical Hacking” programs. While such programs are attractive to youngsters, it is necessary for Cyber Security professionals to be developed on a foundation of “Responsibility”. Merely training youngsters on skills of hacking would lead to development of a large number of potential problem elements.

It is essential for every “Ethical hacking” training programs to be peppered with a teaching of “Cyber Law” as well as fortified with a proper “background Checks”, “Post training monitoring” and behavioural training.

There is therefore an urgent need for proper supervision of all “Ethical Hacking” training programs.

It is not clear if the Department of IT, Government of India nor DSCI, the Nasscom initiative is addressing this issue before trying to create a Frankenstein.

A serious national debate is required to evaluate the outcome of this publicity blitz undertaken by E C Council whose press release is cleverly implying endorsement of INCERT and DSCI. (See this report of Business Standard).

Naavi

Ever since the Aadhar scheme was introduced, security specialists have been warning about the large scale problems that may be caused by loss of identity of individuals.

The UIDAI authroities have been going ahead with spending of public money and enrolling the individuals who report at the counters of the registration agents.  Fraudulent registration agents have been creating their own enrollments with false identities as was revealed some time back when an aadhar card was issued in the name of “Coriander” (“Kottambari soppu” in Kannada. s/o Palav. (See the story here). In the meantime the UIDAI Bill is yet to be passed and several cases are pending in different Courts challenging the scheme altogether.

In the meantime many State Governments have been forcing citizens to go for Aadhar and linking mandatory public services to the Aadhar registration.

UIDAI however has been as irresponsible and as arrogant as the UPA Government and has continued with the project unmindful of the risks it is hoisting on the country. There have been many instances of data losses reported from different States. Even the successful registrants are battling with the practice of UIDAI sending aadhar registration cards by ordinary post which are reportedly dumped in dust bins in some places.

Now a massive data loss of 14 lakh cards has also been reported from Andhra Pradesh due to reasons that can be attributed either to negligence of UIDAI or criminal activities. (Report available here)

The fact that such large scale Aadhar related mischief is reported from Andhra Pradesh where the terrorist organizations from Pakistan are operating sleeper cells indicate the possibility of an organized threat to national security arising out of the stolen identities.

The stolen data can be used to create Aadhar ID for terrorists with different photographs. The biometrics can be switched if required. Even if the current biometrics is retained, since most of the ID use centers are unlikely to check biometrics and accept the parameters of name and address available in the given aadhar number and accept it as satisfactory identification of a person, (Eg Banks), the 14 lakh lost identities can be used to create that many false identities. using this false identity other IDs such as PAN cards and driving licenses can be created by terrorists.

This means that the system has been completely compromised and India is under threat.

It is therefore time for the Government to think of scrapping the scheme before further damage is done.

Naavi