NATIONAL CYBER SECURITY POLICY : DRAFT

1.    Finally we are working on a national cyber policy....infact late but ...IT'S NEVER TOO LATE....the thing that we have started on this is a good sign.The draft of the subject policy is available at www.mit.gov.in/sites/upload_files/dit/files/ncsp_060411.pdf and is in fact inviting comments in case u have any!!!

2.   The draft is a 21 page report.After going through the same I have given the following points at the desired email address available in the draft report.

PARA 3.3 (I) C
GOVERNMENT SECURED INTRANET :
Addition point :

“ In addition to the emphasis on creation of such kind of intranet, efforts at the design stage should be made to exclude all possible options of internet connectivity with this intranet to avoid any kind of imminent threats. This intranet may need internet for various updates etc ,but this should be a privilege access point and no node should be allowed a free access. Any attempts to connect the same may invite action as a threat to nation. The limited internet connectivity to this is required for the following purpose :

- It is the most common action by any user to browse the net. Once given a opportunity he/she is always eager to access emails and download malware or infected software or any third party application. This is the point where command and control centre of a Botnet can be established by a cyber criminal. To avoid such practices it would always be the endeavor of the designer and the super administrator to ensure physical separation of Intranet and Internet. This Intranet should also be subject to regular cyber /IT audits by govt recognized penetration testers and forensic experts to maintain a cyber secure working environment.

PARA 3.3(D) @ Page 12
OPEN STANDARDS

The strength and power of open standards and applications remains unexploited in our country. Other developed nations who have realized the potential of this standard are already contributing significantly to their positive growth in cyber space. This has largely been possible owing to the lack of exposure of such standards by the new generation who is only exposed to the windows environment. Policy should be in place to ensure growth of open standards at school level curriculum.

PARA 3.5.2
COMBATING HIGH TECH CRIME/CYBER CRIME

Though the cat and mouse race between the good and the bad cyber guy would remain on always,it is worth noting that cyber crime if not controlled at such a nascent stage of induction and growth, has the full potential to become a cyber threat.No single policy would be able to achieve a CYBER CRIME FREE CYBER SPACE.It remains the onus of the common man how he tackles the cime himself.It is here that the National Cyber Policy can contribute in the following manner :

- Cyber Huntsville is a collaborative cyber community with the aim of attracting and developing the brightest minds, attacking the most complex problems, and providing the best solutions of national and international significance. Cyber Huntsville is an integral part of the National Cyber Initiative. Similar establishments should be encouraged at India level. More info at http://www.hsvcity.com/cyber/

4.2.3
Thrust areas of R&D  : 

-  Thrust areas of R&D should majorly focus on inducing maximum SRS and QRs at the DESIGN STAGE. Because, if not done at this stage, whatever work follows is patch work that remains a cover up action.
- Analysis of data flow in a network
- Pentration testing
- Storage solutions with backup, archiving, recovery provisioning of entire data.

5.1.1
ENABLING PEOPLE

Promoting a comprehensive national awareness program to include organizing seminars, events, webinars, guest lecture’s in tie up with established societies like IETE,Institution of  Engineers, Computer Society of India etc

Besides,these points I would suggest to include ensuring information security by managing the flow of information to the citizens as well as on securing its physical information infrastructure.The policy should call for the following :

- Popularize e- government
- Optimize the cyber industry structure.
- Provide a rugged 24x7 nationwide cyber infrastructure.
- Promote innovation of cyber technologies.
- Build a cyber oriented national economy.
- Design way to advanced internet culture.

Green Dam Youth Escort : What's that?

1. The title suggests that it has got something to do with college unions doing thier bit contribution in saving some water or fighting over some water dam issue.But its nothing like that.It is the name of a firewall which is a first of its kind official government imposed content-control software developed in the People's Republic of China (PRC). Under a directive from the Ministry of Industry and Information Technology (MIIT) , it is mandatory to have either the software, or its setup files accompanied on a compact disc or pre-installed on all new personal computers sold in mainland China, including those imported from abroad. 

2. The firewall software is to be made a mandatory pre-requisite for new computers sold in the country, as a meaure to help stamp out pornography and other vile elements on the Web. The move thus has been widely criticised by industry groups and officials as rash, politically intrusive, technically ineffective and commercially unfair.Few of the features of the software are enumerated below :

• Designed to work with Microsoft Windows operating systems,the software is specifically aimed at restricting online pornography but could be used for other purposes.
• Green Dam Youth Escort automatically downloads the latest updates of a list of prohibited sites from an online database, and also collects private user data. 
• Green Dam recognizes pornographic images by analyzing skin-coloured regions, complemented by human face recognition. The software is incapable of recognizing pictures of nudity featuring black- or red-skinned characters but sensitive enough to images with large patches of yellow that it censors promotional images of the film Garfield: A Tail of Two Kitties. 
• The software's misrecognition of "inappropriate contents" in applications including Microsoft Word can lead it to forcefully close those applications without notifying the user, and so cause data losses.
• The software runs only on Microsoft Windows x86, so Microsoft Windows x86-64, Mac and Linux users are ignored. Even on Microsoft Windows, the software is known to interfere with Internet Explorer and Google Chrome, and is incompatible with Mozilla Firefox.
• Some computers sold in China already come with parental-control software, but it isn't government-mandated.
  

3. The latest good news for the chinese people is that for the time being the compulory shipping and installation by the user has been put on hold.

4. Thanks http://www.circleid.com and off course wiki like always!!!!