Policies and Procedures – Boon or Boondoggle
While fighting
for one of our latest legal case of unauthorised electronic banking
transaction, we found it hard to defend for a client against the banking
institution in the absence of proper policies and procedures in the company.
When we buy
insurance, do we think of it as an expense completely or do we also look at it
from a financial security perspective for us and our family. Expenses on
creating policies and procedures is similar to buying an insurance. Look at the
confidence and security provided by it while conducting business. Only then you
won’t find it a boondoggle. People think of it as an additional expenditure
since the results are not directly visible. You never know how many incidents
you have averted by following the proper procedures.
The business of
our client who was victim of cyber fraud, was running completely on trust (mere
trust)
- Employees were trusted not to disclose the confidential information
- There was a general presumption that the IT support team did its job diligently
- It was thought that the old employees would never breach the trust of the company
- There was no maker checker concept
- People thought they knew what incidents can happen at the most and how to react
- Information/guidelines were shared verbally, and no documentation was kept on record and so on.
But one fine
day, when the SIM card of the accountant stopped working, neither did he think
about reporting it to the cellular company via another mode of communication
nor he thought of communicating with the bank about the same. This resulted in
a loss of crores of rupees to the company.
Had the company
invested in creating security policies and procedures, distributed the same among
the employees and got their acknowledgement, the accountant would have known his
response to such/similar incidence. Also, some where it appears that the
internet banking password was compromised. Probably the accountant informed
someone (may be legitimately) due to his absence or some other reason and it
got leaked. Another possibility was that the computer systems being used were
compromised due to lack of proper security. Had there been policies in place for
internet banking operation, period system audit, yearly vulnerability
assessment and penetration testing, log management, periodical change of
passwords etc this situation could have been averted. Above list is too big to
provide in this write-up.
Our Cyber Legal experts at ANA Cyber Forensic Pvt.
Ltd. can provide you with a comprehensive security policies and procedures which
can be customised according to your business requirement. This can not only
help in defending a legal case but can also provide you with a direction and
avert you from fraud in case you are a prospective victim of cybercrime.
You may kindly contact us at kailash@anacyber.com or info@anacyber.com for any further queries