Policies and Procedures – Boon or Boondoggle



While fighting for one of our latest legal case of unauthorised electronic banking transaction, we found it hard to defend for a client against the banking institution in the absence of proper policies and procedures in the company.
When we buy insurance, do we think of it as an expense completely or do we also look at it from a financial security perspective for us and our family. Expenses on creating policies and procedures is similar to buying an insurance. Look at the confidence and security provided by it while conducting business. Only then you won’t find it a boondoggle. People think of it as an additional expenditure since the results are not directly visible. You never know how many incidents you have averted by following the proper procedures.
The business of our client who was victim of cyber fraud, was running completely on trust (mere trust)

  • Employees were trusted not to disclose the confidential information
  • There was a general presumption that the IT support team did its job diligently
  • It was thought that the old employees would never breach the trust of the company
  • There was no maker checker concept
  •  People thought they knew what incidents can happen at the most and how to react
  • Information/guidelines were shared verbally, and no documentation was kept on record and so on.
But one fine day, when the SIM card of the accountant stopped working, neither did he think about reporting it to the cellular company via another mode of communication nor he thought of communicating with the bank about the same. This resulted in a loss of crores of rupees to the company.
Had the company invested in creating security policies and procedures, distributed the same among the employees and got their acknowledgement, the accountant would have known his response to such/similar incidence. Also, some where it appears that the internet banking password was compromised. Probably the accountant informed someone (may be legitimately) due to his absence or some other reason and it got leaked. Another possibility was that the computer systems being used were compromised due to lack of proper security. Had there been policies in place for internet banking operation, period system audit, yearly vulnerability assessment and penetration testing, log management, periodical change of passwords etc this situation could have been averted. Above list is too big to provide in this write-up.
Our Cyber Legal experts at ANA Cyber Forensic Pvt. Ltd. can provide you with a comprehensive security policies and procedures which can be customised according to your business requirement. This can not only help in defending a legal case but can also provide you with a direction and avert you from fraud in case you are a prospective victim of cybercrime.
You may kindly contact us at kailash@anacyber.com or info@anacyber.com for any further queries

Popular posts from this blog

Mrs. Kailash A. Nevagi

DIVORCE A WAY OF LIFE

Judicial Separation & Divorce: Major Differences