R ECOMMENDATION F OR SRI LANKAN ICT POLICY (T RUST A ND S ECURITY )

Why Trust & Security ?

We need trust & security because IT an emerging industry in Sri Lanka Tackles different industries & markets Enables participation in digital & financial space at individual level Cradle to grave digital identity Data floating everywhere and still expanding Responsibility ???

Recommendations  Formulate an information security policy for the Government, as well as public and private institutions which handle public records  A secure centralized, online storage system to store documents  Use of a two-step authentication process, using a one-time password (OTP) when performing online transactions

Recommendation 1  In a government department which delivers a very important service  An attack of ‘CME-24’ aka W32.BlackMal.E worm CERT Case Study: “The Worm – Episode 1”

Recommendation 1  Forthcoming regulations to formulate an information security policy for government, public and private institutions who handles public records  ISO code of practice for Information Security control may be used in formulating the policy

Recommendation 2 A secure centralized, online storage system to store documents User (accessible with Public Key) +File 1 – Private Key 1 +File 2 – Private Key 2 +File 3 – Private Key 3 +File 4 – Private Key 4 Government Data (R) Personal Data (R/W) +File 1 – Private Key 5 +File 2 – Private Key 6 +File 3 – Private Key 7 +File 4 – Private Key 8 +File 5 – Private Key 9 Institutions (accessible with Public Key)

Recommendation 2  All documents are watermarked  Government data is digitally signed (verifiable) and read only  Private keys are specific to clients and have expiry  And additional code or symbol will be added when a client pull the document corresponding to the given private key  Government has no direct access to the private folder

Recommendation 3 Compulsory two-step authentication for online transactions The CID has reported that banks holding NRFC account have suffered losses of over Rs. 1 Billion due to illegal withdrawals from fake accounts. Sunday Times, 28 th June 2015 All banks registered under the Central Bank Monetary Control System, should use a two step authentication process when carrying out the online transactions.

A Discussion Does telecom operators expose the CDR information to 3 rd parties for commercial purposes?

Q UESTIONS ?