How secure is your outsourced operations

From http://www.offshoringtimes.com/

Steadily, more and more enterprises are exploring the outsourcing strategy, primarily to increase profitability by cutting costs. However, this seemingly attractive strategy comes with certain inbuilt risks, which if not complemented with a mitigation strategy does create uncertainty for success in long run.

The key question that all organisations, especially the banking and insurance industry, face is: How will the secure information be guided tightly preventing any free flow, leading to any misuse?

Information security raises concerns of:

• Privacy;
• Internal misuse of information;
• Intellectual property right infringement;
• Regulatory compliance;
• Industrial espionage, and.
• IT security concerns of virus attack, etc.

One of the earliest matters of internal abuse came to light in 1995, where a system administrator at a bank in the United States hacked the banks user-IDs and passwords to set up accounts with the leading banks involving transfer of millions of dollars.

In light of such frauds, the US came up with regulations -- Sarbanes-Oxley Act of 2002, Gramm Leach Bliley Act, US Patriot Act, Bank Secrecy Act, HIPAA, Computer Fraud and Abuse Act, Computer Security Act, etc -- to ensure safety.

Ensuring effective security methods require a combination of integrity, availability, and confidentiality along with a robust compliance framework and monitoring system. It needs consistent enforcement with reasonable oversight, awareness and continuous training on the part of the management.

Information security is a journey not a destination. Compliance policies and procedures are the foundation of effective information security posture.

You are as strong as your weakest link

The global sourcing model in a single process leverages the efficiencies across companies, geographies, and workforce to deliver the optimum results in cost and quality. With the increase in risks associated with the complexity of the delivery model - and the process involves giving access to vital IP assets -- security is a major concern.

The success of secure information dissemination within these units lies with the offshore management structure. The processes followed should be mature and well documented and should have strict adherence that can be verified through surprise audits.

Leading outsourcing companies providing services to financial organisations are getting reviewed and audited by OCC and OTS (US federal agencies for regulation and supervision of banks). This is a major step to ensure that outsourced operations follow policies and procedures of clients and behave as an extended arm of the companys operations.

Page 1, Page 2