What COVID-19 Means for the Data Breach Landscape?

A three-month analysis on the possible impact of COVID-19 on the data breach landscape has shed light on an increasing number of threat actors worrying cyber-security specialists.  The Verizon Business study reviewed 474 data breach incidents from March – June 2020 based on contributor data, publicly disclosed incidents and Verizon’s own observations drawn from its collective years of experience. It focuses on 36 confirmed data breaches which were identified as being related directly to the COVID-19 pandemic. 

“ In view of the COVID19 pandemic,  many large and small organisations have adopted new technologies such as software- as-a-service (SaaS) solutions, increased cloud-based storage and the use of third-party vendors in record time to continue to support their customers. While the  SaaS solutions mentioned above, or the cloud itself, are not inherently less secure, however the  concern arises from the fact that due to the conditions the pandemic has created, most organizations are adopting them in a hurried fashion, and they are often forced to do so while relying on fewer resources in terms of both personnel and revenue thereby multiplying the risk.. ” said Prashant Gupta, Head of Solutions, Verizon Business.  

The analysis has thrown up an increasing number of commonly seen threat actors, which include: 

Increase in Error -- The Verizon Business 2020 Data Breach Investigations Report (DBIR) outlined that almost a quarter of all breaches were due to human error and this trend continues during the pandemic. This is due in part to organizations operating with a reduced number of staff due to illness, redundancies and/or with staff who have limitations due to their remote status. At the same time, these organizations are often experiencing unusually heavy workloads with a much higher reliance on new and unfamiliar solutions that need to be deployed quickly. 

Stolen credential-related hacking -- The DBIR shows that over 80 percent of breaches within the hacking category are caused by stolen or brute­ forced credentials. During the pandemic, this is now being exacerbated by the large number of employees working from home and the maintaining external workstations for remote access, leaning on SaaS platforms. Business IT departments are being challenged to secure company assets on the corporate network while the majority of the workforce is out of the office. 

Phishing -- In order to utilize stolen credentials, an attacker must first be able to obtain them and phishing remains one of the most commonly used methods. Prior to COVID-19 the 2020 DBIR flagged that credential theft and social attacks such as phishing and business email compromises were at the root of the majority of breaches (over 67 percent) and this trend has continued. Specific terms in combination with "COVID" or "CORONAVIRUS," such as "masks," "test," "quarantine" and "vaccine” were found to be widely used within the time period. In March, a phishing simulation, conducted by a DBIR contributor, performed on approximately 16,000 people found that almost three times as many people not only clicked through a phishing link, but also provided their credentials to the simulated login page.  

“Businesses need to start taking far greater responsibility in protecting their technology infrastructure. From deploying more robust security protocols to ensuring timely data breach disclosure policies. Once you lose public confidence, gaining that credibility back can often be an uphill task”, said Dr Zaki Qureshy, Founding Father, Hyderabad Security Cluster. 

Verizon Business 2020 Data Breach Investigations Report 

The Verizon Business 2020 Data Breach Investigations Report, analysed 32,002 security incidents, of which 3,950 were confirmed breaches; almost double the 2,013 breaches analysed last year. These cases came from 81 global contributors from 81 countries including the Government of Telangana and the Hyderabad Security Cluster.  

Central Square Foundation and Omidyar Network India Release ‘State of the Sector Report on Private Schools’

Central Square Foundation, a non-profit organisation that works towards ensuring quality school education, and Omidyar Network India, an investment firm focussed on social impact, released the first-of-its-kind report today on the state of the private school sector in India. The report highlights the need to improve learning outcomes in private schools which educate nearly half of India’s school-going children.

The report is a comprehensive analysis of existing research and evidence on the sector. It suggests reforms to streamline the operations of private schools with a focus on improving student learning. It aims to be a ready reckoner for policymakers, academicians, researchers, philanthropists and educationists amongst other stakeholders associated with the sector.

About 70% children in urban centres and a quarter from rural households attend private schools. Over 50% students in 16 Indian states are enrolled in private schools. The increased enrollment can be attributed to the rising demand by aspirational parents. A large number of parents — about 70% — pay less than Rs. 1000 per month as school fees. The report finds that 73% of parents with children in private schools believe these schools provide a better learning environment. However, student performance in private schools is only marginally better than government schools after adjusting for disadvantages in student backgrounds. About 35% of rural private school students in Grade 5 are unable to read a basic Grade 2-level paragraph.

The report finds that parents lack the means to make informed decisions while choosing schools based on learning performance. Board Examinations, among the only few reliable and standardised metrics to assess learning, are held in the last few years of schooling making it difficult for parents to judge the quality of schools during the early years of education. Moreover, nearly 60% of the private schools across India do not go up to a Board Examination grade.

Amitabh Kant, CEO of NITI Aayog, released the report at a digital event and said, “An educated and literate India is not possible without the private sector working towards our nation building. We must pay attention to getting it right. We need to bring reforms using access, equity and quality as guiding factors. More importantly, we need to shift the focus from monitoring of inputs to monitoring of outcomes. Quality education has been this government’s priority and NITI Aayog is drafting a model regulatory act in consultation with all stakeholders. We believe we will see fruitful results based on the references and results underlined in this report."

Highlighting the fact that private schooling is not popular among the elite alone, Mr Ashish Dhawan, the Founder-Chairman of CSF, emphasised that many families from underprivileged households send their children to private schools as well. “Today the private school sector in India is the third-largest school system in the world. These numbers are mainly made up of parents from low- and middle-income backgrounds who believe their children will have better learning outcomes in private schools. It’s critical now to institute a system that will give parents assessment-based information based on key stage examinations at Grades 3, 5, and 8, as the NEP suggests. They can use this information to compare school quality and pick the best school for their child.”

And speaking about the creating a demand for quality education among parents, Roopa Kudva, Managing Director, Omidyar Network India, said, “We need to empower parents to make informed decisions based on learning quality when choosing a school. In the absence of meaningful information on how schools perform on learning, parents tend to give weightage to tangible parameters like school infrastructure or English as the medium of instruction. Philanthropy capital can play a vital role in setting the ground in three main areas: greater awareness building, increased transparency from the schools themselves and improving the quality of engagement between parents and the schools.”

About the Report Launch

Mohandas Pai, Chairman, Manipal Global Education delivered a special address and spoke about the need for bold reforms to improve the quality of education and help India’s children acquire 21st Century skills for gainful employment. Other key speakers included Baijayant Panda, National Vice President & spokesperson of BJP; and Gurcharan Das, author and former CEO of Procter & Gamble India.

The release of the report was followed by two panel discussions. The first session on ‘Never waste a crisis: re-engineering the private school sector post Covid-19’ witnessed Baijayant Panda; Gurcharan Das; Arun Bharat Ram, Chairman, SRF Limited; and Geeta Gandhi Kingdon, Chair of Education Economics and International Development at the Institute of Education discuss how learning can be incentivised for private schools. The session was moderated by Ashish Dhawan.

The second session on ‘The need for reforms in the private school sector: Voices from the ground’ saw a very engaging discussion on the impediments in running and scaling private schools between Prabhat Jain, Co-Founder, Pathways World Schools & Pathways Early Years; Kulbhushan Sharma, President of NISA, and President, Federation of Private Schools Association, Haryana; Bhuvana Anand, Director, Research at Centre for Civil Society; and Vikas Jhunjhunwala, Founder & CEO of Sunshine Schools. Dilip Thakore, Co-founder and Managing Editor of EducationWorld moderated the session.

State of the Sector Report on Private Schools in India: About the Report

The report highlights the importance of private schools in educating India’s children. It provides details on the size of the sector, deep-dives into the challenges and outlines potential reforms to ensure improved learning outcomes for students. Specifically, the report stresses on two key challenges that need to be addressed urgently:

Under-regulation of learning outcomes

73% of parents believe their children will receive a quality education and have better learning outcomes in private schools. However, in the absence of a standard metric to measure learning outcomes, it may be hard for them to judge how much their children are learning in school in absolute terms, or how good their school actually is in comparison to other schools in their neighbourhood that charge similar fees. Grade 10 and 12 board exam pass percentages, sometimes used as a school learning marker, do not cover 60% of India’s private schools which end at Grades 5 or 8. Subsequently, parents tend to choose schools based on proxies for learning like "English medium" or the "School Infrastructure".

The information gap that exists for parents also means that schools are less likely to invest in learning-focused, invisible improvements like teacher training and quality, and more likely to spend on things that are observable by parents but may not lead to much improvement in learning - like computer labs, or marketing that proclaims English medium instruction.

Over-regulation of inputs

The second barrier is the over-regulation of inputs and a lack of policy focus on learning. Input-focused regulations prescribing playgrounds, computer labs, teacher salaries, etc., tend to be contextually unfit for under-resourced low-fee schools which make day-to-day operations difficult for them. Extensive licensing requirements deter quality providers from entering the sector and limits competition. For instance, opening a private school in Delhi calls for 125 documents, and applications move through at least 155 steps within the Directorate of Education. The non-profit nature of the education sector also discourages high-quality providers from entering or scaling up. These regulations have a direct impact on the capacity of private schools to deliver high-quality education.

The report also dives into the five-pillar sectoral reforms that account for the above-mentioned challenges and can help improve learning outcomes:

Create a universal learning indicator to help parents compare learning performance across schools and make informed decisions

Develop a pragmatic accreditation framework that factors in constraints of low fee schools and state capacity to implement while focussing on learning outcomes and child safety                    

Establish an independent regulatory agency for the private school sector

Review non-profit mandate and existing fee regulations to attract investment and enable easy access to credit for schools

Strengthen RTE Section 12(1)(c) which mandates 25% reservations for underprivileged children to ensure more robust targeting and fee reimbursements

While the report focuses on private schools, many of the regulatory issues raised in the report are also relevant for the public education domain.

Check out the dirtiest web sites of summer 2009

Security vendor, Symantec has identified the "Dirtiest Web Sites of summer 2009", the 100 sites with the most threats detected by site ratings service Norton Safe Web as of August 2009. These sites represent the "worst of the worst" based on the number of threats.

While nearly 48 percent of the sites feature adult content, the remainder of the sites is dedicated to varying subject matters, like deer hunting, catering, legal services and buying electronics. Malware is the most common threat, followed by security risks and browser exploits. Even a simple visit to these sites without downloading or clicking on anything in particular can be risky. Some of the sites listed include, 17ebook.com, divineenterprises.net, magic4you.nu gardensrestaurantandcatering.com and fantasticfilms.ru.

The report states that there has been an increase in the number of online threats that are constantly evolving, as cybercriminals look for new ways to target money, identity and assets. Rowan Trollope, Senior Vice President, Consumer Business Unit, Symantec says, "Norton Safe Web provides visual ratings that let consumers know about potential risks before visiting a site. Armed with this information, consumers are empowered to make informed decisions about which sites to visit."

The average number of threats per malicious site rated by Norton Safe Web is 23. The average number of threats on the Dirtiest Web Sites list is a staggering 18,000 per site. In fact, 40 of the 100 dirtiest Web Sites have more than 20,000 threats per site. Nearly 75 percent of sites on the list have distributed malware for more than six months. Norton Safe Web crawls the Web and performs analysis of millions of sites, and benefits from a network of more than 20 million Norton Community Watch members that automatically submit suspicious URLs for analysis in real-time.

Agencies

GP test market expected to reach Rs 6,692.5 million by 2011

The growing trend of the telecom market has paved way for the general purpose (GP) test equipment industry. According to the analysis from the Growth Partnership Company, Frost and Sullivan, the Indian GP test equipment market has earned revenues over Rs 4,346.50 million in 2007 and is expected to reach Rs 6,692.5 million by 2011.

The GP test equipment market is employed for a wide range of products including the research and development (R&D), manufacturing to installation and maintenance (I&M). The cost advantages and availability of skilled professionals have transformed India into a R&D hub for various industries. A vast number of companies from the entire world are investing in the country, which is aiding the market of GP test equipment.

"As security concerns assume the limelight in the wake of the terror threats and security concerns facing the country, an enormous amount has been budgeted for defense spending, which includes communication technologies," says Deepa Doraiswamy, Frost & Sullivan Program Manager. "A decent proportion of the spending goes into procuring test equipment, which mostly includes general purpose (GP) test equipment, and this is expected to create good opportunities in the ensuing years for the GP test equipment market."

Further, the customer support and the brand equity have become the determining factors for the success of the GP test Equipment market. Most of the test vendors have allocated 10 to 15 percent of their revenues to R&D, which result in the emergence of multi-functional instruments that integrate the functions of diverse equipments into one, marking the end of stand-alone products.

Moreover, the expansion of communication networks across the country is facilitating the GP test equipment such as the spectrum analyzers and the network analyzers. With the increasing penetration of mobile phones into the rural zones, the demand for the GP testers is on rise.

However, there are some concerns associated with the GP market, which need to be addressed. "Continuous product improvement with new features demonstrating cutting-edge technology remains the challenging aspiration for GP test vendors to gain market share," says Doraiswamy. "They must fine tune their products and make feature additions and modifications to outpace competition. Participants must also cater to the demand for customized products, identifying the specific end user needs across all end user segments," she adds.

SiliconIndia

iGATE Pulls Out of Satyam Bidding Process

Fremont-based iGATE has decided not to go ahead with the bidding process for acquiring 51% stake in India's scam-tainted Satyam Computer Services (SATYAMCOMP), based on further analysis.

Talking to CXOtoday, Phaneesh Murthy, CEO of iGATE, said, "While there is no one particular reason, it's the totality of concerns like sliding revenues, unknown margins and large liabilities that made us pull out of the race."

Murthy said, "We know that there are customer exits happening at Satyam. While the value erosion and the extent of liabilities were a concern, it was the totality of concerns that influenced our decision."

The company had earlier announced its participation in the bidding process last week, competing against some of the large Indian investors.

However, our PE fund partner had no role or influence in our decision to pull out. We had prepared our own model of financials and in that model it was difficult to get a reasonable return for any investor, said Murthy.

Satyam has been struggling for survival since January 7, when its founder and former chairman, B. Ramalinga Raju, confessed to filling the company's balance sheets with $1 billion in fictitious assets and nonexistent cash.

March 20 was the deadline set by the government-appointed Satyam Board for bidders to respond to the request for proposals the IT firm had sent out on March 13.

Sources indicate that potential bidders are concerned about the lack of clarity about the financial status of Satyam, as well as the implications of the class action suits and other legal troubles that the company is facing.

CXOtoday