Specify and enforcing

security policy
Security policy is the foundation of information
security in an organization. As with any
foundation, it must be well developed,
enforced and complied with to improve the
security of information, from both inside and
outside the organization. Compliance with the
security policy is not an easy task as it
involves translating the written policy into
actions. It requires careful planning and
participations of all the related parties.
vulnerabilities inherent in the code of a
Web-application itself (irrespective of
the technologies in which it is
implemented or the security of the Webserver/back-end database on which it is
built).
In the last few months, vulnerabilities
have been exploited with serious
consequences: Hackers have tricked ecommerce sites into shipping goods for
no charge, usernames and passwords
have been harvested, and confidential

information (such as addresses and

credit-card numbers) has been leaked.
In this paper, we investigate new tools
and techniques which address the
problem of application-level Web
security. We 1) describe a scalable
structuring mechanism facilitating the
abstraction of security policies from
large Web-applications developed in
heterogeneous multiplatform
environments;
2) present a set of tools which assist
programmers in developing secure
applications which are resilient to a wide
range of common attacks; and 3) report
results and experience arising from our
implementation of these techniques.
India had no Cyber security policy before
2013. In 2013, The Hindu newspaper, citing
documents leaked
by NSA whistleblower Edward Snowden, has
alleged that much of the NSA surveillance was
focused on India's domestic politics and its
strategic and commercial interests. This leads
to spark furor among people. Under pressure,
Government unveiled a National Cyber
Security Policy 2013 on 2 July 2013.

Mission[edit]
To protect information and information
infrastructure in cyberspace, build capabilities
to prevent and respond to cyber threat, reduce
vulnerabilities and minimize damage from
cyber incidents through a combination of
institutional structures, people, processes,
technology and cooperation
In india
National Cyber Security Policy is
a proposed law by Department of Electronics
and Information Technology (DeitY), Ministry
of Communication and Information
Technology, Government of India. which is
due to be passed by parliament, aimed at
protecting the public and private infrastructure
from cyber attacks.[1] The policy also intends to
safeguard "information, such as personal
information (of web users), financial and
banking information and sovereign data". This
was particularly relevant in the wake of US
National Security Agency (NSA) leaks that
suggested the US government agencies are
spying on Indian users, who have no legal or
technical safeguards against it. Ministry of
Communications and Information Technology
(India) defines Cyberspace is a complex
environment consisting of interactions

between people, software services supported

by worldwide distribution of information and
communication technology.
Objective
Ministry of Communications and Information
Technology (India) define objectives as
follows:

To create a secure cyber ecosystem in the

country, generate adequate trust and
confidence in IT system and transactions in
cyberspace and thereby enhance adoption
of IT in all sectors of the economy.

To create an assurance framework for

design of security policies and promotion
and enabling actions for compliance to
global security standards and best practices
by way of conformity assessment (Product,
process, technology & people).

To strengthen the Regulatory Framework for

ensuring a SECURE CYBERSPACE
ECOSYSTEM.

To enhance and create National and

Sectoral level 24X7 mechanism for obtaining
strategic information regarding threats to
ICT infrastructure, creating scenarios for
response, resolution and crisis management

through effective predictive, preventive,

protective response and recovery actions.

To improve visibility of integrity of ICT

products and services by establishing
infrastructure for testing & validation of
security of such product.

To create workforce for 5,00,000

professionals skilled in next 5 years through
capacity building skill development and
training.

To provide fiscal benefit to businesses for

adoption of standard security practices and
processes.

To enable Protection of information while in

process, handling, storage & transit so as to
safeguard privacy of citizen's data and
reducing economic losses due to cyber
crime or data theft.

To enable effective prevention, investigation

and prosecution of cybercrime and
enhancement of law enforcement
capabilities through appropriate legislative
intervention.
Strategies[edit]

Creating a secure Ecosystem.

Creating an assurance framework.

Encouraging Open Standards.

Strengthening The regulatory Framework.
Creating mechanism for Security Threats
Early Warning, Vulnerability management
and response to security threat.
Securing E-Governance services.
Protection and resilience of Critical
Information Infrastructure.
Promotion of Research and Development in
cyber security.
Reducing supply chain risks
Human Resource Development (fostering
education and training programs both in
formal and informal sectors to support
Nation's cyber security needs and build
capacity.
Creating cyber security awareness.
Developing effective Public Private
Partnership.
To develop bilateral and multilateral
relationship in the area of cyber security with
other country. (Information sharing and
cooperation)
Prioritized approach for implementation.
Operationalisation of Policy

Shortcomings[edit]
(1) The declared cyber security policy has
proved to be a paper work alone with no actual
implementation till date.[4]
(2) The cyber security trends and
developments in India 2013 (Pdf) provided by
Perry4Laws Techno Legal Base (PTLB) has
listed the shortcomings of Indian cyber
security policy in general and Indian cyber
security initiatives in particular.[5]
(3) Indian cyber security policy has failed to
protect civil liberties of Indians including
privacy rights.[6]
(4) Civil liberties protection in cyberspace has
been blatantly ignored by Indian government
and e-surveillance projects have been kept
intact by the Narendra Modi government.[7]
(5) The offensive and defensive cyber security
capabilities of India are still missing.[8]
(6) India is considered to be a sitting duck in
cyberspace and cyber security field and the
proposed cyber security policy has failed to
change this position.[9]
In short, India is not at all cyber
prepared [10] despite the contrary claims and
declared achievements and the cyber security
policy is just another policy document with no
actual implementation and impact.