What are the various counter- intelligence measures companies commonly use?

[Varsha Chitale]

In order to defend effectively, you must know how to attack

To quote the master strategist Sun Tzu again – “All warfare is based on deception. Hence, when we are able to attack, we must seem unable; when using our forces, we must appear inactive; when we are near, we must make the enemy believe we are far away; when far away, we must make him believe we are near”.

http://blog.valuenotes.biz/in-order-to-defend-effectively-you-must-...

[Pradhuman Singh]

As far as the Real Estate Industry is concerned, most of the boardroom discussions are to be carried out in a classified mode. Practising Information Security Management Systems (ISMS) standards is one of the areas to begin with. That ways, an organisation ensures that its information resources do not end up into the hands of individuals who are not authorised to use it.

 

[Varsha Chitale]

Thanks Pradhuman. Do tell us more about this. Is it a commonly used certification in your industry? What kind of companies typically seek this certification? What does it involve?

[Pradhuman Singh]

The certification that I had done was ISO27001 Certified ISMS Auditor sponsored by British Standards Institute and Amity University. The basic objective of the Auditor is, to protect the Information Assets and resources of an organisation by complying to certain 'Standards' and following a set of directives or guidelines called 'Code of Conduct'.

When an organisation is said to be ISO27001 certified, it implies that there is a certain degree of assurance its clients have that their sensitive information will be protected here. However, the funny part is, most real estate companies in India do not have such a policy in place.

The highest no. of organisations that are practising such standards are primarily in the BPOs and very recently KPOs for the simple reason that their International clients would seek a certain degree of compliance to information security standards, so as to guard against any catastrophe caused by leakage or misuse of sensitive information/data.

In order to get certified, a company approaches a certification/ authorisation body for eg British Standards Institute or the ISO, and thus put the measures in place. The whole process can take 6 months to an year and then an audit can be carried out. Post audit, the certification is provided.

This certification is like your ISO9001 which is a standard for quality. The standard for Information security is ISO27001. You may like to refer to the ISO site for more specific details.