Offshore and Cyber Security

The ‘Offshore’ IT ser­vices mar­ket has grown extra­or­di­nar­ily fast in the global mar­ket in the past few years. Since the 1980’s, off­shore out­sourc­ing has become a major facet of the busi­ness world. An increas­ing num­ber of orga­ni­za­tions have turned to off­shore out­sourc­ing of appli­ca­tion devel­op­ment and main­te­nance as a means to reduce the cost of infor­ma­tion technology.

Definition: Offshore IT out­sourc­ing is the prac­tice of sub-​​contracting to a third-​​party com­pany the per­for­mance of cer­tain appli­ca­tion devel­op­ment, main­te­nance and sup­port func­tion to a coun­try other than the one where the pri­mary orga­ni­za­tion resides.

In a report issued by Datamonitor, the cur­rent mar­ket is esti­mated at more than $10 bil­lion USD annu­ally. Some indus­try ana­lyst esti­mate world­wide spend­ing on IT ser­vices deliv­ered by off­shore com­pa­nies will exceed $75 bil­lion USD within three to five years.

According to Gartner, the lead­ing off­shore out­sourc­ing coun­tries by region are listed below.

Americas: Argentina, Brazil, Canada, Chile, Costa Rica, Mexico and Uruguay

Asia/​Pacific: Australia, China, India, Malaysia, New Zealand, Pakistan, the Philippines, Singapore, Sri Lanka and Vietnam

Europe, the Middle East and Africa: The Czech Republic, Hungary, Ireland, Israel, Northern Ireland, Poland, Romania, Russia, Slovakia, South Africa, Spain, Turkey and Ukraine

Large orga­ni­za­tions see this as a huge oppor­tu­nity for costs sav­ings. Many experts view IT off­shore out­sourc­ing as a poten­tial threat to the domes­tic job mar­ket in the tech­ni­cal world and have asked the gov­ern­ment for pro­tec­tive mea­sures or at least closer scrutiny of exist­ing trade prac­tices. There is another threat that IT off­shore out­sourc­ing poses, the threat of covert espi­onage, back­doors and remotely acces­si­ble exploits.

Security and pri­vacy con­cerns are now the biggest issue for com­pa­nies con­sid­er­ing out­sourc­ing their IT projects to com­pa­nies off­shore. These con­cerns included, but are not lim­ited to — fraud, back­doors, data theft, extor­tion and espi­onage and are the major com­po­nents of off­shore secu­rity risks that are now a major area of con­cern for out­sourcers and our national secu­rity alike. Moreover, the unau­tho­rized use of pro­pri­etary tech­nol­ogy is another facet of secu­rity con­cern. Most clients and out­sourcers come together to inte­grate safe­guards into their sys­tems. New laws are being enacted reg­u­larly with regards to IT secu­rity and data theft. These laws have given some degree of pro­tec­tion to out­sourc­ing soft­ware devel­op­ment. Many orga­ni­za­tions find com­fort now that these laws have been enacted. That being said, secu­rity loop­holes exist and are addressed when they are iden­ti­fied. Not only that, but in the world of cyber con­flict, ter­ror­ists, extrem­ist groups, hack­ers in gen­eral and rogue nation states do not make a habit of fol­low­ing the law.

In a ran­dom sur­vey of tech­nol­ogy pro­fes­sion­als with a com­bined 250+ years of expe­ri­ence, the fol­low­ing insight was gleaned.

1. The cur­rent approach to code reviews, walk-​​thrus, test­ing, val­i­da­tion and accep­tance reviews of soft­ware devel­op­ment that was out­sourced would be extremely unlikely to detect the exis­tence of back doors, trap doors or any other type of exploit.

2. The detailed test­ing, code review and walk-​​thrus required for a high degree of con­fi­dence that no mali­cious code has been embed­ded within the application

Below are the major influ­enc­ing fac­tors that came up dur­ing the data col­lec­tion discussion.

1.Organizations that out­source appli­ca­tion devel­op­ment have lit­tle if any con­trol or over­sight of the per­son­nel assigned and work­ing on the soft­ware development.

2. The size and com­plex­ity of cur­rent appli­ca­tions do not allow code reviews and analy­sis to a gran­u­lar level that would ensure there are no back-​​doors or exploits.

3. The cur­rent state of auto­mated test­ing and val­i­da­tion tools has very lim­ited capa­bil­i­ties for detect­ing back-​​doors or exploits.

Below are some inter­est­ing facts and fig­ures that were dis­cov­ered dur­ing this analysis.

Fact: The soft­ware and ser­vices rev­enues of India are expected to hit $50 bil­lion USD by the end of 2008

Fact: The three most com­mon off­shore out­sourc­ing func­tions are soft­ware devel­op­ment, soft­ware main­te­nance and help desk support.

Given the cur­rent cyber threat envi­ron­ment, extra secu­rity mea­sures must be taken to pro­tect the infor­ma­tion infra­struc­ture of the nation, our gov­ern­ment and our cor­po­ra­tions. Failure to take such mea­sures and address this threat results in a huge risk and lia­bil­ity. According to Ed Maggio, Professor of Criminal Justice at the New York Institute of Technology and an Advisor to Spy-​​Ops, “Organizations can out­source the work, but they can­not out­source their lia­bil­ity to ensure the integrity of the soft­ware pro­duced.” Even with the added secu­rity test­ing and val­i­da­tion, you can­not be 100% sure the deliv­ered soft­ware con­tains no mali­cious code.

So the only ques­tion that remains is, given the added cost of secu­rity test­ing and val­i­da­tion cou­pled with the remain­ing risk of unde­tected mali­cious code, do you really save any­thing by using off­shore out­sourc­ing for soft­ware devel­op­ment? Finally, for those skep­tics out there, to think that our ene­mies have not thought of and may have actu­ally placed covert assets in major devel­op­ment cen­ters around the globe is short sighted and endan­gers our national secu­rity and the eco­nomic health and pros­per­ity of our coun­try and businesses.

– Kevin Coleman

October 6th, 2008 | Cyber-warfare | 410610 Comments »http://defensetech.org/2008/10/06/offshore-and-cyber-security/Offshore+and+Cyber+Security2008-10-06+12%3A59%3A15Ward You can skip to the end and leave a response. Pinging is currently not allowed.