1. Information Security considerations for Outsourced ICT Services
Badru Ntege
Group CEO
NFT Consult

2. What is Outsourcing? Outsourcing - Why Outsource?
“the strategic use of outside resources to perform activities traditionally handled by internal staff and resources” Dave Griffiths
Why Outsource?
Provide services that are scalable, secure, and efficient, while improving overall service and reducing costs

3. international corporation of the future will need to consider security as more of a "customer service" and "profit protection" entity rather than a necessary evil. In the long run, should they fail to do so, they will lose the trust of their customer (who in the end) is the one who dictates their future
Ted Richardson wrote in his blog

4. Wickipedia
Security is the degree of protection to safeguard a nation, union of nations, persons or person against danger, damage, loss, and crime. Security as a form of protection are structures and processes that provide or improve security as a condition.

5. Business process outsourcing (BPO) or ITES is a subset of outsourcing that involves the contracting of the operations and responsibilities of specific business functions (or processes) to a third-party service provider

6. Components of Security
People
Systems
Technology

7. People & Trust in BPO The Four cores of Credibility (stephen MR Covey)
Integrity
Intent
Capability
Results

8. Trust Tax Low Trust Slows Down Your Success The Economic Formula…..
Review
Think of 911….airport security…..
Here are some of the key taxes SMRC identifies…..next
Low Trust Slows Down Your Success
Leading at the Speed of Trust
FranklinCovey 8 8

9. Trust Dividend High Trust Speeds up Your Success
If you turn that around and think of the formula for Trust Dividends…..if there is a high degree of trust for instance on a team……between you and them, between themselves….with little suspicion, clarity around who was doing what, accountability……things speed up….time drag minimizes, errors go down…..
A leader who delegates….speeds the process of, lowers costs of time, his/her time engaged in work someone else should be doing
Invvestigates levels of paperwork and streamlines, raises speed, lowers costs…..
So building a high trust culture allows you to……. Next
High Trust Speeds up Your Success
Leading at the Speed of Trust
FranklinCovey 9 9

10. People
It is critical that both the client and the service provider play a shared role in the selection of people.
An effort from both sides must also be made to build and inspire trust within the workforce
Remember in outsourcing we start and end with people.

11. Systems AND Technology

12. ITES-BPO Security Factors
Lack of meaningful sponsorship
Failed agreement on business processes
Lack of formal and disciplined project management
Project team turn-over of staff
Inability to identify and mitigate risks or remedy incidents
Excessive software customisation, with poor documentation
Insufficient training
User adoption factors
Project viewed as an “IT” project

13. A need for good security policy
You must also check your security policy.
A good security policy will be sound and rational.
should include a data classification that can distinguish between sensitive and common data.
The policy should also state clear standards and guidelines.
These guidelines should be finalized by the stakeholders, managers and employees of your organization

14. privacy and intellectual property policy
vendor must have sound intellectual property protection laws.
vendor will go by your privacy and intellectual property policies.
Make these clear with your vendor in simple language to avoid later misunderstandings

15. Protecting your data
use of database monitoring gateways and application layer fire walls before outsourcing.
These devices can help you enforce usage policies.
prevent privilege abuse and vulnerability exploitation.

16. The rule of least privilege
decide on a method to monitor material exceptions on your vendors and ensure the rule of least usage.
Most of all, do not provide access to all your records during the same time. Ensure that this is also monitored

17. Leak-Proof traffic
Make sure that your vendor monitors outbound Internet traffic
Monitor s for potential information leaks.

18. Security Trust Dividend or Tax
Vendor and client have to build trust with each other
Vendor must have credibility to perform
Vendor must inspire trust in his employees
A trust relationship between both vendor and client must exist

19. Thank You ----Any questions