On April 28 India announced new IT directives that require verbose logging of almost all IT activities, report infosec incidents within six hours of detection, keeping records of customer IP addresses for clouds and VPNs and much more … with compliance required next Tuesday. Oh and Cert-IN is happy for you fax in reports of security incidents, which is deeply weird because the rationale is to give Indian authorities better intelligence about threats.
a great excuse to stop outsourcing 90% of my department to India.
They don’t get anything done anyway, all they do is make unapproved commits at 3am and break everything and then log off and wait for me to log on and fix it without even telling me shit is broken.
Honestly I was joking because I dont have to deal with that, but I could for real. Get a central log server. Graylog is probably the best cookie cutter setup that could get you going pretty quickly.
Does anyone actually care? I actually heard about this from SurfShark, a commercial VPN. They’re just shutting down their Indian servers, and somehow or other using servers elsewhere “with an Indian IP” whatever that means.
We tend to just let India do their own thing in my company.
Every year or two we get asked to implement telephony services in India but give up after two or three meetings due to the conplexity of the regulatory requirements and the fact the local offices dont want to actually pay for anything. Actually I am due to start this loop again soon. Who knows one day this project might make it beyond the planning phase.
If you sleep for 8 hours with notifs off, and get hacked in the first 2 hours of sleep, you are outside the 6 hour mandatory requirement and can go about your day.
Considering that Indian police have trouble enforcing already existing laws I don’t think this will affect anyone that doesn’t live in or work with India.
Hello police, if you look at these 4 computers by the entrance, this is a legitimate call center. Don’t look at the other 5 rows of 10 PC’s each, and the cash handoffs for payments, or our banking trail/s, don’t Google our organizations name, or…
Outsourcers are usually a separate company. They might have to provide logs, but I can’t imagine it would include logs belonging to their customers as well.
If it does, then I can see *MANY* big companies ending contracts with India quickly.
It’s not even a matter of disliking the rules. It would violate things like HIPAA and PII laws. It would mean no longer being able to ensure your own business privacy or customer privacy.
Pray to IT Jesus for me. My entire server team is being outsourced to India (Accenture) I’m a nervous wreck. I watch too many India scam call videos and my faith is low.