Citizen confidence on his mobile device is crucial for businesses as well as governance

This panel discussion from India Digital Summit 2022 focuses on “Citizen confidence on his mobile device is crucial for businesses as well as governance” - exploring how to build trust and security in mobile devices for Indian citizens, particularly those using budget smartphones in lower-middle-class families.

Panelists

• Satyendra Varma: Head, Indian Citizens Assistance for Mobile Privacy and Security (iCAMPS) at IAMAI, moderator
• Colonel Sumit Monga: Head Government Affairs, Lenovo Group India and Asia Pacific
• Mr. P. Panini Prasad: Director, NCCS (National Center for Communication Security), Department of Telecommunications, Government of India
• Shubo Haldar: Co-founder and CISO, Appnox
• Anujan Shali: Head Trust and Safety, PhonePe
• Anant Shrivastava: Project Leader, Android Tamer and Android Security Researcher

Key Topics Discussed

India is Mobile First:

• Mobile security is cybersecurity in India
• Average citizen owns budget smartphone as family device
• Lower middle class, not proficient in English, mostly unaware of dangers
• Six vectors: network, device, OS, application, user actions, offline processes

Device Manufacturer Perspective (Lenovo):

• Easy availability, accessibility, affordability driving adoption
• 39% increase in usage due to COVID
• Always logged on scenario - threat surface increased
• Need KYC of devices, not just users

Government Perspective (NCCS):

• Developing security standards and testing/certification labs
• Telecom Security Assurance Requirements for mobile devices
• Seeking stakeholder input at nccs.gov

Fintech Perspective (PhonePe):

• Mobile has become primary identifier (Aadhaar, DigiLocker, bank accounts)
• AnyDesk/TeamViewer misuse for account takeover
• Loan apps accessing photos, contacts - harassment cases
• Two-sided attack: user privacy level and technical capabilities

Application Security (Appnox):

• 90% of top 50 US fintech apps have basic security problems
• Three-fourths of those vulnerabilities could have been fixed
• Once app in Play Store, lose control - updates depend on users
• Google has kill switch for malware but no magical update switch

Independent Researcher Perspective (Anant):

• All stakeholders need to work together for citizen confidence
• People exploiting applications’ intended functionalities and trust
• Citizens going on different trajectories - either giving data to everyone or being paranoid
• User should not be person making right calls - attacks should be prevented before user judgment needed

Moderator’s Concluding Framework:

• Six providers: telecom, hotspot, device OEM, OS/Play Store, app companies, online/offline services
• Within government: seven different organizations, six ministries
• Government informing and educating smartphone user is least intrusive and most cost effective
• Government project underway to collate and deliver security information to citizens via APIs

Key Insights:

• India is mobile-first country - mobile security is cybersecurity
• Average citizen uses budget smartphone as family device, not proficient in English, mostly unaware of dangers
• Six vectors: network, device, OS, application, user actions, offline processes
• Confidence requires trust in entire ecosystem
• Eight countries involved in one mobile phone, hundreds of component manufacturers
• Threat surface increased with multiple devices, always logged on scenario
• 90% of top 50 US fintech apps have basic security problems
• User should not be making right calls - attacks should be prevented before user judgment needed
• Government project underway to collate and deliver security information to citizens via APIs

Actionable Takeaways:

1. Mobile security is cybersecurity in mobile-first India
2. Need collaborative effort across all stakeholders
3. Device certification important - NCCS developing standards
4. App security critical - 90% of apps have basic security problems
5. App updates depend on users - major challenge
6. User should not be making security decisions - attacks should be prevented
7. Government project to deliver security information to citizens
8. Need multilingual, accessible information for citizens
9. Trust needs to be built across entire ecosystem
10. Rogue providers exist outside regulation - need to address