We already have a full-fledged Security Practice in India: Lushen Padayachi, British Telecom

By Sanjeeb Kumar Sahoo

In a conversation with Voice&Data, Lushen Padayachi, Head of Security Sales India, Middle East and Africa at British Telecom (BT) elaborates new emerging trend of people-centric security frameworks and the developments at BT Security.

Voice&Data: Taking cognizance of the recent WannaCry and Petya ransomware incidences, please tell us how does BT help organizations transform their security model from a reactive to a more proactive, predictive and risk-based cyber operating model?

Lushen Padayachi: WannaCry brought to the forefront many of the issues we, security professionals have been highlighting for considerable time. It is not the first global attack, but it is unique in its scope and the way it spreads. We at BT have effective network security monitoring system that enables us to catch problems before they escalate and adversely affect your business. Our real-time threat monitoring and correlation service enables us to monitor all devices across our network, to provide our customers with real-time alerts that halt attacks before they can cause serious damage.

Since the WannaCry ransomware outbreak started, we have been advising our customers to follow these four basic steps to stay secure:

1. Check that our customers have the patch applied and it is running correctly across their global IT estate.
2. Work closely with respective AV vendors and Microsoft to ensure that they have the latest virus protection available.
3. Discover whether they have been infected, limit the spread as far as possible then neutralise to avoid the malware detonating.
4. Isolate and roll-back. Contain the affected machines, clean them, then restore the data.

BT has always taken security as its priority and have followed the below to ensure that they are always one step ahead of any attack/virus. The fact that our network and BT as a company were not compromised during the attack is down to several factors:

• An organisation (from the board level down) that understands the importance of Cyber Security and the investment necessary to deal with the risks, combined with an agile governance structure that can take decisive action at the pace of the incident.
• Regular refresh and upgrade of our IT estate (including Windows XP), based on cyber risk assessments regarding the need and urgency.
• Centrally managed patching and control. We have total understanding of our assets and can manage it accordingly.
• A cohesive global response: within one hour of the malware becoming a global phenomenon we were utilising our Security Incident Management Process to understand how vulnerable we were and what additional action needed to be taken.
• Layered protection with up to date antivirus and better policies around email, which enabled us to be better prepared by blocking executables on the email proxy (reducing risk of phishing, which is likely the point of entry for this malware).
• Control and authentication of end point devices attaching to our networks, such as our corporate desktops and USB devices. And the encryption of data at rest.
• Connection to and partnering with a diverse array of industry & government bodies for sharing of intel and best practices.

Voice&Data: What do you think is the risk-taking appetite of Indian companies when it comes to such attacks?

Lushen Padayachi: Currently, in India, cyber security at most enterprises is not uniformly mature to perceive, prevent and respond to attacks such as WannaCry. While, during this attack, the central and the state governments did advise enterprises and individuals to apply patches to their Windows operating systems, it is high time that the organizations start working towards developing a national convention on cyber law and cyber security.

During this attack, more than 40,000 computers were affected, and India was one of the worst hit nations. If not controlled immediately, data related to critical networks across sectors like banking, telecom, power and aviation will always be in jeopardy.

Voice&Data: Do you think the new emerging trend of people-centric security frameworks will change the approach to security?

Lushen Padayachi: We are hopeful of this new emerging trend. We strongly believe that in the coming years, digital business adoption will compel organizations to implement People -centric security (PCS) strategies.

People-centric security (PCS) puts people right in the center, thereby moving away from a control-centric model. This approach helps in creating awareness among the workforce, thus enabling them to make informed security choices and decisions. It also brings in a feeling of accountability and responsibility among the employees. Such employees change the approach to security and turn out to be strong information security agents for their organizations.

Voice&Data: With cloud security gaining more importance, how is the role of the CIO changing in enterprises?

Lushen Padayachi: At BT, we have realized the ever-changing role of CIOs. Our report on ‘The digital CIO’, states that 72% of senior IT decision makers believe that the role of the CIO has become more central in the boardroom over the last two years. Demand for agility and flexibility is high and CIOs are being relied upon for their ability to straddle both traditional IT and the future innovation agenda.

The report also lays emphasis on the fact that digitalization is rapidly transforming businesses. CIOs are clear on the most disruptive technology trends – cloud, mobility and collaboration, and data. According to the report, a fifth of global organizations are already completely cloud-centric, and a further 46 percent have more than half their applications and infrastructure in the cloud. It also highlights that 76% of organizations across the world are working hard to adopt a multi-speed, or bimodal, approach to technology initiatives. This approach allows organizations to prioritize specific, progressive initiatives that deliver considerable benefits to businesses.

Voice&Data: At what level of technological maturity level India is at when it comes to security related in the cyber space? Do you think Government initiatives are helping in framing this?

Lushen Padayachi: While India is racing fast when it comes to the adoption of technological advancement, it needs to take cognizance of the fact that a cyber security policy is still the need of the hour. During the WannaCry ransomware attack the Government did issue directives on how to tackle such a virus and what can be the legal consequences to give into the demand, this is clearly not enough.

The need of this hour is to work together in collaboration with industry bodies to understand the perils of cyber security and what best policies can be implemented to make enterprises cyber safe.

Voice&Data: How do you identify security challenges of your clients, and design/ implement a cyber remediation program thereafter?

Lushen Padayachi: Business complexity is growing, dependencies are expanding, users are becoming more mobile, and the threats are evolving. New technology brings us great benefits, but it also means that our data and applications are now distributed across multiple locations, many of which are not within our organization’s infrastructure. In this complex, interconnected world, no enterprise can think of its security as a standalone problem. While many of the organizations have built a threat management solution and remediation tools and practice, they are not prepared to handle new and upcoming threats. Since threats are becoming more and more sophisticated, the best way to secure an environment is to define, monitor and control the ‘risks’ rather than threats.

BT being one of the leading communications providers across the globe, we need to ensure complete security of our own infrastructure and that of our global customers. We have evolved to better manage our Security Risks and also created best of class Global expertise and platform to provide Security as a Services to our customers.

We help our customers identify their Security Risks by providing state of the art Consulting and professional services. Our consultants work with the customer to assess the state of Risk management with respect to their assets, critical data and necessary controls. Once practical gaps are identified, we work with our customer to prepare a plan, which is more of a ‘Maturity Journey’. This journey encompasses Technologies, Skills and Processes required to enhance the security and improve the maturity of the organization to better manage the risks and events related to both information security and cyber security threats.

Voice&Data: In your opinion how Indian enterprises are harnessing Indian digital awareness and therefore its benefits?

Lushen Padayachi: In India, the awareness around digital technology and adoption of technology has seen an exponential increase in the recent past. This along with smartphone penetration coupled with availability of internet has helped in generating a significant amount of data. Indian companies particularly the early adopters/ learners have worked out a way to analyze the data, thereby creating trends from the information collected. These organizations are reaping the benefits of digital awareness. India is ready for a digital ecosystem, and the enterprises who join this movement will be the winners in the market place.

Voice&Data: What are your future plans for the security domain in India? Is there any acquisition in pipeline?

Lushen Padayachi: BT Security was launched in January 2013. We already have a full fledged Security Practice in India. We have our SoC (Security Operations Centre) and design / delivery teams in India supporting local and global customers. Security is an evolving practice and one has to be ahead of the threat Landscape to better protect & manage our customers. The key to successful Security services is efficient technologies, Skilled Resources and business aligned Processes and we are constantly investing in the same. To support our customers for Security Consulting, Security Service implementation and complete security operations (SoC / GSoC), some of the key areas we are investing are:

• Technical skills around SoC Contextual Analysis, AI / Machine Learning and Complex Cyber deployments.
• Better Collaborations with BT GSoCs, Partners and OEMs for Information sharing and Risk management.