As a CISO and Head, Cybersecurity, Sudhansu M Nayak specialises and spearheads enterprise cybersecurity (IT/ OT), cloud, and data transformation solutions. He advises CxOs and Executive Boards on cyber risks and techno-operational mitigation, data privacy and protection, and compliance and governance.
CMS IT Services is a leading System Integrator and Managed Services provider. It offers an integrated portfolio of products, solutions, services, built around Artificial Intelligence, Automation, Cloud, Cybersecurity & Digital. Currently, CMS IT Services has over 6500 employees serves more than 300 leading enterprises across key industries. Started in 1976, CMS IT Services has been growing in its value chain. Specially after its demerger in 2015 the company has focussed on two technology service areas i.e., technology managed services, cybersecurity services, automation services, application management and services, and systems integration services.
Enterprise IT World spoke to Sudhansu Nayak, Head Cybersecurity & Cyber Forensics, CMS IT Services to understand its niche in the cybersecurity services.
As per Sudhansu CMS IT Services is committed to providing its clients with cybersecurity solutions that adapt to their growing needs of cyber protection. Its Enterprise Security portfolio is fuelled by the vision to address the challenges of today and tomorrow and is based upon a framework called the Defensible Cyber Security Framework. The Defensible Cybersecurity Framework encompasses three solution portfolios of Protect, Detect, and Respond. Their state-of-the-art Integrated Cybersecurity Command Centre (i3C) committed to supporting enterprises.
“We want to become one of the top-most cyber security firms in India and hence, it is all-hands-on- deck. Therefore, I am more focussed on client-side now.”
Sudhansu Nayak, Head Cybersecurity & Cyber Forensics, CMS IT Services
The Protect portfolio designs and creates strong defences in identities, at the endpoints, on the edge, in computing infrastructure and systems, using traditional and next-generation techniques. The Detect portfolio determines security breaches in real-time and manages malware, unpatched systems, and identifies cybersecurity risks. The Respond portfolio helps enterprises to address cybersecurity threats through streamlined cybersecurity command and automated procedures.
Sudhansu who looks after both internal security and customer delivery, says, “We want to become one of the top-most cyber security firms in India and hence, it is all-hands-on- deck. Therefore, I am more focussed on client-side now.”
The company has an internal lean data-centre and shared services delivery centres at Mumbai and Bangalore. CMS IT Services operates in more than 220 locations in India and there is high focus on maintaining client and internal data security.
With over 6500 employees serving more than 300 leading enterprises across key industries is not a small thing – specially, when the attackers deploy sophisticated techniques to penetrate. Therefore, Sudhansu deploys well defined strategy. CMS IT Services’ core locations are protected with network firewalls and other associated network security solutions. Critical systems and data are well segmented. Servers and endpoints are protected with next generation servers and endpoint security with deep encryption. Their mail/ messaging/ collaboration applications are on cloud and is protected with cloud-native security solutions.
The company uses SaaS applications heavily. Sudhansu added, “To address known identified vulnerabilities, we keep software, operating systems, and applications up-to-date with the latest security patches and updates. Regular vulnerability assessments and management along with compliances are institutionalised in our ISMS policies. All our services delivery centres are ISO 27001, 20000, and 9000 certified. We are GDPR compliant. Therefore, we follow stringent security policies internally.”
Having taken appropriate measures, Sudhanshu is exploring signatureless security solutions, zero trust network access solutions, cyber-awareness gamification, etc.
Its i3C-Integrated Cybersecurity Command Center is our 247×7 next generation client-focussed shared delivery centre. There are incident monitoring teams, incident responders, threat hunters, and deep subject matter experts for delivering these services. The internal team monitors and manages cyber security incidents for inhouse security monitoring.
However, hackers are weaponize Generative AI to penetrate into any system. Sudhanshu opines, “Generative AI cuts both ways. GANs or Generative Adversarial Networks and its autoregressive models with generators and transformers intertwining and building on each other can, on one hand, help create anomaly or malware detection by generating synthetic malware samples for training and testing malware detection systems and synthetic representations of normal network behaviour.”
“It’s important to note, even the curious intelligent hackers have the same or more sophisticated access to these technologies. For example: Generative AI can help create synthetic phishing emails or websites for training of phishing detection systems to recognize new and sophisticated attack patterns while at the same time help create Phishing evasion systems and trained to launch out-of-the-box phishing attacks,” he added.
Generative AI can help create synthetic personas and social media posts to train incident responders/ blue teams to recognize and defend against social engineering attacks while it can also help create synthetic personas and social media posts to conduct identity masquerading or identity thefts, now or in future.
There are multiple other use-cases like helping to strengthen while also helping in cracking password combinations and encryption algorithms, creating lightweight signatureless or agentless architectures while training models on how to penetrate those systems, helping generate honeypots with fake data to deceive potential threat actors and gather information about their tactics, techniques, and procedures (TTPs) while also aiding the threat actors to bypass these honeypots or deception systems.
His take is “Effective control parameters with periodic testing, accountable practices, ethical considerations, humane laws will help us navigate this beautiful technology remains to be seen. So, I am engaged in the space with keen interest.”
If Generative AI is helping the organizations to protect, the hackers are also weaponizing it against the best of the fortifications. Therefore, there is a need of ground level awareness among the IT workers. Even the specialised IT companies like CMS IT Services is acknowledging the reality. Greed always takes over. Do whatever you can, if there is a free voucher, employee will click the link; if there is an interesting download, the employee will download, if there is a lucrative job, employee will apply on website. That is one of the biggest challenges CISOs are facing in general.
Sudhansu maintains, “You will notice HR teams embracing high trust and collaboration in the workspaces. Cybersecurity does the opposite and says “don’t trust anyone, even insiders. Go into ZERO TRUST mode. Trust is essential but with technology areas folding into each other, there is no network perimeter anymore. So, everyone, whether employee or outsider, is a threat and that is the basic premise of Zero Trust systems. So, whether informed workforce or not in IT companies, cyber professionals have started to look at everyone with a deep zero-trust frame of thought. That opens another can of worms.”
He concludes, “Thirdly, deep focus in technology area and associated procrastination towards learning related or unrelated new technology is very rampant- give it any excuse you want-time, availability of tech resources, volume of learning needed, velocity with which it has to be learnt and delivered.”
Workforce in IT companies have specialised skill sets and this is beginning to tunnel drastically even though technologies are folding into one another rapidly. So, getting and retaining cross-skilled personnel is becoming more and more difficult.
So, in conclusion, CMS IT Services for its internal resources and customers, under the cyber security leadership of Sudhansu Naik, is in safe hands.
