10 Best Security Companies 2019

1. 3 Smart Home Security Trends to Watch in 2019 / PG-08 Asia Monthly April 2019 Leadership Technology CEOs News Business Features CIOs 10 SR 2019 Best SECURITY Companies Nadav Arbel, Founder & CEO Enabling Organizations to Establish a Truly Honed Optimized Security Practice:CyberHat www.thesiliconreview.com

2. Everything you need to create anywhere Blank page to brilliant. Designer. Photographer. Filmmaker. Dreamer. No matter who you are, there’s something new for you in the latest release of Creative Cloud. With the world’s best creative apps and easy ways to get started, you can make anything you want, wherever you’re inspired. Make it. Creative Cloud. Marketing Cloud All the solutions marketers need We have Creative Cloud plans for everyone, starting at $9.99/mo.

3. www.adobe.com Document Cloud The complete digital document solution Special o�fers for: Students | Photographers | Business | Adobe Stock

4. EDITORIAL TEAM Sreshtha Banerjee: Vishnu Kulkarni: Michelle Williams: Editor-in-Chief Managing Editor Co-Managing Editor CORRESPONDENTS Michelle Williams Avinash Nayak Harshajit Sarmah Javid Ali ART DIRECTOR Smriti Kumari Editor’s Note VISUALISERS Mira Sengupta G. Sai Pradeep Parnasree Gangopadhyay S. Saipriyadarshini SALES & MARKETING Preeti Kumari Kundan Kunwar Adhees Bhanja Deo Sunny P Choudhary Sita Mounica They want what you’ve got, don’t give it to them. Sathish Kumar Prabir Biswas Arun Kumar Satrasala Kavya Spandana C cyber security is not only becoming an increasingly important but a mandatory action taken to help businesses worldwide fight against significant cyber issues. So but what risks do businesses face in 2019 and beyond? How to be pro-active? RELATIONSHIP MANAGER Nabanita Dutta crm@thesiliconreview.com ybercrimes are evolving and keeping the organizations continuously challenged and awake. With threats multiplying day by day, ADVERTISING BUSINESS HEAD John Allen, Project Head john@thesiliconreview.com Arjun Pandey, Project Coordinator arjun@thesiliconreview.com MANAGEMENT Pavan Kumar Kalla: Circulation Manager pavan@thesiliconreview.com PUBLISHER Manish Pandey QUERIES Given today’s evolving threat landscape, it’s understandable that organizations want to take a proactive approach against threats, create an environment of continuous compliance, and have responsive it operations processes. Organizations want to reduce risk exposure and the attack surface, detect and respond to advanced threats, and drive down security operations costs. Here the only question is – How? sales@thesiliconreview.com editor@thesiliconreview.com GET IN TOUCH The Silicon Review Corporate Office: Silicon Review LLC, #3240 East State Street Ext Hamilton, NJ 08619 Sales: 510.400.4523 Development Office: Siliconreview Technology India Pvt. Ltd #32, 2nd floor, CMH Road, Indiranagar, 2nd Stage, Bangalore - 560038 PH: +91-7760351041 Here we introduce you to the cybersecurity experts, The Silicon Review “10 Best Security Companies 2019.” These companies are not only the most reliable cyber security solution providers, but are helping other companies to overcome the uncertainties. The companies enlisted are known for their simplest yet reliable cybersecurity solutions and pro-active ability. MAGAZINE SUBSCRIPTIONS To Subscribe with The Silicon Review and get 20% off on the Cover price Visit: www.thesiliconreview.com or Email us: subscription@thesiliconreview.com Success recognized to the fullest! Best © Copyright Silicon Review LLC. All rights reserved reproduction in any manner is prohibited. Silicon Review LLC. Does not accept responsibility for returning unsolicited manuscript and photographs. Printed & Published by Manish Pandey on behalf of Siliconreview Technologies India Pvt Ltd at Printo Document Services Pvt Ltd. #1, Double Road, Indiranagar Second Stage, Bangalore-560038, India The Silicon Review’s circulation is audited and certified by BPA International (Audit Pending) VISHNU VARDHAN KULKARNI, Managing Editor, The Silicon Review editor@thesiliconreview.com (CIN:-U72200KA2014PTC075778) (RNI REG. NO. KARENG/2017/75691)

6. CONTENTS ASIA SPECIAL - APRIL 2019 Volume - 3 | Issue - 4 The Critical Infrastructure Specialists: Kordia Solutions Hamish Guild, CEO 10 Delivering unmatched business value to its customers through a combination of process excellence, reusable frameworks, technology innovation, integration, and transformation: ALTEN Calsoft Labs Ramandeep Singh, CEO 14 Transforming the way businesses innovate and operate though a deep understanding of all aspects of information security: CyberQ Consulting Pvt Ltd. Dr. Rajiv Nag, Chairman & Director 26 In The Spotlight: Secure Application, an Information Security Based Consulting Firm, Leads the Security Space with Its Comprehensive Capabilities Shylaja Chandrasekhar, CEO 30 Global Security Solutions Provider: SECUDE Dr. Heiner Kromer, Chairman & CEO 32 Providing a Barrier against Threats that May Harm your Mobile Endpoints: Zimperium Shridhar Mittal, CEO 36 Explained: 360 Enterprise Security Group Provides Users with Multi-Level, Multi-Dimensional, and Systematic In-Depth Defense Solutions to Ensure Truly Effective Security Qi XiangDong, Chairman & CEO 40 Focusing On the Attacker than the Attack: Illusive Networks Ofer Israeli, CEO & Founder 44 Achieve Faster and More Secure Product Development with Secure Code Warrior Pieter Danhieux, CEO, Director, & Co-founder 48 Dathena Science Pte. Ltd.: The Universal Layer of Information Security that enables End-to-End Data Protection Christopher Muffat, Founder & CEO 52

7. FEATURE ARTICLES Modern Web Applications and Their Contribution to Handling Security in Enterprises 3 Smart Home Security Trends to Watch in 2019 08 34 The Standard Security Perils Associated With the Modernisation of Network Automobiles Security: The Need for Improvement 12 38 What Does Securing Big Data Platforms Mean in Today’s World? Blockchain could play a big role in cybersecurity 16 42 Trend Micro, The Global Player in Cybersecurity solutions Now Announces its Launch of MDR services Through Channel Ecosystem Russians staring totalitarianism in the face with internet isolation 24 46 Why it is important for smartphones to be completely secure The Role of AI and Machine Learning In Cybersecurity 28 50 COVER STORY PG-18 Enabling Organizations to Establish a Truly Honed Optimized Security Practice CyberHat Nadav Arbel, Founder & CEO

8. 3 Smart Home Security Trends to Watch in 2019 E is what this generation’s customers expect. But it is not possible to provide the exact same tech that portrayed in these movies or books. But tech that is quite closer to that is surely furnished. It is all thanks to the Internet of things that we are now able to see some amazing security tech at a regular house. An average person in India is now able to own his or her security IoT devices in India. With that in mind let’s look at three of the newest Home Security Trends that every company should know about. veryone knows smart home trends are on the rise and various home security companies have tried to involve themselves in this market. But the problem with this generation customers is that they expect tech that is usually seen in movies and or books. In other words, fictional home security 8 APRIL 2019

9. The Smart Lock Gone are those days when people used to lock their doors with a big lock. Have a number of keys in your pocket and more. We live in an era where money is transferred through apps and share information directly through our phones. When we can improve on so many things, why not the safety of our houses? This is the question many middle-class family house owners ask themselves. This is where companies developing such tech have to seize the opportunity. Middle-class families have started investing home lock system that is computerized. Yet, it is the same as a normal lock and key. It is time that you as a company take imitative, start promoting this new tech and start selling before anyone else in the market does it. The Video Door Bells Well, video doorbells are not new to the market. Many might have seen this in movies and also have seen it in real life. It has already made a huge impact in various countries, but India is yet to see it being implemented in regular houses. But it is expected to go mainstream in India soon by making video cameras that were developed in the past obsolete. Already many in India have this tech in their houses, but they belong to the upper middle class and higher level homeowners. It is important for many businesses in this vertical to realize that it is possible for middle-class homeowners to offer the same tech. Many companies like Nest and Ring have already developed some amazing tech which till today is being used. Clubbing Artificial Intelligence with Home Security Artificial Intelligence is one such industry that is picking up pace rapidly. Many companies have started implementing artificial intelligence in their firms. Other countries have seen better AI based cameras like the SimCam. It is a special camera that can identify humans from objects. It has special face recognition features that allow the owner to identify people who have already come home or have been seen around the house. In India, there are very few people who opt for cameras that constantly monitor your surroundings. But people have seen the problems in daily life. Implementing these techs will become mandatory in the future like having cable TV or Dish. Various businesses from different regions have already made their mark by coming into the home security vertical. India is one such country where everyone is insecure about the environment. Trusting a neighbour is also a problem in the country. Smart lock is a perfect solution for all these problems. In New England, many companies that offer home security have started providing video doorbells as a default feature in its services. It is because every single person in the region buys this product anyway. India is known to catch up with the trend very soon. Let it be fashion, routine, tech and even home appliances. The growing thefts in India along with the lack of security provided by our officials have put a doubt in the minds of homeowners. Video Doorbells will soon be in trend with better quality and resolution. SR Smart locks are a tool which has a keypad or a fingerprint scanner or some other verification barrier, which the owner alone knows. In the case of other family members trying to enter the house, they will have their own unique code, or the other way is to have a fingerprint scanner. All in all, it is the right solution to keep your houses safe. 9 APRIL 2019

10. new conduits incorporating trenching, boring, concrete cutting and core boring Installation of customer premises wiring Installation of the Premises Connection Device and the Network Termination Device as well as battery back unit if required • • Low Power Wide Area Network: The key requirements of the Internet of Things include secure bi-directional communication, mobility, and localization services. For this to happen, seamless interoperability among smart Things without the need for complex local installations is crucial. Hamish Guild, CEO The Critical Infrastructure Specialists Kordia Solutions LoRaWAN is a Low Power Wide Area Network (LPWAN) specification intended for wireless battery operated Things in a regional, national or global network. This specification gives freedom to the user, developer, and businesses enabling the rollout of the Internet of Things. K uses innovative design, advanced performance tools, and the latest technologies to evaluate and analyze clients’ telecommunications network needs to find the right solution for their business. Its experts work on both sides of the Tasman (and beyond) and are highly skilled in the design, deployment, maintenance, and operation of telecommunications networks and solutions. ordia Solutions is an Australasian company with more than 600 staff. It experienced professionals who work alongside its customers to grow their business. SAED-Site Acquisition, Environment, & Design: Kordia understands the site acquisition phase often holds the least certainty, yet influences all dependent activities and stakeholders. Successful site acquisition and effective design are keys to project success and total costs of ownership, which is why the company offer complete management of Greenfield, co- location, and upgrades across macro, small cells, and in-building solutions. Solutions and Services Field Services: Kordia’s Field Services delivery team works collaboratively with a range of customers to deliver quality and timely on-site and premise connections throughout Australia and New Zealand. Key areas it specializes in include: • Installation of new service drop cables from the main network (multi-port) through to the customer premises • Utilizing the existing pit and pipe infrastructure or installing Kordia’s mission is to build connections clients can trust and make its digital world more secure, reliable, and resilient. It has the leading team in the industry, Kordia’s national SAED team comprises highly experienced property, town planning, and engineering design staff, all of which 10 APRIL 2019

11. “Kordia builds the whole telecommunications network around a cutting-edge fault and task management platform.” are able to provide either stand- alone specific SAED services or fully integrate the SAED function into wider projects and programs to offer complete end-to-end solutions for both wireless and fixed network deployments. EME levels in their environment, they can also take advantage of its NATA accredited EME measurement services. • Public utility infrastructure assessment Audit of telecommunications equipment and services Technical tender review Critical Infrastructure as a service • • • Industries Telecommunications: Kordia delivers end-to-end solutions for telecommunication carriers and ISPs throughout Australasia. From planning, design, consultation, installation, and commissioning, right through to operations and maintenance. Kordia is also completely vendor independent, which means its team has the flexibility and ability to tap into a wide range of tools and techniques when providing mission-critical engineering and technical services to mobile, broadband and broadcast infrastructure owners. Its unique, whole-of-life solutions help to reduce risk, eliminate unnecessary duplication and improve the overall operability of networks to ensure emergency first responders anywhere in the field have the right information at the right time. 5G Technology: While the specifications of the fifth generation of mobile networks are still to be finalized, 5G is the next big evolution in mobile technology. The introduction of 5G means that radical network re-engineering is required from all three of Australia’s mobile networks. Meet the Leader Kordia is a civil design contractor and approved structural design certifier to the Australasian mobile carrier industry. Hamish Guild, Chief Executive Officer: Hamish has extensive experience running large scale national project, service, and engineering organizations. A passionate leader, he loves driving people development, great customer service and shareholder value. EME Compliance: Kordia can assist clients with electromagnetic energy (EME) compliance for their transmitter antennas, EME management for a new network, or RF safety awareness in general. Rail: Kordia works with public and private sector rail network owners and operators including major companies with dedicated rail networks and construction companies to deliver fully integrated end-to-end communications solutions. SR Its experienced EME services team provides high level consulting and concise EME reports and training. Its EME drawings clearly and accurately show the RF zones of active antennas, making it easier for them to manage EME safety onsite. If clients need to confirm Government: Kordia’s capabilities include: • Radio networks design governance, implementation and integration services 11 APRIL 2019

12. Automobiles Security The Need for Improvement E road, on road or even automobiles that are used for other purposes like the ones used in airports and more. Growth is going intense. There are many car brands in the market, both Indian developers and verywhere in the world people would have seen an automobile. Let it be off overseas. In India a couple of years back we could see hardly few cars on the roads in cities like Mumbai, Bangalore, Kolkata, Delhi and other major cities. Soon as the years went by the number of cars on the road has also increased. Every single person who belongs to the upper middle class or middle class owns a car. It can be basic care that ranges from 3 lakhs to 10 lakhs. The growing number of cars has also attracted a lot of threats in the market. In India, we hardly see proper parking facilities in middle- class houses. Hence, they are forced to park the vehicle on the side of 12 APRIL 2019

13. the road. This makes it quite easy for a thief to take over the car. Yes, now the question arises, won’t the car’s security system activate – alerting the owner of his car being compromised? Well, to answer that, let’s first consider hackers.No matter how good your firewall is or how good your security system is, a hacker finds a way to hack into a system and obtain confidential data. It is because a hacker is as smart as any security developer. The same goes for the thieves who try to steal a car or obtain some part of a car. With the growing technology, many of these thieves stay updated with the latest tech used in a car. It is evident that middle-class owner’s cars won’t have the luxurious security provided for a high-level car like Mercedes S class or a sports car. This is where the thieves take advantage, this doesn’t happen in all locations, but it is slowly picking up the pace. In order to solve this budding problem, we should end it while it is just starting. not wise to jeopardize a person or a family’s life. Almost 60 per cent of the buyer won’t go for the air bags since it is expensive and buying a car itself is a task and on top of all that adding additional safety features which are actually sold for free in other countries makes any Indian furious. take the better of you. It is obvious that when there is a growth in a vertical it will eventually attract more and more business ideas, with it many other competitors step in. The problem now is that owners who belong to a completely different vertical step into a new play zone just because they have the funds and better ideas. This is where existing players lose customers. Focus Less on Mileage and More on Security Many would agree to the fact that mileage plays a major role in the market today. Every single middle class Indian is concerned more about the mileage than security. The second is the price and offers that come along with it. As a developer, one must always keep their customers happy. Just because the market demands it doesn’t mean a company should do the same. The sales will still go as planned even if you compromise on the mileage and focus on security. The competitor will obviously sell their product for a lesser price and with better tech or tech that is as equal to an existing player’s car. A middle-class person would consider all these factors and it is obvious that a car is a car; it won’t lose its value. Back in those days, it was all about brands and the status a car holds. Even now it is present but no one cares, so the owners just focus on money and comfort. Keeping this in mind, automobile should change and maybe avoid threats. SR Implementation of Better Tech Technology is improving drastically, but the problem with the Indian market is that every single car that comes out will only have one or two new techs. Companies should realize the fact that by doing so you are actually letting other competitors Better Safety for Cars In other countries, airbags, safety belts and other parts of the cars come free. But in India on the other hand, even a middle-class buyer should pay for airbags and other products to improve the safety of the car. To generate the money it is 13 APRIL 2019

14. Delivering unmatched business value to its customers through a combination of process excellence, reusable frameworks, technology innovation, integration, and transformation: ALTEN Calsoft Labs A enterprise IT and product engineering services company, that helps customers to become smarter, highly productive, nimble and better at predicting the future. Leveraging its extensive deep industry and business process expertise, passion for customer excellence, and proven global IT services delivery model and network – it offers best of the breed offerings for Industry verticals like Education, Healthcare & Life Sciences, Networking & Telecom, Hi-Tech, ISV and Retail. a pioneer in helping global organizations in their enterprise digital transformation journey. It enables enterprises with world -class IT technology consulting services that ensure growth, scalability and high performance while mitigating risks. LTEN Calsoft Labs is a next- gen digital transformation, technology consulting, for Information security management system covering the provision of resources, work environment for software design, development testing, implementation, maintenance, enhancement, and support projects. This certifies that the Quality Management System of ALTEN Calsoft Labs has been audited and found to be in accordance with the requirements of the Management System standard. In this era of Digital transformation, every enterprise is working hard in building multiple touch points and journey maps for their customers. The customer expectations can’t be met with multichannel presences alone; good customer experiences with an intuitive, simple, contextually relevant and exciting digital interaction that personalizes all touch points during a customer journey does wonders. A carefully crafted customer experience framework drives customer loyalty, new revenue channels, and cuts down the cost significantly. ALTEN Calsoft Labs delivers compelling digital experiences by developing an omnichannel architecture comprising of: • Personalized Digital interventions on the front end • API and Micro services in the middle tier • Big Data Platforms in the back end Service Portfolio IT Consulting Services ALTEN Calsoft Labs has been Since 1992, ALTEN Calsoft Labs has delivered unmatched and sustainable business value to its customers through a combination of process excellence, reusable frameworks, and technology innovation, integration, and transformation. The company helps in building effective organizations by enhancing their competitive edge, enhancing productivity and driving business transformation. Its consulting services help enterprises work smarter, grow faster and transform businesses by unlocking innovation, driving corporate performance and governance. It provides a full range of IT and Operations consulting services, leveraging its deep industry knowledge across industries and technical expertise. ALTEN Calsoft Labs is a pioneer in delivering Business Innovation, Integration and Transformation through disruptive technologies like SMAC (Social – Mobility – Analytics – Cloud), IoT and Big Data. The firm has mastered the art of addressing enterprise business and technology challenges through its “Connected Customer framework” that: • Enables enterprise business transformation, technology innovation, and integration. • Facilitates customers to thrive in the digital age by enhancing productivity and performance. Enterprise Digital Transformation The pace of business is accelerating. We are living in the age of technology explosion where Digital Technologies like AI, machine learning, Robotics, IoT and Big Data are ushering a new paradigm touching billions. Digital technologies are leaving an indelible mark, and reshaping every industry landscape and how organizations function in ways never heard of. There has been a significant rise in digital transformation initiatives over the years and a lot of investment being pumped in, to transform businesses digitally. However, these initiatives are challenged in reaching digital’s true potential due to organizational silos, legacy business processes and Customer Experience Customer experience is indeed a competitive space. The ability to deliver a delightful experience to every customer has become a key differentiator for many enterprises. ALTEN Calsoft Labs has received accreditation certification of CMMI level-3, DEV-1.3version, ISO 9001:2015 and ISO/IEC 27001:2013

15. CEO Corner Ramandeep Singh: As CEO, Ramandeep is driving the engineering teams and strategic planning activities for ALTEN Calsoft Labs. He joined the ALTEN Calsoft Labs’ management team from Aspire Communications; a subsidiary of ALTEN Calsoft Labs. Ramandeep has over twenty years of experience in data networking, telecommunication, and semiconductor technologies. As a senior level executive, he managed strategic planning, business development, engineering and marketing related activities at various companies. Prior to joining Aspire, Ramandeep was Marketing and Operations Head at Luminous Networks. Ramandeep also served Corona Networks as the CEO. He was also a part of Nortel, Bay Networks, Mitsubishi, VLSI Technology and LSI Logic. Ramandeep holds a B.S. and M.S. degree in Electrical Engineering. Ramandeep Singh, CEO technologies, and a myopic view by senior leadership lacking purpose, clear goals, and objectives. phases viz., Innovate, Launch, and Scale Fortune 100 companies, in their IT & Business Transformation initiatives and has delivered accelerated value via in-depth technology & product expertise, strong industry & functional knowledge, and well- defined processes. Alten Calsoft Labs understand the need to sharing the same vision with the Clients and sharing the risks and thus most of its Managed IT services are managed by strict SLAs. With the changing business and technology landscape, CIOs across the world are redefining their priorities & business objectives leveraging existing IT investments and adopting disruptive technology platforms. Alten Calsoft Labs realizes this changing aspect of modern businesses and offers a wide range of services in the area of consulting, implementation, system integration and managed services that enable organizations to create a competitive advantage in the marketplace. In this context, ALTEN Calsoft Labs’ Lean Digital Practice enables large enterprises to re-architect and re- engineer their front, middle and back office operations, helps prevent costly mistakes by assuring technology decisions are aligned with the business and that those decisions result in the right business outcomes in line with organization vision. The company is committed to delivering continuous value to its clients by leveraging its unique Lean Digital framework derived from helping more than 100+ clients innovate, integrate, and transform their business process operations. The firm Lean Digital framework comprises three distinct “ ALTEN Calsoft Labs provides the technical expertise, time and resources to manage various application environments. It delivers full benefits of critical applications disregarding issues like shrinking maintenance budget, highly complex infrastructures and limited visibility into applications. Over the years ALTEN Calsoft Labs has been supporting leading global players in Manufacturing, High- Tech, Energy & Utility, including SR With a multi-cultural and transnational talent comprising over 33,700 employees, spread across 28 countries, we bring in competitive advantage, innovative and fresh perspectives to business challenges and promote a collaborative knowledge environment.”

16. Blockchain could play a big role in cybersecurity W cybersecurity is the most pressing concern. A cyber-attack has the potential to cause more damage and monetary loss than a conventional terror attack. The most common target for hackers is data. Data is the perhaps the most valuable commodity today, and with the right knowledge of its applications, it won’t be an exaggeration to say that data is probably as valuable as oil or natural gas. Industries such as telecommunication, banking, healthcare, information technology, financial services depend on data integrity. With such a high value in the current scenario, it is no surprise that cybercriminals have always gone after data. e live in the information age, where personal data is everything and erased or tampered with without others knowing about it. In other words, each of the ledgers in the blockchain network contains entries for every single transaction, and attempting to alter any one of them would alert others to the discrepancy. It is an extremely safe technique of maintaining records that has numerous applications. ensure continuity of service and secure operations. Blockchain is a relatively open environment where most of the data is available for everyone in it, and copies of them are present on each node. This enables all the users involved to verify and corroborate any information, ensuring that there is no unauthorized modification or deletion. What’s more is that since every single action is recorded into blocks that are connected to other blocks and linked to a user, the sequence of activities can easily be traced back to their perpetrator. In this way, every activity can be verified by everyone, providing a powerful deterrent to would-be cybercriminals. Furthermore, blockchain also has the potential to act as an effective preventive measure against a range of techniques used by cybercriminals to disrupt systems. Most messages sent over the internet are encrypted using private keys and decrypted at the receiver’s end using the same key. If hackers manage to gain the key, it enables them to intercept all messages and discern personal user IDs and passwords, which in turn would allow unauthorized access to vital systems and data. Blockchain allows organizations to use a distributed public key system to authorize users by their devices, where each device is assigned a special SSL certificate. The data for the certificates are managed on the blockchain, making it much harder for hackers to gain any sort of unauthorized access. A brilliant application for blockchain is carrying out financial transactions across international borders without central regulatory institutions like banks. The currency of exchange is called cryptocurrency and is completely electronic and ensures complete security. Many experts, however, don’t give much credibility to this idea, given the size and the clout of the banking industry. Adding to this hurdle is the inherently unpredictable nature of cryptocurrencies. Unlike financial instruments like stocks and shares, whose valuations can be deduced, cryptocurrencies, on the other hand, are next to impossible to predict. This makes them rather unreliable. But there have been many startups that offer currency exchanges for blockchain based cryptocurrencies. Cybersecurity experts and hackers are locked in a constant struggle to outdo one another, emphasizing the need for a comprehensive security solution. Blockchain is one technology that could be the answer to most of the problems plaguing cybersecurity issues. It is a revolutionary concept that can change the face of how we protect data, and also has the potential to replace banks as a centralized authority for regulating transactions. In addition to this, Denial of Service (DoS) is one of the most widely used methods used by hackers to disrupt networks. It involves flooding a central server with a very large number of requests, resulting in congestion caused by network traffic that is greater than what the bandwidth can accommodate. It results in websites going offline and service disruption. Blockchain by its very nature and decentralized structure cannot be targeted by a Dos attack. This goes a long way to Its working is somewhat elaborate, but it promises information security like no other. Unlike banks, data centers, centralized servers, and other institutions, a blockchain is a distributed, encrypted public ledger wherein each node in the network contains a copy of the ledger. Every single copy of the ledger records every single activity and transaction with a timestamp that cannot be Blockchain is a very nascent idea and only time will tell if it would make a dent in cybersecurity. SR

18. Enabling Organizations to Establish a Truly Honed Optimized Security Practice CyberHat Proactive Cyber Defense C of data thefts, breaching, and loss of confidential information all due to lack of cybersecurity. When the attacker can think out of the box and breach into your systems, youcan too do thatand protect your data against such threats. Since, YOU – as a company must be one step ahead of all these criminals, procuring the right cyber security for your firm becomes crucial in the current market. In order to shield your ybercrimes are growing with the growth of technology. In the present time, we see a lot company and the data you have, CyberHat brings you a variety of protection. solutions, including operating the world’s first Smart SOC as a service - CYREBRO. CyberHat is a leading cybersecurity company that designed, developed and operates CYREBRO. It is an unique and advanced SOCs (Security Operation Centers) as a service. CyberHat empowers and secures organizations globally and across all industries in the most cost-effective manner. CyberHat’s elite teams of experienced hackers, analysts and cyber experts, provide cybersecurity CYREBROs unique “pro-active” approach for a Security Operations enables organizations to take back control of their security operations and establish a truly honed and optimized security practice. The company offers the industry’s first 100% technology agnostic, professional SOC-as-a-Service to customers across all industries. Supported by a state-level response 18 APRIL 2019

19. COVER S T O R Y 19 APRIL 2019

20. team it is the first of its kind to provide an out-source elite level of service and expert SOC. technologies, working processes and procedures and a thorough proper SIEM streamlining. understanding of; network forensics, network protocols, malware and hacker’s propagation techniques and attack scenarios. CYREBRO reduces false positives and creates a clear, precise and noise-free cyber-security environment. CYREBROs unique approach for Security Operations enables organizations to take back control of their security operations and establish a truly honed and optimized security practice. It offers the industry’s first 100% technology agnostic, professional Managed SOC to customers across all industries. Supported by a state-level response team, it is the first of its kind to provide a professional turnkey solution, Cyber Experts, technology and operations of a Managed SOC. CyberHat’s professional teams are comprised of elite Israeli hackers, Intelligence officers and IT security experts with years of private and state level experience. The firm’s security solutions are designed, executed and operated by elite Israeli cybersecurity experts. Hackers, defenders and state level investigators with state and corporate level experience. The company provides professional cybersecurity solutions that enable practical and active defences, allowing its clients to grow their business while keeping a secure working environment. Various Teams Playing their Part SET-UP Team The dedicated set-up team is focused on optimizing the monitoring infrastructure and verifying optimal SIEM configuration. Through establishing relevant log sources, ensuring rules and correlations function correctly, and implementing current attacker’s point of view functions, this team ensures the optimal streamlining of the SIEM. The Four Tier Analysts Incident Response Team The team is composed of analysts of different teams such as tier 3, tier 4, intelligence and professional services. The team provides a professional and methodical response based on years of specific IR experience and specific preliminary actions tailored for each client. The team works on mitigating and containing the incident while preventing the spread to other systems and stopping any operational or intellectual damage. Its experience comes from hands- on deep cybersecurity forensic and postmortem investigations, advanced hacking simulations and cyber assessments for companies of all sizes from the fortune 500 to small and medium-sized businesses. CyberHat protects financial services, retailers, telecoms, and energy and infrastructure organizations around the world. Tier 1 Analysts Tier 1 Analysts are CYREBRO’s first line of defence and detection. This team oversees first alert interception, documentation, prioritization and initial investigation in accordance with a detailed guideline protocol. Tier 2 Analysts The team provides CYREBRO’s customers with an in-depth alert investigation. This team utilizes various security systems, proprietary CYREBRO tools and unique investigative processes to handle cyber incidents. CYREBRO SOC Platform CyberHat provides customers with an opportunity to harness the full power and potential of the SOC through CyberHat’s next-gen “Smart SOC” called CYREBRO. CYREBRO, its expert based SOC platform is designed, operated and managed by experienced hackers and state level qualified defenders. Specifically focused on quality and value monitoring and response, CYREBRO Provides 24/7 detection, analysis and remediation of cyber-security threats, enabling the most practical and effective approach to SOC operations. The Intelligence Teams With State level background and deep web experience, our intelligence teams are constantly searching, analyzing and producing valuable and relevant threat intelligence for the SOC. Tier 3 Analysts Tier 3 analysts hold vast experiences in the security field and host-based forensics. Using those skills, they conduct advanced forensic investigations and guide T1-2 analysts on workflows and procedures. Type of CYREBRO CYREBRO Core “CYREBRO CORE” is based on the customer’s existing SIEM solution, and provides 24/7 SOC monitoring coverage, with an end to end T1 –T4 capabilities. This includes all SOC capabilities like specializing in detection, preliminary investigation, Tier 4 Analysts These expert analysts hold vast experience in large scale investigations, and have a deep CYREBRO platform delivers real value to businesses through optimization of existing security 20 APRIL 2019

21. The Expert in Cyber Security and the Leader of the Company Nadav Arbel | Founder and CEO Nadav has over 15 years of experience in Cyber and IT security for Military intelligence and Law enforcement agencies at tactical and technological units, specializing in cyber defence, intelligence gathering and strategic technical systems. Cyber Hat is a company specializing in Cyberdefense services and solutions worldwide, providing strategic and tactical teams for Cyber intelligence, cyber and IT security architecture, cyber hacking and cracking, forensics and response capabilities and more, for various business and government sectors from finance through Telecom and Hi-tech and up to national critical infrastructure. Specializing in building and operating Cybersecurity operation centres – as a service, worldwide I.R. teams and real-time event management, Nadav established and commanded the Israeli Cyber and SIGINT technology unit for the Israeli Police between the years 2009 – 2012. Nadav Arbel Founder and CEO “We know from firsthand experience, that a good defence is based on understanding the attacker’s methods, the drive and the practical technical domain. Keeping this in mind we provide you with the right solution for your business.” Nadav has also carried out various roles in international technological companies from COO to Defense division manager, managing over 250 employees worldwide, responsible for the execution and deliverables of over 150 technological projects of various magnitudes and complexity simultaneously across the globe and managing business units of over 120 Million NIS. 21 APRIL 2019

22. C O V E R veterans of the Israeli Military and various security agencies on both the state and corporate level therefore are exposed to cyber threats and cyber-attacks. STORY The Solution Targeted Hacking Simulations – CyberHat’s hackers & crackers team simulates high level sophisticated hacking simulation that focuses on information assets rather than information systems. The attack simulates a motivated group of hackers that target the organizational assets: source code, emails, financial information, general production environment and any other organizational level assets. The hacking simulation provides the organization with a unique experience of walking through a real-life cyber-attack in a contained and safe environment. Professional Services: Cyber Security Readiness Assessment CyberHat’s unique cybersecurity readiness assessment is based on years of practical offensive expertise. It designed and built a unique, on-site, professional assessment that provides clear and tangible insights into an organization’s cyber defence capability. The company evaluates a client’s security readiness and provides a roadmap of remedial actions which address three core elements: • Resilience • Response • Recovery abilities isolation of problems, minimizing false positives, mitigation and remediation processes of cyber incidences 365 days a year. It also helps its client utilize their existing security systems to their maximum. CYREBRO One “CYREBRO One” is a ‘turn-key’ solution for organizations that have no SIEM or data collection technologies in place. “CYREBRO One” provides SIEM licensing and set-up, SOC services, 24/7 monitoring coverage; the end to end T1 –T4 capabilities, advanced forensics and response capabilities. The solution combines technology, expert skills, processes and procedures and a managed end-to- end solution. Scope of Work The Simulation consists of a 2 step process, designed to test both the external defensive capabilities and the internal defences. The Tests may include any or all of the following: The Firm’s Methodology CyberHat’s methodology is focused on the gap between theory and fact. The assessment creates a clear and coherent picture of the true cybersecurity posture of the organization and its ability to handle real-life cyber incidents. Attack scenario analysis – CyberHat’s methodology includes a comprehensive analysis that is carried out by tracing known attack phases and examining how a potential attacker could exploit the organization’s existing gaps throughout the different attack vectors. External • All aspect of social engineering • Malware manipulations • Advanced Phishing (Internet or Cellular) • Circumventing protection systems • Examining of remote access capabilities (VPN, Terminal, etc) • External facing applications Unique Features of CYREBRO • 100% technology agnostic • Advanced forensic capabilities • In-house cyber threat intelligence • Fast and cost-effective “Setup time” • Offensive oriented design and operation • Extensive offensive and investigative experience • Ongoing, customized, client- facing reports and updates • Provides Tier1 to 4 multi-layer monitoring and response • Professional incidents response, 24/7 expert response team • A unique, monitoring optimization process, designed for “Quality alerting” • Hands-on management and experience with all the world’s top SIEM technologies • Highly qualified and experienced analyst team, as Internal • The resilience of networks separation • Internal employee rouge simulation • Identification and alerts testing • Manual and in-depth testing for logical problems in the infrastructure architecture and settings SR Targeted Hacking Simulations The Challenge Almost all organizations base their core business on technology assets, comprised of personal devices and critical operational servers with sensitive business information connected to the network – and 22 APRIL 2019

23. 23 APRIL 2019

24. Russians staring totalitarianism in the face with internet isolation C as well as governments. From disrupting government infrastructure and bringing corporate operations to a grinding halt to demanding millions in ransom, cybercriminals are getting bolder and ever more audacious with their attacks with each passing year. However, in spite of the growing threat of cyber terrorism, companies, as well as governments, have been slow in enacting policy few. But what happens when the ybercrime is a rapidly rising threat to internet security, causing millions in losses to individuals, corporations and implementing measures to counter this threat. same principles of the government for the people, of the people and by the people is used to legislate all the power to the privileged few? The internet is an extremely useful platform that connects people across the globe, enabling the spread of ideas from country to country, across continents. While cybercriminals pose an external threat to internet freedom, the internal threats that stem from weak democratic institutions may pose a larger threat to internet freedom. Democracy has always been about the people and not the powerful The result is legally approved authoritarianism and an end to internet freedom. Such a state of affairs in any country would be worse than cyber terrorism at its worst. The internet is perhaps the most important medium to spread the ideas of civil liberties and justice and censorship on its usage is very similar to state- sponsored cyberbullying. Countries

25. where democracy and civil liberties have been eroded constantly see governments that impose severe restrictions on internet usage. China is perhaps the best example of internet censorship stemming from autocracy. However, Russia could now be another entrant into the list of countries where democracy is threatened by attacks on civil liberties and free speech. people’s data, it can effectively establish a police state and erode the privacy of the populace and put an end to individualistic opinions of people. servers outside the country. Such a move is definitely a step towards establishing comprehensive surveillance in Russia’s cyberspace. We live in the internet age and each user generates data. All that data can be used to create a profile about a person and determine if that person would stir dissent among people. Democracy was conceived to keep power away from the hands of the few, but when a government chooses to implement a mass online surveillance program by curbing internet privacy and gathering information on the online activity of its own people, it is a definite step towards the end of democracy and the establishment of a totalitarian state. When people lose the right to criticize and question their leader, they lose something fundamental in their government. Citizens in such a country can be arrested without trial for criticizing or even making fun of their leaders online. This was actually the case last year when a Russian citizen was jailed for a month for a tweet that condemned the government. When a government curbs online privacy, it is essentially putting a cap on fundamental rights and freedom of speech. It is nothing but state- sponsored cybercrime perpetrated on its own people on a nationwide scale. SR The Russian parliament is set to propose a highly controversial bill which would essentially isolate internet services in the country from the rest of the world. When news about this bill broke out, it drew massive crowds, upwards of over fifteen thousand people on the streets of Moscow, Russia’s capital. The protestors remain convinced that the bill is an effort to find and silence people who oppose government policies and curb dissent. Russia’s president Vladimir Putin has been notorious in foreign media for aggressively promoting Russia nationalism and many experts believe that he is slowly transforming Russia into a police state, similar to the former Soviet Union. Russia internet freedom Thousands protest against cyber-security bill The newly proposed bill could gradually reduce Russia’s internet traffic from being routed through When most corporations or government express concern over their cybersecurity infrastructure, it is implied that they protect their interests against outside aggression. However, in the case of countries like Russia, it is the government that people need to worry about. Having all the digital information about its people with little to no oversight can be worse than any cyber threat posed by foreign actors. When a hacker group gains access to personal information about people, it can perpetrate identity thefts, credit card frauds, financial crimes, etc. However, if a sovereign state without any sort of regulatory measures, oversight or checks and balances is able to collect its

26. Transforming the way businesses innovate and operate through a deep understanding of all aspects of information security CyberQ Consulting Pvt Ltd. Dr. Rajiv Nag, Chairman & Director CyberQ Consulting Pvt Ltd. is aimed at helping companies such as the ones described above. It is a company that is dedicated to offer the best in class security advice based on its in-depth knowledge, expertise and experience in providing security consulting services to clients from India and overseas. themselves with the latest technology/tools to protect customers’ investments in IT infrastructure and Applications. As an organisation, CyberQ not only provides its security consulting services following rigorous processes and standards but also follows a stringent Information Security policy, especially in case of client related data and information. “CyberQ’s Security Assessment services help organizations in timely identification of vulnerabilities, evaluating the risk and taking of remedial measures to find and fix security vulnerabilities within their network.” CyberQ: A Class Apart CyberQ has carved a niche for itself and has worked with some of the biggest names in the industry. While its strength lies in the skills and experience profile of key personnel, each one of its consultants are well experienced in their respective domains, with the average experience being around fifteen years. In addition to that, they also have extensive software development experience having worked in both India and abroad. Therefore, during training, the consultants are able to share real life experiences with the audience, making the interaction more meaningful. During consultancy, this reflects in practical and easy to use solutions without the rigors imposed by a purely academic approach. In conversation with the founder, Dr. Rajiv Nag Tell us something about the company. CyberQ Consulting was founded in February 1997 in New Delhi, with the objective of providing process improvement and information security consulting services. Over the years, CyberQ has worked with some of the biggest names in the IT industry in all parts of the world. It has worked for over 650 clients spread over 24 countries. M requirements, strengthen their operations and performance, as well as improve their shareholder value. Moreover, the business environment has turned to be hyper-competitive making it extremely risky for organisations to afford ad-hoc security measures. In order to be able to protect their intellectual property and other sensitive customer and business information, firms need to have a comprehensive security strategy that closely matches business objectives. odern day organisations have to face a lot of pressure to comply with regulatory Today, CyberQ is accepted as one of the leading players in the areas of IT Consulting, Software Quality (CMMi Consulting and Certification Services, Process definition, Training and independent audits), and Information Security Consulting/Audit services (Security Policy/Processes, Risk Assessment/ Management, ISMS Implementation, CyberQ has several IT/Infosec experts with international certifications and a strong R&D team who continuously update 26 APRIL 2019

27. Application and IT Infrastructure Security, Training, Compliance Audit). a broad consensus about the most critical security risks to web applications. The Driving Force behind CyberQ’s Meteoric Rise Regarding IT Infra audit, Network Security / VA PT requirement, CyberQ follows Open Source Security Testing Methodology Manual (OSSTMM). CyberQ follows standards and practices and has experience of conducting audit in reference of IT ACT 2000.We are also ISO 9001:2005 and ISO 27001:2015 certified company. Our past eighteen years’ experience in Information Security extends beyond 3,000+ man-months of Information Security professionals. We are empaneled with CERT- IN since 2005 and are also CCA Certified. We have professionals having experience in Information Security for over ten years. Dr. Rajiv Nag, Chairman and Director, CyberQ Consulting Pvt. Ltd. Dr. Nag is the Chairman and Co-founder of CyberQ Consulting Pvt Ltd. He has held many senior management positions over the years. He was a Senior Advisor to KPMG India (2010-2012), Director, Asia Pacific and CEO, Bakst Asia Pacific Ltd., Hong Kong and General Manager (Systems), Bakst Indika Pvt Ltd, India from 1988-1996. His earlier jobs included Senior Manager (Systems), JK Techno soft, New Delhi, MIS Manager at Bhartia Cutler Hammer. He started his career in India in the IT industry in 1980 with Engineers India Ltd., New Delhi. Can you talk about your products and services in brief? We offer the following services. • Information Security • Network Security (PT VA) • Process Consulting • GDPR consulting • IT Infrastructure audits • Mobile application security audits • Consultancy and security Audit Services in Information Security Implementations (ISMS/ ISO 27001) • System Audit of Storage of Payment Systems • Application Security Audit • Implementing RBI guidelines for banks and NBFS Testimonials of Success “CyberQ’s quality of deliverables and services is excellent and so was performance of CyberQ team during the assignment and they provided on time delivery (commitment to schedule). Overall, we are thoroughly satisfied of working with CyberQ and wish to have a long term relationship.” - Larsen & Toubro. “We are proud to say that with consultancy from CyberQ Consulting, Perot Systems TSI (formerly known as HCL Perot Systems) has established the best security practices and processes to satisfy its business needs and meet the BS7799/ISO7799 requirements and it was successful in being certified as a BS7799 compliant organisation. The timeframe for the project was about 8 months and the project was completed without any time and cost overruns.” - Perot Systems. What do you feel are the reasons behind your service popularity? The primary reasons are a) our commitment to customer satisfaction and b) our commitment to the quality of work we do. Both these, in turn, stem from the strengths that we derive from the professionalism and technical excellence of our people. Dr. Nag specializes in Software process improvement and quantitative measurement initiatives. In his role as a CMMI/High Maturity Lead Appraiser and a well-known consultant and trainer, he has been among the first ten High Maturity Lead Appraisers in the world to be authorized by the Software Engineering Institute, USA. “We are pleased to state that under the guidance of CyberQ Consulting, Rose IT Solutions Pvt Ltd is in the process of establishing the best security practices and processes to satisfy its business needs and meet the BS7799/ISO7799 requirements. The timeframe for the project is about 8 months and till now there is no time and cost overruns.” - Rose IT Solutions Pvt Ltd. CyberQ tends to follow the OWASP guidelines which are a powerful awareness document for web application security. It represents SR 27 APRIL 2019

28. The Role of AI and Machine Learning In Cybersecurity T breaches. Though there have been many advancements in the field of cybersecurity, we still do lack in our security systems. It’s been a long time since they have existed, and it’s not wrong to think that they should have reached their complete maturity by now and worked on every aspect to combat security threats. ime and again, individuals and firms have to come across email spam and data learning, data science and artificial intelligence. Computers are getting smarter day by day thus ensuring the safety of our systems. to work, they need to be exposed to months and months of activity logs. Eventually, they become capable of achieving efficiency at detecting threats and anomalies. However, in reality, the problems centered on cybersecurity will continue to remain for the entirety of our digital lives. Certain reports have stated that the number of recorded malware attacks in 2018 have doubled to 5.99 billion than the cases occurred in 2017. It is obvious that experts in the security domain would want the trend to shift in the other direction, but cybersecurity is more proactive than reactive. One major reason to support that is the advancement going on in machine AI Algorithms Use Pattern Recognition to Detect Threats Adding a strong layer of defense to your network and software is necessary, and that won’t be done by just switching to an AI based system because machine learning also involves harnessing data from the past and using it to your benefit in the future. In order for AI algorithms AI algorithms usually start by taking in the information required to set a baseline of normal performance and keep track of new events from there. The pattern thus developed from the calculation of new events help the machine learning system to recognise a hacker or a threat to the system. One more thing that is important to consider, when it comes to cybersecurity, is time. Time is really of the essence! 28 APRIL 2019

29. It wouldn’t take much time for a hacker to invade into a firm’s system and either steal critical data or hold it for ransom. Taking a situation like this into account, what can best describe the efficiency of any AI tool is its ability to recognise an attack at the earliest stages and send alerts to the right people. to be critical of putting their trust in cloud platforms that will contain all of their sensitive data. This, in turn, again generates a new range of potential threats and vulnerabilities. This scenario will take some more time to happen because even the strongest AI cybersecurity tools that we know of needs collaboration with the human world. The latest AI and machine learning systems are all based on software algorithms making it easier for firms to get them deployed across their cloud infrastructure and services. AI is finding its application in the best of antivirus tools for scanning through servers and finding instances of malware. The algorithms are smart enough to learn everything on their own self and detect malicious softwares. When businesses have an intelligent system based on machine learning watching over their systems, every business of every size can be sure of a secure cloud environment and protect them against malware penetration. It is very tough to completely eliminate the risk, no matter what your cloud provider says, but one should always ensure the security of their applications and websites by their own means. This is where AI comes in to offer effective tools to do that. Currently, machine learning systems are being developed to be better and better at natural language processing and trend analysis. However, at the end of the day, humans still can do a better job at interpreting spoken and written test thereby adding much value to the efforts put in synthesizing the reports generated by AI. Generally speaking, it’s not sensible to let machine learning systems take control over the decision making process because AI is still not perfect at identifying cyberattacks. Therefore, humans need to be alerted in case of a threat, and they need to decide the next course of action.SR There’s no doubt that cybercriminals will always be on the lookout for new ways of executing effective attacks, and as a result some have begun to leverage AI for their own purposes. This means that firms of all sizes have to invest in the best machine learning software in order to beat the competition and stay ahead of the game. Cloud Integration The way how companies operate on the web, to a large extent, is now governed by the cloud computing movement. Firms no more have to host servers and equipment in local offices or small data centres; instead of that, they can just take help of platforms like Amazon Web Services and Microsoft Azure and get their systems shifted to the cloud. However, this has proved to be both a blessing and a curse in the cybersecurity world. Human Interaction Is Still Essential Now the question to ponder upon is whether machine learning algorithms will have the capability to be so smart that they reduce the need for any sort of human input. With the advancements in cloud technology, companies have fewer pieces of physical hardware to worry about. But they surely have 29 APRIL 2019

30. In The Spotlight: Secure Application, an Information Security Based Consulting Firm, Leads the Security Space with Its Comprehensive Capabilities Shylaja Chandrasekhar, CEO A stay competitive in the market, they also become more vulnerable to cyberattacks. It has been witnessed that cyberattacks have been increasing at a steady pace year by year, and information security incidents and accidents have become a crucial issue that needs to be taken care of because of their potential to adversely affect an organisation’s business activities. This makes it absolutely indispensable for firms to double their efforts to counter such attacks. This is where Secure Application comes in with its unique experience and latest technology that completely caters to each and every vital security needs. s the modern day businesses get more and more dependent on networks to without disrupting their ability to do business. landscape. With our knowledge, experience and global footprint, we are best placed to help businesses identify, assess, mitigate & respond to the risks they face. We are passionate about making the Internet safer and revolutionizing the way in which organizations think about cyber security. In conversation with Shylaja Chandrasekar, CEO of Secure Application Can you brief us about the history of your company? Secure Application was started in the year 2005 with just five people performing application security testing for medium size e-commerce Sites. Now we have built a team of hundred employees who are working in different client locations and catering to the needs of customers for a variety of security solutions and services. How do you position your company in the current market scenario? Secure Application is an independent provider of Information Security Architecture, Strategy and Solution Integration services to a number of leading global organizations and security vendors in both the public and private sector. Our continued success is firmly based on the experience and capability of our people. Our consultants are highly accredited, and we invest heavily in training on an ongoing basis. We have strong foundations in a host of Information Secure Application is one of the leading consulting firms in Information Security. It takes pride in being a leading independent firm and works closely with its clients to address their security concerns Secure Application is an international expert in cyber security and risk mitigation that works with businesses to protect their brand, value and reputation against the ever-evolving threat 30 APRIL 2019

31. Security Architecture frameworks, IT Governance Methodologies and industry best practice principles, along with strong expertise in the selection, design and integration of solutions from a range of technical security vendors. security measures Application security testing Penetration testing Mobile application security testing gathering and investigations Proportionality providing balance and relevance Support providing what the client wants as well as what the client needs Continuous development of staff and technological resources • • • • • How do you amalgamate latest technology with your business objectives? Today, more than ever, successful technology executives must help their executive clients understand how technology fits into — or, even better, power in their business. CFOs are typically attracted to lower up-front costs and the ability to pay only for what you use. CMOs are typically looking to keep the company’s brand fresh and respond to changing market conditions. • How do your products and service offerings benefit your clients? With the growth in cyberattacks and data breaches costing millions every year to the business and public sector, cybersecurity is now high on the strategic agenda. By putting proper cybersecurity assessments and audits in place, organisations can define the right strategy and transformation program to protect their sensitive data and assets. This demand for speed leaves many organisations feeling that there is not enough time to spend on security, which increases the risk to their critical business applications. What are your present and future focus areas? We wish to build a strong presence in the cyber security market, and focus more on ‘CYBER SECURITY AS A MANAGED SERVICE’. Knowing the Visionary Shylaja Chandrasekar, CEO After joining as a CEO in the year 2008, Shylaja has replaced founders and integrated $50m acquired business into mainstream global business while improving efficiency by 40%. Her leadership has scaled the company to be the largest security testing company in South India. Her ideas have created new businesses, bootstrapped several new products and services from the ground up into profitability that is collectively valued at $70m. She has been the driving force behind the company’s success through the combination of sound business practices, leadership and expertise related to growing business through developing services and around software products. Secure Application is part of making this shift, but most of the hard work at the executive level revolved around understanding each executive’s pain points, what they wanted to get out of cyber security, and aligning technology to help them meet their goals. Our new services include IoT security testing, mobile application security testing, cloud security consulting, and cyber security consulting. In addition, we are currently focusing more on the BFSI sector and ecommerce portals which deal with customer credit card data. Secure Application experts have unmatched experience in application/mobile security in general and testing specifically. Every test we execute is reviewed by a security expert that analyzes the results, reduces any false positives, and provides remediation guidance. In all but our most basic automated scan, a security expert will call your team to review the test and discuss the remediation guidance to help them fix what we find. Our core security services includes: • A smooth transition from internal to external security teams • Develop a security roadmap unique to your organization • Reduce the costs of robust cyber What would you say are the factors that differentiate you from others in the domain? Our services are underpinned by its Core Values, which are: • Costing • Transparency and full legal compliance • Ethicality in our information She has co-invented a new product platform and business model for eliminating efforts on post-sales support, enabling rapid product development and reduced 17% software warranty cost of multi- billion dollar product line over 3 years. “We are committed to staying on top of the latest technology in the security industry. Adopting the situation and analyzing the environment are the best tools taken by us to give customer support in all circumstances.” Shylaja holds an MBA in HR from the University of Madras. She has also completed her CISA in 2010. SR 31 APRIL 2019

32. Global Security Solutions Provider: SECUDE S data protection for users of SAP software. Founded as a joint venture between SAP and Fraunhofer Institute in 1996, SECUDE maintained a close SAP technology partnership and became a reliable resource for security solutions for the SAP market with ‘Single Sign-On’ for SAP, which was acquired by SAP in 2011. With a focus on making processes for data security and protection efficient and automated with little or no user interference, SECUDE’s goal is to minimize the cost of roll-out and operations. ECUDE is an established global security solutions provider offering innovative and other sensitive information extracted from SAP systems. By integrating directly with SAP, HALOCORE protects data with automated classification, blocks unauthorized reports, and helps generate fine-grained access policies. This innovative approach allows enterprises to maintain a high level of control and security over sensitive documents extracted from SAP throughout their lifetime, even if these have been shared via email, downloaded to a recipient’s PC, or printed as PDF. ‘firefighter’ activities, the module provides real-time insight into which sensitive data is at risk of leaving the SAP system and sends e-mail notifications in case of data leakage. HALOCORE BLOCK: HALOCORE BLOCK effectively prevents business-critical data and documents from leaving the protected SAP application and, thus, protects against accidental or intentional data leaks. Directly integrated into SAP, it works based on the HALOCORE audit log at the source of all recorded data flows. Users without a corresponding SAP- authorized profile would not be able to download files. Furthermore, a granular, bespoke policy can be implemented using automated data classification, which tailors the control over SAP exports to the specific needs of organizations. HALOCORE MONITOR: HALOCORE MONITOR audits all exports and downloads of critical SAP data regardless of which egress point the data flows. Through pseudonymization, the audit log meets, by default, Works Council requirements. It is a key extension to the standard SAP Security Audit Log (SAL) and, furthermore, enriches the auditing data shown in SAP Enterprise Threat Detection (ETD) and SAP Digital Boardroom, especially as it audits all exports using an automated classification engine. Closing these GRC compliance gaps even during SECUDE’s solutions are trusted by many Fortune 500 and DAX listed companies. With branches in Europe, North America, and Asia, SECUDE supports customers with the implementation of IT security strategies through a global network. HALOCORE PROTECT: HALOCORE, through its PROTECT module, extends the SAP access control shield for Intellectual Property (IP), Personally Identifiable Information (PII) and Solution Offerings HALOCORE: HALOCORE is data security software that protects intellectual property “Data is your IP. Protect it before it goes out of hand.” 32 APRIL 2019

33. Meet the Leader Dr. Heiner Kromer, Chairman and Chief Executive Officer: Dr. Heiner Kromer is the Founder-Chairman of the Board of SECUDE AG. He brings over 30 years of experience as founder, partner, and CEO of high technology and consumer product companies. His experience and leadership powers SECUDE to be a force in the domain of SAP Data Security. He holds an Economics degree from the University of Erlangen-Nuremberg and a doctoral degree in Economics from the University of Zurich. Dr. Heiner Kromer, Chairman & CEO Message from the Chairman Data is the ‘new gold’. This adage may be clichéd, but with concepts such as the Internet of Things, Big Data, Machine Learning, Artificial Intelligence and so on, being increasingly leveraged by industries worldwide, it couldn’t be truer! However, this also means that data, such as IP, is the most precious commodity for any business and one that must be protected against all threats – internal and external. In these days of heightened security challenges coming across in all forms, technology, and human, one cannot be too sure against the array of challenges. But, as our research and experience prove, the greatest is the human factor especially caused by the one weak link in the security chain (malicious or otherwise). even Toxic Data and other sensitive data beyond SAP’s boundaries. HALOCORE intercepts the data being downloaded from SAP and applies fully customizable classification labels to the document metadata. As an SAP user, you would be aware that your data resides in the heart of your business operations – your SAP ERP system. But most SAP users are unaware of a hidden danger – data leak due to uncontrolled user downloads and data flows in the background. Thus, there is a real need for solutions that monitor and block such leaks from SAP applications. Additionally, HALOCORE is tightly integrated with Microsoft Azure Information Protection (AIP) and fully supports the implementation of Active Directory, Office 365, and Azure Active Directory. Using Microsoft AIP every document exported from SAP is automatically and efficiently encrypted at the server level before it arrives on any device. Using the automated HALOCORE classification engine, granular authorizations and user rights are assigned to sensitive data, allowing easy and secure exchange of documents between employees, partners or suppliers. I assure you that when it comes to your precious data in SAP, you have come to the right place. With over twenty years of core SAP experience, we understand the nuances of this enterprise platform as no other. In fact, SECUDE’s origins are from SAP itself and have ever since maintained close technology partnership. Today, our solutions are trusted by many Fortune 500 and DAX listed companies. -Dr. Heiner Kromer, Chairman, SECUDE 33 APRIL 2019

34. Modern Web Applications and Their Contribution to Handling Security in Enterprises T breaches. News regarding such activities is non-stop, and therefore, organizations need to realize that they have to fundamentally rethink their approach to protect their applications and data. It has been found that a significant amount of the security issues have come from a new generation of attacks that specifically target application programming interfaces, which have resulted in infringements at firms like Panera Bread, T-Mobile, Verizon, etc. In addition to that, even Google and the United States Postal Service (USPS) have been known to show some major API vulnerabilities. he recent years have witnessed a constant increase in the number of security services and IoT applications that offer a wide range of assets and security levels for different areas. shifted to the client side making it more complex than ever. Increasing Complexity in Applications Increases Opportunities for Hackers Gradually, hackers have found out new ways to use the complexity and uniqueness of present day application structures to their advantage. And as every organisation and application has a unique vulnerability, this generation of security breaches can’t be identified by a signature. Moreover, it’s very tough for developers to think in the exact dubious ways that an attacker does as the expertise of a developer only centres on functionality and not security. Applications Tend To Evolve With Time In earlier times, the applications and data that had to be secured were very simple when compared to the present day applications. Back then, basic and simple security solutions did the job of keeping hackers at bay while also offering broad and unmonitored access to authorized users. Their major components of defense were WAFs or typical web application firewalls focused on perimeter protection and guarding against known or predictable attacks, and that kept most of the hackers in search of undefended targets away. What’s alarming particularly is that breaches of these sorts are hard to detect; sometimes they go undetected for months together and even years despite the fact that organizations have deployed advanced security systems and practices that are meant to safeguard them. The problem lies in the dependence of organizations on security approaches that used to work in many environments earlier. But times have changed now. The situations that existed before are fundamentally different from the ones that are prevalent in organizations now. Therefore, a new security perspective is necessary. Firms can opt for modern SaaS, mobile, web, micro- But, with time, the way in which modern applications are built and deployed has evolved so that they can function effectively in both small and large organizations. Even application programming interfaces have multiplied across application environments to enable a greater access to a much broader range of users. At the same time, the quantity and sensitivity levels of the data generated and transmitted by applications have proliferated. Today, performing complicated tasks can be done by just using a laptop and mobile devices with web browsers. This means that process that required to be handled on the server side behind the firewall have Therefore, instead of expecting sound development practices aimed at nullifying security threats, protecting the modern environment with proactive ‘monitor and respond’ approach holds paramount importance. It’s completely unreasonable to have an approach that only focuses on secure perimeters and access controls. The APIs that form the core of today’s applications are as complicated and one of a kind as the environments to which they connect, and in their unique logic is where hackers find vulnerabilities and take advantage. So an effective 34 APRIL 2019

35. Modern Web Applications and Their Contribution to Handling Security in Enterprises security approach for modern web applications might be the one that offers a clear comprehension of the activities that users normally tend to have as well as the location and way in which sensitive information is stored. To be more specific, this indicates that an effective security solution must help a firm to understand the unique logic behind each and every API at a granular level so that they can become capable of distinguishing possible pernicious behavior and stop attacks. of APIs at the granular level, and hence, fail to recognize regular user behavior from malicious user behavior. Organizations have made various attempts to address the potential vulnerabilities by testing or white hat hacking each API, but this is a long experimentation process that cannot match the speed and intricacy of the modern development cycles, not to mention the evolution of hackers. security systems can distinguish the user initiating an action through an API, the target of that action and whether that action is appropriate for the user, the API and the application. This approach has the potential to identify the most subtle and advanced threat that are attempting to exploit unique features of an API or application to stage an attack or steal data. Web applications have come to evolve, and our security approach too needs to evolve to match up with its pace. So the most effective way to keep an attacker from exploiting unique API vulnerabilities is to keep track of API usage in a way that the Developing New Approaches to Attain Application Security Unfortunately, the conventional security measures lack the understanding of the unique logic SR js www CLOUD HTML5 XML .NET PHP ENTERPRISE A P P L I C A T I O N S .com .net .org database 35 APRIL 2019

36. Providing a Barrier against Threats that May Harm your Mobile Endpoints: Zimperium Shridhar Mittal | CEO The Face of the Organization So the IT infrastructure, specifically mobile, must adapt. Shridhar Mittal | CEO Shridhar is the CEO of Zimperium. Previously he was the GM of the Application Delivery business unit at CA Technologies (CA), where he was responsible for creating the DevOps vision and establishing CA as a leader in the high-growth space. At CA, Shridhar ran a global organization and led the acquisition of Nolio. Shridhar came to CA with the successful $330M acquisition of ITKO. Prior to ITKO, Shridhar had an 11-year career with i2 Technologies in various roles including pre-sales leadership, sales leadership, and various marketing and general management positions. He finished his career with i2 as the Chief Marketing Officer. Artificial Intelligence has been the buzzword, and it will continue to hit the stride. Do you think enterprises should embrace AI to drive much advanced cyber security? It depends on what you’re using AI for, and what problem you are trying to solve. In the case of endpoint protection, AI makes a lot of sense. Historically, endpoint protection was accomplished through signatures - - you had a large signature database and you compare that against potential threats looking for a match. The rate at which threats could morph as well as the volume makes this approach limited. Several new security companies adopted AI as their base platform to deliver better security for traditional endpoints and they are slowly replacing traditional endpoint security solutions. In the case of mobile, there is no legacy installed base to move from so you have the benefit of starting with AI-based mobile security which is perfectly suited for mobile given the overall signature issue and also some of the limitations you have on mobile that don’t lend themselves to large, overbearing security apps. C threats, phishing and application- based attacks with advanced machine learning. To provide a solution, Zimperium has helped define the market and it now stands as the #1 choice for Mobile Security Solutions & Mobile Threat Protection in the industry today. ompanies can finally defeat mobile security problems such as device threats, network and limitations of cloud-based detection—something no other mobile security provider can claim. Headquartered in Dallas, TX, Zimperium is backed by Warburg Pincus, SoftBank, Sierra Ventures, Samsung and Telstra. In conversation with Shridhar Mittal, CEO Zimperium, the global leader in mobile device security, offers real- time, on-device protection against Android and iOS threats. The Zimperium platform leverages its award-winning machine learning- based engine, z9, to protect mobile data, apps and sessions against device compromises, network attacks, phishing attempts and malicious apps. To date, z9 has detected 100% of zero-day device exploits without requiring an update or suffering from the delays What is the impact of cloud and big data on a company’s IT infrastructure and its security today? As more resources and corporate information is moved to the cloud, it will be accessed by various endpoint devices. There are protections in place to ensure traditional endpoints are secure as part of the access, but very little if any protections are in place for mobile endpoints (i.e. phones and tablets). 36 APRIL 2019

37. “ We are currently scaling various regions and aiding our customers by providing real-time on-device defense solution against known and unknown mobile threats.” A security firm has two big responsibilities, one – to secure oneself from being attacked and two –securing other companies against attacks. The first one can be tougher than the second; how do you manage both? Security is in our DNA so as we’re developing solutions for customers that are industry leading, we also apply the same mindset to our internal systems and IT environment. the customer is there is 100% adoption, as the mobile security is incorporated into any app update through the app stores. Lastly, z3A is our Advanced Application Analysis. z3A has analyzed millions of applications and the over 5,000 that are added each day to the app stores. The analysis gives IT organizations insight into the risk level of apps for privacy and security so they can make informed decisions on whether to allow those apps into their environment or not. is often integrated into the global IT security platforms of SIEMs or MDMs. Do you have any new product/service ready to be rolled out into the market? We continue to evolve our existing products as well as lead the industry in new and innovative solutions. Where do you see your company in a couple of years from now? Mobile security is a key piece of the enterprise security ecosystem, and Zimperium will continue to lead the mobile security market through innovation, customer service and strategic partnerships. What do you feel are the reasons behind your service popularity? We solve a real problem that organizations have. Mobile devices are the new endpoint and the favourite attack target of hackers. We protect the new endpoints with a positive customer experience at both the end user and administrative level. Can you talk about your products and services in brief? We have three primary mobile security solutions. zIPS is our on- device application that protects against all types of mobile attacks and is managed centrally through a Zimperium console and through integration with an MDM/UEM. It relies on the underlying z9 machine learning-based technology. zIAP is based on the same z9 technology but in an SDK form factor for easy integration to mobile applications. The integration takes less than 10 minutes and delivers the same protection against various mobile threats. The benefit of zIAP to SR How does your company contribute to the global IT security platform at large? Mobile devices represent 60% of the endpoints in an organization. Getting visibility into those endpoints is critical. The visibility 37 APRIL 2019

38. The Standard Security Perils Associated With the Modernisation of Network W adoption is booming thereby reducing the use of traditional corporate network models. SD-WAN offers the promise of lower capital expenditures and cut an organisation’s ongoing operational and management costs by around a half when compared to the traditional hardware-based approaches. It also boosts up the network efficiency. ith the increased adoption of cloud services, SD-WAN system, malware analysis and sandboxing. For that, it recommends organisations to deploy integrated and dynamic threat protection for multiple cloud connections at the cloud’s edge and the customer’s Internet/ WAN gateway points. Let’s take a look at the widely recognised security pitfalls that pose a threat for SD-WAN deployments. Leaving Traffic without Inspection Sometimes, users don’t have any idea about the configuration of their networks. As a result, the internet-bound traffic that leaves directly from satellite offices in certain SD-WAN architectures is not inspected. In many other cases, it so happens that the traffic is intentionally let to leave without any sort of inspection However, there is one area where SD-WAN is deficient in, i.e. advanced security functionality. According to a statement from the research firm Gartner most of the SD-WAN vendors support basic capabilities such as stateful firewalling and VPN, but they still have to depend on security partners for advanced functionalities such as intrusion prevention 38 APRIL 2019

39. Expanding the Area of Security Surface As many SD-WAN products and services are devoid of better security capabilities, firms need to add multi-factor authentication along with next-generation firewalls and endpoint protection. They also need to take care of their branch offices and mobile workers by adoptingcloud-based firewalls, strong VPN, and authentication protocols. With SD-WAN, firms can avoid backhauling traffic to headquarters and route them to the internet instead of branch offices thus ensuring reduced security risks and encrypted network connections. SR so that the MPLS backhaul could be reduced. most hackers. As soon as they infiltrate the network, they use their malware in order to find other vulnerable devices and exfiltrate data. However, lateral threats can be contained and stopped from spreading further if systems possess the capability to detect and quarantine compromised devices. Moreover, there are a significant number of cases, where the traffic under inspection lacks critically important firewall and endpoint protection capabilities like intrusion prevention, SSL decryption and malware detection and response. Consequently, malware and other attack vendors will find it easy to compromise the security in remote sites thus infiltrating avenues for threats to reach and propagate inside an organisation. Inadequate Network Segmentation It’s a tough job to secure traffic between workstations or other endpoints. Whenever, a threat or malware compromises a workstation, it’s not long before the problem affects other endpoints throughout the organisationas well. Network modernisation implementations need to have the visibility that offers them a look into the traffic and segmentation aspects in order to contain threats as soon as they enter the network. Lack of Proper Scrutiny at Endpoint Threats Presently, hackers prefer to conduct lateral attacks that spread from infected endpoints across the network. This has come to become a widely preferred technique by 39 APRIL 2019

40. Explained: 360 Enterprise Security Group Provides Users with Multi-Level, Multi-Dimensional, and Systematic In-Depth Defense Solutions to Ensure Truly Effective Security “360 Enterprise Security Group uses innovative means of Internet+ such as big data analysis to help the Chinese government and enterprises better respond to security threats.” N disclosure and disposal of personal information. At the same time, the rate of cyber-attacks, data breaches and unauthorized use of personal data is growing exponentially. In the current environment, it is more important than ever, particularly for those organizations handling financial data, health information and other personally identifiable information, to understand the rights and obligations of individuals and organizations with respect to personal information. ew laws are taking effect across the globe to regulate the collection, use, retention, is more committed to building enterprise information security ecological environment. In today’s cloud computing and large data age, the group provides users with multi-level, multi-dimensional, and systematic in-depth defense solutions to help them improve the comprehensive response to new security threats and ensure truly effective security. behavior management product. It provides a powerful web filtering, application control, outbound information audit, and application-level bandwidth management. Prevent and Block Malicious Network Activity – • Detect and pinpoint network/ traffic anomaly, take proactive action in real time • Block access to sites associated with spyware, phishing and malicious mobile code • Block communications initiated by malwares like Trojan, Spyware, and Virus 360 Enterprise Security Group was established in 2015 and is headquartered in Beijing, China. 360 Enterprise Security Group: Synopsis In view of the above-mentioned scenario, we’re delighted to present 360 Enterprise Security Group. Protect confidential information from leakage – • Monitor the outgoing traffic, including web, email, IM, etc. for compliance auditing • Monitor files transferred through FTP, HTTP, MSN, QQ, and Email • Alert and Block the unauthorized outgoing messages 360 Security Innovation Center 360 Security Innovation Center, built by the world’s largest Internet security company 360, and with the world’s elite talent and top technologies, has established three major research institutes: The National Network Security Research Institute, Enterprise Network Security Research Institute, and Personal Network Security Research Institute. Representing the most forefront network security thinking, the most advanced security technology, and innovative security products in China’s network security industry, it is an Asia- Pacific network security innovation center with global influence. 360 Enterprise provides new- generation security products and security services for the government and enterprises. The Group has integrated 360’s technical, human resources, products, data and service capabilities in the field of security. With “protecting the security of the large data age” as its mission, “data-driven security” as its technical idea, and data collection and analysis as its support, 360 Enterprise has launched a number of innovative security products and security services urgently needed by enterprise-class customers. From cloud to terminal, from the business to the data, from individuals to businesses, from before events to after events, the Group provides users with ubiquitous protection, and it not only focuses on specific security threats protection but Manage User Network Activity and Employee Productivity – • Provide comprehensive monitoring and analysis to evaluate employee productivity loss due to non-work-related network activities • Control 4,000+ protocols and applications, including P2P download, IM, Streaming media, online Gaming, brokerage and trading • Enforce policy according to user, application and content 360 ESG Internet Control Gateway 360 ESG Internet Control Gateway (ICG) is a professional Internet 40 APRIL 2019

41. Qi XiangDong, Chairman & CEO “360 Enterprise Security Group takes ‘protecting the security in the big data era’ as the mission, ‘data-driven security’ as technical thinking, and big data collection and analysis as support to provide escort and protection for enterprise users.” Ensure Business-Critical Application’s needs for bandwidth – • Provide visibility of network traffic, composition and trends so as to setup appropriate traffic control policies • Guarantee bandwidth required for critical applications • Limit or block the bandwidth- consuming/harmful applications to avoid traffic congestion and resource waste able to achieve precise control of each kind of network applications, a complete audit of all Internet data. ICG provides multiple internal ports and external ports, to act as multiple bridges at the exit of the enterprise network between the edge router and core-switch or sent at intervals to designated network administrators Syslog Reporting: supporting remote syslog servers to enable reporting SNMP Support: enables monitoring and management by 3rd party devices via the SNMP standard • • Corporate Vision Our corporate vision is to comprehensively enhance security protection ability and level of the Chinese government and enterprises and build a reliable network environment for economic development. Current corporate customers face unprecedented security challenges, which cannot be tackled effectively by traditional security mean. 360 Enterprise Security Group uses innovative means of Internet+ such as big data analysis to help the Chinese government and enterprises better respond to security threats. Simplifies Management and Administration – ICG is simple to configure and manage, providing: Integrates Seamlessly with Existing Infrastructure – 360 ESG ICG supports multiple deploy topology, it is simple to deploy within your existing infrastructure; there is no need to duplicate security appliances or re-architect the network infrastructure. • Centralized Management: allowing multiple appliances to be administered via Security Management Center technology (SMC), including system performance monitoring, health monitoring, configuration backup and scheduling and configuration synchronization E-mail Alerting: configuring logs to trigger alerts that can be immediately forwarded via email • Mirror Mode: ICG on mirror mode sniff network packets without affecting the normal transmission Inline Mode: this mode can be • • SR 41 APRIL 2019

42. a better ability and scalability to secure different types of data in different stages. • Encryption: Firms have to depend on encryption tools to secure data in-transit and at-rest across massive data volumes. These tools also need to be capable of working with different analytics toolsets and output data. • Centralised Key Management: This is one of the best practices to ensure data security. Usually used in environments with a wide geographical distribution, centralised key management involves on-demand key delivery, policy-driven automation, logging, abstracting key management from key usage, etc. • User Access Control: Firms need to invest in strong user access control to automate access based on user and role-based settings even if the management overhead gets high. That’s because practicing minimal control can lead to disastrous effects on the big data platform. • Intrusion Detection and Prevention: IPS enables security admins to protect the big data platform from intrusion, and in case the intrusion attempt succeeds, the IDS quarantines the intrusion before and significant damage. • Physical Security: The importance of physical security systems shouldn’t be ignored. It can control the access of data by strangers as well as staff members who don’t have the authority to be in sensitive areas. What Does Securing Big Data Platforms Mean in Today’s World? E enterprises has skyrocketed. Data volumes have been constantly expanding and firms want to extract value from the data in order to tap into the opportunities that it contains. But due to its centralised nature, it creates new security challenges. Also, big data deployments pose as valuable targets for attackers. ver since big data has come into use, the amount of information managed by granted; instead they should work in close association with their providers and have strong security service level agreements. Some of the typical challenges on the way to securing big data are mentioned below. • The relatively new technology of advanced analytic tools for big data and non-relational databases are difficult to protect with security software and processes Data is sometimes mined by big data administrators without prior notification or permission. The size of big data installation is way too huge for routine security audits Though security tools can protect data ingress and storage, they still fail to create the same impact on data output to multiple locations When the security processes are not regularly updated, firms remain at the risk of data loss and exposure When big data is subjected to ransomware attacks and data infiltration, organisations will have to go through severe losses. Therefore it is critically essential to secure big data platforms and in order to do that, a mix of traditional and latest security toolsets along with intelligent processes to monitor security is needed. • • • The Challenges and Pitfalls in Big Data Security Securing big data throw many challenges on the path of organisations. These challenges are not limited to just on-premise big data platforms but also pertain to the cloud. When it comes to hosting the big data platform in the cloud, firms shouldn’t take anything for • Big Data Security Technologies Big data security technologies have been existing since a while, and there’s nothing new about them. However, they have evolved to have SR 42 APRIL 2019

44. I entrepreneurs with decades of collective experience in cyber warfare and cyber intelligence. It was built to tackle what has been a significant and urgent problem for cybersecurity practitioners— the challenge to stop Advanced Persistent Threats (APTs) and other advanced attacks that bypass security controls and silently gain access to organizations’ most risk- sensitive and business-critical digital assets. Deceptions in Financial Services Financial institutions are one of the most high-value targets for attackers who “follow the money” and those intent on systemic disruption. Despite the vast resources financial institutions devote to cybersecurity, one challenge has been especially difficult to solve: the challenge to detect and stop APTs before real damage is done. llusive brought together top cyber-attack specialists and pioneering cyber technology litigation, patent applications, employee contracts—everything important happen with legal counsel. Law firms traditionally have been underinvested in security defences, so they are easy targets for advanced cyber attackers. In many cases, law firms are much easier targets for attackers than the firm’s clients themselves. Deceptions in Manufacturing With relatively little PII and payment data to protect, many manufacturers have felt relatively safe from the cross hairs of attackers. However, cyber attackers see things differently. With large investments in Intellectual Property (IP) and the evolution of Industry 4.0, manufacturers have become attractive targets. Deceptions in Healthcare and Life Sciences Whether your organization provides healthcare services, health insurance, or cutting-edge medical devices and therapies, health information systems have become increasingly digital, interconnected, and consumer- driven. In the process, they’ve also become attractive targets for data theft, identity theft, and insurance fraud and worse, as the recent spate of ransomware attacks has shown, cyber attacks on healthcare institutions can also disrupt vital services. The impact: loss of patient trusts, significant financial losses, regulatory scrutiny—and above all, the risk to patient safety. Given the frequency of successful targeted attacks, it decided not to continue with old approaches and expect to get different results. A new approach is needed. Illusive looks at the problem from the perspective of the attacker and exploits the attacker’s weakness. As fire needs oxygen, attackers – once they have found their way into a network — need reliable data that will lead them toward their target. By saturating the environment with deceptive information, Illusive creates a distorted reality that the attacker cannot confidently navigate. It’s a solution that disrupts the attacker’s operations — without disrupting yours. The company provides tools that help security teams detect and resolve advanced attacks, to prevent cyber incidents from becoming business crises. Today’s smart manufacturing relies on connected networks for manufacturing operations, production asset management, maintenance, and field service. Internet of Things (IoT) devices are critical components of smart manufacturing processes for collecting, aggregating, and delivering data. Complex connected networks and IoT devices—plus extended supply chains—create vast opportunities for attackers to make their way in. Once embedded in the network, it may take an attacker weeks or month to find what they’re Deceptions in Legal Services Mergers and acquisitions, SEC filings, corporate restructuring, Focusing On the Attacker than the Attack Illusive Networks Agile approach stops cyber attackers before they stop you.

45. after, but if they get to critical systems, catastrophic damage can be done in an instant. common: a vast and growing attack surface. RFID merchandise trackers, wireless POS systems, and a growing number of smartphone apps designed to improve customer experience add infinitely more avenues of potential entry for attackers. Customer trust and loyalty separate retail winners from losers, so while there is an increasing risk of downtime and data breaches, cyber incidents can also have a greater business impact than ever. SR Digital transformation and automation of supply and distribution chains have moved order-taking, payment processing, inventory management, and marketing operations online. Cloud infrastructure helps preserve razor- thin margins but also expands the security perimeter. “Smart” shelves, Deceptions in Retail Retailers maintain troves of the customer, payment, card holder, purchase history, and other data that are irresistible to attackers. From department store and big-box brands to grocery and restaurant chains, retailers have one thing in “Attackers have one fundamental weakness: they must make decisions — hundreds of them — during the attack process. We starve them of the credentials and connections they need for lateral movement. We surround them with deceptions so they can’t tell truth from fiction. One wrong decision... and it’s over. Your defenders have rich forensic insight to act. The attackers are caught. You win.” Moving Towards Success with the Company Ofer Israeli, CEO & Founder Having pioneered deception-based cybersecurity, Founder and CEO of Illusive Networks Ofer Israeli lead the company at the forefront of the next evolution of cyber defence. Prior to establishing Illusive Networks, Ofer managed development teams based around the globe at Israel’s seminal cybersecurity company Check Point Software Technologies and was a research assistant in the Atom Chip Lab focusing on theoretical Quantum Mechanics. Ofer holds B.Sc. degrees in Computer Science and Physics from the Ben-Gurion University of the Negev. Ofer Israeli, CEO & Founder

46. T industry. It had held an annual Channel Partner Day event that happened in Gangtok, Sikkim. The event ran for three days and many business leaders were part of the event. CEOs, directors of many organizations, and major decision-makers took part in the event. In the event, people saw an engaging session on the changing security landscape that is happening in India. Furthermore, the event clearly showed that there is a lack of skill set. Many organizations and individuals are yet to tap into the world of security and develop a solution for these advanced hackers and data pirates. Securing the world in terms of data exploitation has become a major priority in today’s generation. rend Micro is one of the players who has achieved a lot in the Cyber Security The Vice President of the Southeast Asia and India of Trend Micro, Nilesh Jain said that the company has always been thinking to be a channel-focused company. That is why it is trying its level best to deliver its solutions through channels. Channel partners of Trend Micro are certainly considered to be a great asset. It is the reason for Trend Micro’s success. That is why the company has plans to do more with it and is trying to build an ecosystem where the firm can leverage its channel partners’ security operations centres (SOCs). Furthermore, existing capabilities will also be enhanced, the working culture will be improved, and innovative solutions will be delivered to customers. In the end, the major goal is to grow alongside the channel partners and create a winning situation for both. Trend Micro, The Global Player in Cybersecurity solutions Now Announces its Launch of MDR services Through Channel Ecosystem To solve problems many companies showed an updated program and showed ways to tackle such threats. Trend Micro is one such company which is developing momentum around the TrendSetter Channel Rewards Program that was launched in the previous year. The firm wants to incentivize its channel partners’ sales. Also, seek to incentivize the technical team for the strategic solutions they offer. During the event Trend Micro had officially said that it will be providing managed detection and response services in India. These Manage Detection and Response Services (MDR) is an outsourced service for enterprises that are seeking to deepen the threat hunting or investigation capabilities. The company had also mentioned the shortage of cybersecurity professionals in India, for that MDR is a solution. It will aid in the 46 APRIL 2019

47. Trend Micro India Annual Channel Partner Day event in Gangtok & Sikkim augmentation of the company’s security team by providing external expertise and resources. This will be allowing many to proactively hunt for stealthy threats in the IT environment. This is the only way to avoid data breaches and also stop threats at an early stage. Organizations should be doing this and are the only way to avoid losing confidential data. are being used by almost 33 out of 40 large banks in India. Seven of the top energy companies are also relying on the same. Further, the top five IT enabled services which is the ITES companies are currently using Trend Micro’s hybrid cloud security solutions. The major telecommunication companies are not behind; they are also using the best network security and email hosting security solutions from Trend Micro. in its Bangalore’s office or training facility. Bangalore’s training facility is considered to have a state of the art infrastructure, which means the best quality of knowledge will be provided here by the company. Eventually through this people can take advantage of the advanced systems engineering job opportunities that are budding in the IT Security Industry. SR The Vice President also shared the roadmap of the future focus areas that will take place this year for the Indian project. Apex One is included for the endpoint security along with cloud security for firms that operate in a hybrid cloud environment. Through the use of MDR, network defence, more visibility through connected threat defence and virtual patching can be done. Trend Micro also has seen the tremendous growth in endpoint detection and response (EDR) and MDR in India. With this, it has even closed a few large enterprises deals around the country. Trend Micro’s connected threat defence solutions Trend Micro further expands in its certification program in IT security (CPITS). It is a full sponsored certificate that will last for two months. It intends to upskill people and the program is said to launch 47 APRIL 2019

48. S Madou, two globally recognized security experts. Through their combined security experience as developers, researchers, trainers, and consultants, Pieter and Matias had experienced the negative impact of insecure code and were frustrated by the industry’s focus on finding vulnerabilities, rather than fixing or preventing them. Both recognized that improving secure coding skills and outcomes would add a powerful layer of cyber protection for companies and would help them make better, faster code. Developers didn’t need to become security experts, but they could be empowered positively to be the first line of defense for their organization. ecure Code Warrior was co-founded by Pieter Danhieux and Matias clients’ teams use the tools in its platform, the better they’ll become at coding securely and the less time and money will be spent on fixing bugs. • One must embed security from the start, saving time, money, and resources in the software development lifecycle A powerful and measurable layer of cyber protection for in-house or outsourced developers can be added • Achieve Faster and More Secure Product Development with Secure Code Warrior In a world that depends on software, developers need to be the first line of defense for any company’s security strategy. • The secure developer skills shortage can be mitigated Clients can give their organization a competitive edge Clients can equip their developers with skills and tools to succeed • The team pioneered an innovative approach to improving secure coding skills and outcomes that is simple, scalable and positive, for both development and security teams. The team is driven by the knowledge that measurable improvements in security compliance, consistency and predictability will be matched by better quality and speed of code writing. And that creates an environment in which everyone can enjoy spending more time building, and less time fixing! • Solution Offerings Secure Code Warrior is a proven suite of secure coding tools within one powerful platform that moves the focus from reaction to prevention. The platform trains and equips developers to think and act with a security mindset as they build and verify their skills, gain real- time advice, and monitor skill development. Why Secure Code Warrior With Secure Code Warrior, Clients can empower their developers to code securely, achieving rapid improvements in security compliance and consistency, as well as enhance the quality and speed of code writing. The more Training: Secure Code Warrior’splatform enables developers to view their progress throughout their journey. They can see which challenges they have completed, their strengths and weaknesses, time spent on training, and their accuracy. 48 APRIL 2019

49. The gamified aspect of the platform offers hints and allows developers to earn points and collect badges, with anonymized leaderboards for teams. enables developers and AppSec to capture their knowledge in a best practice or code guidelines and automatically distribute that knowledge to the development team. Sensei provides an efficient solution to prevent vulnerabilities, empowering developers to write secure code from the very beginning. This puts an end to time-consuming and expensive fixes later in the software development lifecycle. The company is constantly expanding and updating the platform. Its platform currently has hundreds of short challenges, covering over 50 common vulnerabilities, including the OWASP top 10. It is also constantly updating its suite of languages and frameworks, and creating new challenges daily. Pieter Danhieux, CEO, Director, & Co-founder “ Sensei also offers defense against vulnerabilities that already exist within the code. Upon detecting an issue, Sensei highlights it while offering the developer a pre-defined fix. This allows developers to swiftly and consistently correct an issue across the company without referencing the in-depth research on how to remedy that particular problem. Tournament: Tournament on the Secure Code Warrior platform allows organizations to run competitive and engaging events that get the whole developer community involved. Players will be presented with a series of vulnerable code challenges that will ask them to identify the problem, locate the insecure code, and fix the vulnerability. All challenges are based on the OWASP Top 10 and they can choose from a range of software languages to compete in the tournament, including Java EE, Java Spring, C# MVC, C# WebForms, Ruby on Rails, Python Django, Scala Play, and Node.JS. Throughout the tournament, developers will earn points and they can watch as they climb to the top of the leaderboard and be crowned the ‘Secure Code Warrior.’ We help you in building a positive security culture that reduces conflict between security and development.” Meet the Leader Pieter Danhieux, CEO, Director, and Co-founder: Pieter Danhieux is a globally recognized security expert, with over 12 years’ experience as a security consultant and 8 years as a Principal Instructor for SANS teaching offensive techniques on how to target and assess organizations, systems, and individuals for security weaknesses. In 2016, he was recognized as one of the Coolest Tech people in Australia (Business Insider), awarded Cyber Security Professional of the Year (AISA - Australian Information Security Association) and holds GSE, CISSP, GCIH, GCFA, GSEC, GPEN, GWAPT, and GCIA certifications. Sensei: Sensei works by keeping every member of the team on the same page, filling the gaps in security knowledge without requiring tedious knowledge-based updates and referencing. It SR 49 APRIL 2019

50. S all the data that once required a desktop computer. Every single internet service is now offered through mobile applications, in addition to desktops, with numerous service providers have done away with desktop-based services altogether. Whether it is a mobile phone, tablet or a desktop, it is data that hackers are after. martphones have become integrated with people’s lives. It is now completely possible using smartphones, to access Why it is important for smartphones to be completely secure More and more working professionals today access corporate data from their smartphones. This results in a huge opportunity for cybercriminals to gain access to sensitive data and cost a company millions in damages. While most of the commonly available phones have protection against malware, there are numerous ways in which dedicated hackers can still 50 APRIL 2019