IARM Information Security

Please describe your company and your position there.

VDart Digital focuses on creating products and platforms which enable digital transformations within the Blockchain, IoT, Analytics, Cloud, Cybersecurity, and Artificial Intelligence spaces for our customers. We understand how to bring these new technologies together along with your existing data and systems to drive maximum value in a coherent holistic architecture. VDart Digital works with startups and established brands that are pioneering innovation in their respective domains. Our comprehensive knowledge, industry expertise and unique service capabilities have enabled us to leave a global footprint across U.S.A, India, Mexico, Brazil, Australia and the United Kingdom. I am working as the Manager for Information security for VDart.

For what projects/services did your company hire IARM Information Security?

We looking for a company that would help us in achieving the ISO 27001:2013 certification.

How did you select IARM Information Security and what were the deciding factors?

When we were searching online we found many companies with the same profile. We short listed them to 5 out of which IARM was a one of the leading companies in ISO/IEC implementers.

Describe the project in detail and walk through the stages of the project.

We had all the process drafted with policies and procedures in place. This helped us to identify the gaps in the system. We had carried out security audit which helped us to understand the potential risk on our infrastructure. WAPT was carried out along with VAPT to understand the risk involved. We cleared all the security recommendation that were sent in and all the vulnerabilities were addressed and closed.

How many resources from the IARM Information Security team worked with you, and what were their positions?

1. CISO 2. 1 Security analyst 3. 1 Process specialist

Can you share any outcomes from the project that demonstrate progress or success?

They were able to identify the risk and the gaps in the system. They helped in setting the process and drafting the policies to be in place for effective functioning of the organization. They took the time to teach us additional security practises. This helped us implement the industry best practises.

How effective was the workflow between your team and theirs?

It was very effective we used to have session on Zoom which helped us to propel our project.

What did you find most impressive or unique about this company?

They offered multiple services based upon request, and their services were very prompt in completing the project.

Are there any areas for improvement or something they could have done differently?

WAPT/VAPT testing took a bit longer but their expertise paid off in the end.

Introduce your business and what you do there.

Our energy company is an SPV incorporated by IL&FS Group under the energy platform (i.e. IEDCL) for implementation of the Thermal Power Project (“Project”), at Cuddalore in Tamil Nadu. The company is setting up 3180 MW thermal power plant in certain locations in India.

The project is being implemented in Phases. Phase I of the project is for 1200 MW comprising of 2 units of 600 MW each. Second phase shall have 3 x 660 MW.

I head the Information Services Function for the entire organisation which includes IT Infrastructure Support, Information Security for both IT and OT Networks.

What challenge were you trying to address with the vendor?

The Challenge’s that any organization would face with regards to Cyber Security and Information Security were no different for our organization as well. The Service Provider had the capability and trained and professional resources to identify the GAP and provide appropriate solution and services to the identified GAPS.

What was the scope of their involvement? 

The Scope that was involved were to identify the Security Vulnerabilities within the organization entire IT Infrastructure including the corporate office, Plant Networks, Industrial Critical Systems (SCADA) Cyber Security Audit and as well as the hosted Data Centers.

Over and above, the awareness of Cyber Security and its relevance to the Business framework was an add on by the Service provider which helped to work on consecutive engagement with service provider. 

What is the team composition? 

The Project team has the technical assessment team specialized in Vulnerability Assessment, Penetration Test of Network, Web Application as well as Mobile Application. The Process evaluation pertaining to the compliance needs of the Business requirements was headed by the Compliance Process/Delivery Lead. The entire Project was overseen by the Project Manager and the Director of the Service Provider Organisation.

How did you come to work with the vendor?

Based on their presentation and capabilities and proof of concept approach, the service provider was evaluated to work with us. Meticulous verification of their capabilities and reference from other similar organization were taken into consideration before assigning the project to the identified Service Provider.

How much have you invested with them?

Even though this is a confidential information, we have so far invested about $10,000 to $50,000, over the period years to improve and enhance on the cyber security controls.

What is the status of this engagement?

We have made the engagement as one of the continuous effort processes. The management has included as part of the Business Program (i.e.) Systematic Security Assessment Program.

What evidence can you share that demonstrates the impact of the engagement?

Cyber Security and Information Security involving Confidentiality, Integrity and Availability are sensitive in nature. However, with a valid Non-Disclosure agreement, the evidence may be shared based on the Legal counsel final decision.

How did the vendor perform from a project management standpoint?

The Vendor/Service provider did spend a quite a good amount of time to understand the requirements and then it was revalidated from our end. The Scope of finally arrived with all the associated results of the Risk identification process and appropriate mitigation plan whilst carrying the project.

Similarly, all due attention to the sensitive nature of the project was well planned and necessary resilience were put in place in order to minimize any disruption during the Project Life cycle. The estimate of time was precise including the revalidation of the process.

What did you find most impressive about them?

Their documentation skills with the attention to details and playback session to under our requirements and to ensure that both the parties didn’t have any assumption was really impressive.

The agile nature of the work carried out was equally impressive. The entire team has the same focus stating “Security is nothing but being transparent” in the approach. Technical knowledge and their attitude to include everyone to contribute to this project was something unique to this organization.

Are there any areas they could improve?

I would recommend that they establish themselves in other international market so that they have better working opportunities with our other Group companies as well.