Download as pptx, pdf, or txt
Download as pptx, pdf, or txt
You are on page 1of 22

Cyber Security

Capabilities and Case Studies

October 2022
TCS Cyber Security Practice Overview

500+ 100+ 25+


GLOBAL
SECURITY IP’s and
3200+ 370,000 +
OPERATION Accelerators Incident Handles
Customers CENTER Devices Monitored
Daily and Managed

20 + 8000+ 8
Years' Experience DEDICATED 2.9 bn+ 100%
CYBER SECURITY CENTERS OF
PROFESSIONALS
Events Monitored ITIL Based
EXCELLENCE Daily Delivery

A full-service security player with Consulting , Integration and Managed Security Services

Scripting Enterprise Vigilance


Security Thought Leadership
Platform Our Recognitions
✔ Leader in Managed Security Services
✔ Leader in GDPR services
TCS HackQuest
✔ Execution Powerhouse for Managed Security Services
Gamified Hiring
✔ Star Performer in PEAK Matrix Assessment
Platform
✔ CREST Accredited Pen Testing Methodology
2
TCS Cyber Threat Management Centers (TMC)
13 + TCS Threat Management Centres| Geographic Spread

Bloomington: Bhubaneshwar
Focus Area: Threat Hunting, IAM Professional
Focus Area: Application Security , DevOps &
Services, Security Operations Center, Tools
Deployment Professional Services
Manchester transitions technology solutions , Security
Focus Area: Penetration Testing , Red Teaming training programs
Threat Hunting , Professional Security and
Security Operations center Kolkata | Delhi | Indore
Focus Area: Network Security , Analysts of new &
Zero-day vulnerabilities ,Security Advisory ,
Microsoft Azure Cloud Security .

Hyderabad
Focus Area : Fraud Management and Digital Forensic
Madrid Services, Security Advisory
Focus Area: Penetration Testing , Red Teaming
Threat Hunting , Professional Security and
Queretaro Security Operations center Chennai:
Focus Area: Penetration Testing , Red Focus Area: SOC Services ,Vulnerability Analysis,
Teaming Threat Hunting , Professional Security Advisory , Security Tools management
Security and Security Operations center

Pune | Gandhinagar
Focus Area: Mobile Security , Develop New Means & Methods Bangalore
Security Research to prepare enterprises to handle exposure of enterprise data to Focus Area: ICS, OT Devices Security. IAM
Labs mobile users ,GRC ,Vendor Risk Assessment Professional Services, Security Operations Center

The TMCs offer comprehensive and integrated threat management


3
services across IT, OT , IoT , Cloud ecosystems.
TCS Analyst Recognitions for Managed Security Services (MSS)
Analyst Recognition – Published in 2020 Analyst Recognition – Published in 2018

∙ IT Security Services PEAK Matrix® Assessment 2020. ∙ NelsonHall: Cognitive Threat Management NEAT
TCS recognised as 'Leader & Star Performer in ∙ TCS CSP has been positioned as a ‘Leader’ within NelsonHall’s Cognitive Threat Management
Everest Security Services‘ NEAT 2018 and was positioned in the Leadership quadrant by Nelson Hall for GDPR Services
∙ MarketScape Asia/Pacific Managed Security Services ∙ IDC: Security Services MarketScape, Canada
2020 Vendor Assessment. TCS recognized as ∙ TCS CSP is recognized as Leader in IDC MarketScape: Canadian Security Services 2018 Vendor
∙ TCS is categorized as LARGE Managed IT Service Assessment
provider as part of Forrester Now Tech European ∙ NelsonHall: NEAT GDPR Services
MSSP ∙ TCS CSP has been positioned as a ‘Leader’ within NelsonHall’s first-ever NEAT vendor
evaluation for GDPR Services.
Analyst Recognition – Published in 2019 ∙ IDC: APAC MSS Vendor Assessment
∙ IDC has recognized TCS CSP as Major Player as APAC MSS vendor for 2018
∙ TCS recognized as ‘Leader’ in Managed Security
∙ Everest: GDPR Services PEAK Matrix™ Assessment 2018
Services Marketspace survey by IDC APAC
∙ Everest has recognized TCS CSP as Major Contender 
∙ NelsonHall: CyberResilience services- NEAT report
∙ TCS CSP has been positioned as a ‘Leader’ within
NelsonHall’s CyberResilience services-NEAT 2019 Analyst Recognition – Published in 2017
∙ HfS: Top 10 MSS provider report ∙ Everest: IT Security PEAK Matrix Assessment Report
∙ TCS CSP has been positioned in the top 10. ∙ TCS CSP is recognized as a star performer and major contender in Everest’s IT Security PEAK
∙ Everest: IT Security PEAK Matrix Assessment Report- Matrix Assessment Report
2019 ∙ NelsonHall: NEAT: Cognitive Threat Management
∙ TCS CSP is recognized as a major contender in ∙ NelsonHall has positioned TCS CSP as a Leader in its NEAT research report on Cognitive Threat
Everest’s IT Security PEAK Matrix Assessment Report Management
∙ Gartner: Featured in IAM Market guide ∙ HfS: Trust as a service blueprint report. 
∙ TCS CSP is positioned as “execution powerhouse”
∙ Gartner: Mentioned TCS CSP in Market Guide for IAM Professional Services, North America
4
What Differentiate Us From Others
❖ Accountability & Ownership : TCS SOC Operations will ❖ Pre-Built UEBA /SOAR use cases
demonstrate requisite accountability & ownership to over-all that addresses insider threat TCS Partnering with Gartner
improve the incident detection & response by augmenting
❖ Multi-Language Dashboards and Leaders
Customer's . We will offer requisite flexibility & reactiveness
towards the same. Repots
❖ Thought Leadership and Domain CoE’s ❖ Incident forensic investigation
❖ Program governed by TCS’s Cyber Security Practice with its support
proven MDR capability & experience of servicing 96+ SOC ❖ TCS Threat Intelligence Feed &
engagements globally, operating 13+ Threat management Reports
centers across globe.
❖ Management commitment of a quality delivery offering robust ❖ Security Threat analysis Support
governance & transparency and addressing current operating ❖ End To End MDR Service CatLog
challenges (SOC analysts skill gap, Flexibility & ownership
issues) ❖ Out of the box integration with IOT & Telecom device and
❖ BCP Led Delivery Strategy to Deal Covid-19 kind of Pandemic applications
❖ Expandable online and Offline Archival Storage within cloud
Situation-SBWS
environment
Executed a Complete BCP / DR process overcoming Pandemic Challenges
A full-service security player from Consulting , Integration and Managed Security
Reinforcing Business 4.0™ in Our MSS
https://www.gartner.com/doc/reprints?id=1-1YEGB0LF&ct=200219&st=sb

5
Our Digital Security Offering Portfolio
Identity and Access Advisory & Identity Web Access
Privileged Access Risk Analytics,
Integration Management & Management Identity as a
Management Management MFA
Services Access Governance SSO, Federation Managed Service
IdentiFence™
Governance Risk and Third Party Control Instrumented
Data Privacy Strategy and
Compliance Risk Testing Governance Program
Assessment

Platform-based Services (Shared


GRC as a Service
Enterprise Vulnerability Red Team / Vulnerability Application
DevOps Security Infrastructure
Management Ethical Hacking Management Security /
Security
Services Mobile Security

Digital Forensics and eDiscovery Digital Forensic &


Digital Forensics Cyber Security Vulnerability
eDiscovery Malware Setting up Management as a
Consulting Readiness Incident
Analysis Forensics Lab Service
Assessment Policy Framework

or On-demand)
Cognitive Threat Security monitoring
Threat Security Incident Infrastructure
& Operations, Use Case
Management Reporting & Intelligence and Response Development Threat Protection
Advisory Digital Forensics as
Management & Data Protection a Service

Cloud Security Cloud Security Cloud Advisory & Cloud Security Cloud Security Cloud Governance
Assessment Architecture Implementation Operations
Cyber Vigilance
Platform
Security Design Security Security
IOT/ICS Security Assessment
Threat Detection Vulnerability (CVP)
Enforcement Assessment

6
Learnings & Best Practices

• Shift Left – Reduction of tickets moving to • SOC Design, build and SIEM implementation with business
Tier II teams alignment
• Response time improvements Greenfield • Development of playbooks for SOC team to handle various
Efforts SOC Setup
• YoY Productivity enhancements types of incidents
Optimization

T3

• Lack of visibility around the SOC strategy and


• Base lining of environment
• Introduced TCS threat intelligence feeds to Detection SOC operational process
Learnings Process • Build the SOC strategy ,technology architecture
boost detection capabilities Enhancements Development including operational handbook documents
• Introduced new use cases based on global
• Build the Threat Modelling , Use Cases and audit
learnings and threat actor
Logging policies

• Lack of data availability to conduct forensics


Automation investigation and root cause analysis of
Investigation
incidents.
• Integrated the SIEM tool with case management • Reduce Dwell Time and Mean time to resolve
solution to reduce MTR • Training on the new platforms e.g. EDR, UEBA
• Orchestration and automation of containment and
incident response using scripts

7
TCS Cyber Security Practice | Services Offerings Portfolio
End to End Service Offerings to enable Cyber Resilience
Security Consulting , Enterprise Security Architecture & Standard Based Assessments

Managed Detection and Enterprise Vulnerability Identity and Access Governance Risk and
Response (MDR) Management (EVM) Management (IAM) Compliance (GRC)

Incident Response
Security Tools and Data Privacy and Protection OT / IOT Security Management and Digital
Engineering (DPP) Forensics

Cloud Security (CSS)

Platform-based Services (Shared or On-demand) Emerging Offerings

Vulnerability
Encryption as a Managed Detection Security for AI/ML
TCS IdentiFence™ Management as a
Service & Response for eco-systems
Service
Connected Vehicles
Cyber Vigilance Digital Forensics
GRC as a Service Network Security
Platform as a Service
Offering for 5G

Cloud Calibur

8
TCS SOC Services
Security Monitoring & Hunting
Consulting Professional Managed
• Security Monitoring, investigation and
threat Hunting • Assessment • SOC • Monitoring and
• Framework Implementation incident
Incident Response management • Critical Incident response
Development
mgmt and
Solution Offerings

• Readiness assessment, Framework • Technology


Setup and incident response investigation Maintenance

Digital Forensics TCS Global Network Delivery Model

• Digital forensics and malware Primary Onsite Onsite/Offshore Primarily Offshore


analysis

Security Technology Operations Reduced Reduced Reduced

Benefits
Increased
Compliance business reputation cost of
• Tool configuration, change and confidence
down time damage investigation
release management

9
Threat Hunting Service
Report &
Define Prepare Assess Conduct
Feedback

• Define specific
systems or • Prepare report for
• Identify the goal of networks to be • Identify the Threat hunting
• Assess the
threat hunting to included in hunt analytics excursive
availability of logs
meet business • Define hypothesis technique to • Provide feedback
on analytics
objective in alignment with perform threat to monitoring
platform
• Identify the Hunt Goal hunt team as per the
• Assess the health
purpose of the • Define logs type • Execute threat result of hunt
of analytics
hunt and logging level hunting as per • Identify issues /
platform to
• Desire outcome of required for each identified concerns, update
perform Hunt
threat hunting hypothesis hypothesis the hunt plan and
• Prepare Threat rerun hunt cycle
Hunting Plan

10
TCS Threat Intelligence Services
TCS approach for Threat Intelligence Services Benefits
Develop capability to share, early warning based on the global risk context in the
form of IoCs, TTPs and vulnerability advisories
Cyber Threat Propose and place TCS threat intel platform powered by Recorded Future feeds for Introduction of Structural
commercial Threat Intel feeds and to automatically process intelligence in a tightly Approach with inclusion of
Prevention External Cyber Risk Scoring (As
integrated manner.
part of CVP)
TCS Threat intel Centre of Excellence will share Threat Advisory and Intel Feeds
enriched with Operational & Tactical Intelligence for better correlation and decision
making

Cyber Threat Integrate the IoCs and TTPs from intelligence platform with SIEM to enable
Detection automatic detection of threat vectors Enriched Quality of Feeds

Cyber Threat Enrichment of the incidents or alerts automatically in integration with SIEM with
Response proposed threat intelligence services
Contextualize Intelligence by developing specific use case as part of SOC

Enriched application of threat


intel feeds
Threat Hunting Leverage /utilize Threat Intelligence service provided IOCs and TTPs for developing
hypothesis models, and retrospective IoC hunting by proposed threat hunting team.

11
Network Security Snapshot
Footprints Alliance & Partnership

500+ IPS\IDS
Network Security Engagements

1500+
Network Security Engineers

50,000+
Network Security Devices Managed

100+
Global/Fortune 500 Clients

25+
Countries

80%
Certified Associates

Joint Solutions Risk Averse Execution Reduced Time to Provision Comprehensive Security Experience
Single console visibility for Customized execution
advance threat protection, Accelerated solution delivery Expertise in multilayer security products
approach comprising rapid, and specialized teams
email & web protection, powered by pre-built knowledge
incident detection and threat incremental and measurable
base and expertise
analytics across the enterprise steps.

12
TCS Enterprise Vulnerability Management Service

Ethical Hacking Vulnerability Management Secured SDLC

▪ Asset Discovery
▪ Dynamic Application Security Testing (DAST) ▪ Threat Modelling
▪ Scanning Prioritization
▪ Static Application Security Testing (SAST) ▪ Architecture and Design Review
▪ Security Configuration Review & Hardening
▪ Free Open Source Software (FOSS) Audit ▪ Secure DevOps Enablement
▪ Vulnerability Remediation Management
▪ Web Application Penetration Testing ▪ CI/CD Security Tool Integration
▪ ZERO-Scan
▪ Infrastructure Penetration Testing ▪ Code Sanitization
▪ Doomsday (Breach Risk Prediction)
▪ Red Teaming ▪ Setting up Security Center of Excellence
▪ Asset Threat Profiling
▪ Web API Security Testing
▪ Security Advisory
▪ WAF Analysis
▪ Infra Vulnerability Assessment
▪ Website Perimeter Scanning
▪ Vulnerability Assessment of Cloud Infra (IaaS/PaaS)
▪ Mobile App VA/PT (Android/iOS)
▪ Proactive Patching of COTS Applications

TCS : CREST Global Accreditation


TCS is qualified CREST global member in penetration
testing services starting 01 June 2018
5 Dedicated EVM Security labs 2700+ Vulnerability assessments

120+ EVM security customers 4 HackQuest :The online ethical Dedicated online Redteam Lab
hacking contest

13
Identity and Access Management (IAM) Services
Experience Across Industries Experience Across Products Experience Across Geographies

500+ Engagements executed

clients (mostly Fortune 500


200+ companies) serviced
US
India Canada
49% 7% 4%
Person hours of IAM
1 mn+ experience gained as a result
UK & EU APAC
of: 34% 6%
75+ large scale products IAM Skills Distribution Across Roles
deployment
3K+ Applications integrated

1,000+
48% 12% 9% 31% Resourc
es

BFSI Telecom Manufacturing Others

Breadth and Depth of IAM Experience and skills across Industries, Products, and Geographies

14
TCS Governance Risk and Compliance Services

• Policy Management Consulting Professiona Managed


l
• Risk Management
• Tool Assessment • Package • Break fix support
• Compliance Management • Control Design Development • Maintenance
GRC Modules by functionality

• Workflow Design • Package • Content


• Enterprise Management • Roadmap Implementation Management
development • Health check & • Small Enhancements
• Incident Management Performance Tuning
• Operational model • Configuration
• Platform Migration
• Vendor Management establishment Management

• Threat Management
TCS Global Network Delivery Model
• Business Continuity Management Primary Onsite Onsite/Offshore Primarily Offshore

• Audit Management
• Issue Management Reduced Improved Better Improved Reduced
time to ROI on service cost of
• Security Operations Management utilization

fits
technology
Be
ne
market quality operation
s

• Vulnerability Risk Management


15
TCS Value Proposition for Data Privacy & CoE
Competencies Solution Accelerators Global Presence
Engagements for Privacy Readiness
20+ Assessments & Remediation

Consultants engaged in Privacy Privacy Impact Assessment Application Prioritization


80+ projects globally Methodology and Questionnaire Framework

GDPR Mandated documents (Data


1000+ Flows and Records of Processing) Data Privacy Control Risk Classification Criteria
Frameworks and Framework
Applications assessed for Privacy • Global Insurance Company
2000+ compliance & risks remediated Vendor Risk Assessment Test Data Management • Largest Finnish Telecom Organization
Methodology and Methodology and
Risks Identified Questionnaire Questionnaire • Scandinavian Insurance Company
5000+ (Application/Organization level) • Leading Nordic Postal Organization
• Global Car Rental Organization
• Global Hotel Group
• Leading European Bank
• Leading Nordic Airlines
• Leading Norwegian Bank
• Leading Swedish Insurance Company
• Leading Nordic Insurance Company

16
Our Success Stories
US Insurance Service Provider Europe Hi-Tech Client Europe Life Sciences Client

• Defense in Depth Controls in Azure • TCS engaged from Consulting, • Providing 24x7x365 Security Operations
Cloud Implementation and continued support Center Services.
• Identity and Access management along for Advanced Threat Detection and • Integrating TCS Threat Intelligence to
with adaptive Authentications Management . QRoC provide knowledge based evidence
• Network Segmentation , End Point Security • Implementation of Security Infrastructure for informative Decision while
• East West Security along with North South and Tools comprising AV, HIPS, DXL, ATD responding incidents.
Security integration. • .Vulnerability Management using
• PKI Infrastructure • Providing Managed Security services Nexpose solutions
• Application Security across IT infrastructure .
• Security Monitoring and Incident
Management via TCS SOC Platform
Europe Manufacturing UK Retail Client Europe TTH Client

• SIEM and Vulnerability Assessment • Providing 24x7x365 Security Operations • Implemented Security Information and
• 24 X 7 Security Monitoring and performing Center Services for E-Commerce Events Monitoring (SIEM) System to
analysis on the SIEM events Platform enable Security Operations Center
• Vulnerability Assessment for 3000 internal • Integrating X-Force to QRoC provide – Customized Correlated Analysis and
and external facing assets knowledge based evidence for informative Reporting
• Yearly Penetration Testing Decision while responding incidents. – 24x7x365 enabled Security Operations
• Security Configuration Review • .Monthly and Weekly Reporting Center
• Application Security Testing for 120 key • WAF and Bot Management Logs monitoring – Implemented TCS Threat Intelligence
business applications • Usecases for Azure platform components Platform
• Develop monitoring usecases based on • Customer Service Improvement Initiatives – Process Improvement Initiatives to
business requirements • Transformation Projects Support Audit and Compliance
Requirements

17
Case Study | End to End managed security services
Customer Overview TCS Solution
1. TCS built Cyber Security Program aligned with Client's Information Security Manual
Customer is a leading flag carrier of Sweden, Norway, and Denmark, which and Client's IT Strategy
together form mainland Scandinavia. Headquartered in Sweden, the 2. TCS has providing the following security services:
Organization is a founding member of the world's largest airline alliance, Star • Malware and Advanced Threat Protection for core systems, endpoints and
Alliance. communications channels
• 24x7 Security Incident Management, Intrusion Detection, Threat Intel,
Threat Hunting, Monitoring, SIEM and IT-Forensics
Customer Challenges • Patch Management and Vulnerability Scanning
• Improve insights into Security • Security Reporting regarding Information Security KPI
• Detection of unknown targeted attacks in real time • Operational Security (access points, endpoints)
• Streamlines security operations • Information Classification Framework as well as Data Loss Prevention for
Data-in-Use and Data-in-Motion and Data-at-Rest
• Provide a 24x7 SOC to respond and proactively preventing Cyber Security
Tools Incidents
• Vision - Agile, Proactive Information Security Organization able to foresee
∙ SIEM – Splunk and prevent Cyber Security Incident.
∙ Windows Defender ATP for endpoint monitoring • Pen Testing
∙ McAfee ePO • Certificate Management
∙ Nessus • Security Awareness Training
∙ Cisco Firewall
∙ Palo Alto
∙ Cisco AnyConnect • Pro-active use case building
• Action Trackers for all actions to be accomplished.
∙ Active Directory
• Enhancement Plans for improved environment security.
∙ CyberArk • Proactive Creation of Dashboards for clear Client understanding

18
Distinctive security services including SOC, Vulnerability Management , Certificate
management, covering 35+ worldwide locations, 5000 EPS 1000+ integration points
Customer Overview TCS Solution
French pharmaceutical company headquartered in Paris, France. It develops SOC/SIEM
and markets medications used in oncology, neuroscience and rare diseases • Support - 24 X 7 Security Monitoring with MSSP model.
along with consumer healthcare products and its spread across 35+ locations • Integration of 1000+ log sources with the SIEM tool.
worldwide. • SIEM tool-based log collection and use case creation based on the customer
needs.
Customer Challenges • Initial Triage and analysis of alerts to identify incidents for investigation.
• No security monitoring and detection tools • Follow up on incidents until till closure and remediation.
• High no of vulnerable systems and unpatched OS • Investigation of identified security incidents along with Customer security
• No Proactive Monitoring team.
Vulnerability Assessment
• Support – 8*5
Tools & Volumes • Manage vulnerability management program .
• SIEM Tool – QRoC(QRadar on Cloud) with 5000 EPS and integration of • Vulnerability discovery and closure tracking .
1000+ log sources . • Performing the dynamic application security testing using manual and
• Nessus Vulnerability management with 500+ IP’s scanning quarterly.
automatic methods to find the vulnerabilities and follow up on remediation.
• Web Application Scan(DAST)– Burpsuite and web inspect testing of 10
Public Key infrastructure(PKI)
application a month. • Support 8*5
• PKI – Microsoft PKI certificate management. • Managing the certificates life cycle .
• Monitoring the CA.
Benefit • Troubleshooting and installation of certificates.
• Continuous visibility into IT infrastructure security posture. • Managing close to 3000+ certificates
• Improved ability to detect and react to IT security events.
• Identification of common vulnerabilities leading to focused remediation
activities to improve security at the sites.
• Remediate and update the security patches , unwanted software removal.

19
Case Study | Converge 21+ Business Units into a Single Group for World’s Largest
private trading group & Energy holdings across 24+ countries

Customer Overview Solution


Market Leading Europe based Energy & Resources organization spread
across 24+ countries based out of Netherlands, Europe • Phased wise pragmatic on boarding of 21 Business units
• Build Security Operation Centre for 24*7 security monitoring
Customer Challenges • Co- creation model to drive Cyber Resilience along with customer
• Improve insight into security • Streamlining processes and activities
• Settling minimum standard for all business units and monitoring risk • Centralized Security operational model to improve the effectiveness
• Sharing threat intelligence across group companies of the security operations and threat intelligence
• Implemented a dedicated QRoC SIEM platform shared across
business units providing economies of scale covering ~11,000 EPS.
Tool & Volumes • Augmented Security Operations with TCS Threat Intelligence
• IBM QRoC , 11000 EPS platform to drive pro-active detection
• Holistic view on vulnerabilities and integration of other security
Benefit solutions such as Windows defender ATP etc. to SIEM platform
• High Return on Investment • Continuous innovation through COE collaboration
• Reduced MTTR for security incidents • POC on next gen security solutions to drive automation and MDR
• Improved Security Compliance. capabilities
• Real time monitoring of security incidents • Dashboards, reports and transparent governance to leadership
• Cost Optimization • Integration of native Microsoft solution alerts to SIEM

20
Case Study | Most Exclusive Cyber Risk Program across IOT for Leading
Manufacturing Organization covering 4000 servers, 16000 endpoints
Customer Overview TCS Solution
A Dutch company and currently the largest supplier in the world of
photolithography systems for the semiconductor industry. The company Setup 24*7 SOC Operations
manufactures machines for the production of integrated circuits, such as • 24 X 7 Security Monitoring
CPUs, DRAM memory, flash memory • CSIRT - Incident Response
• Coordination for causal analysis and Remediation
• Security maturity improvement aligned to NIST framework
Customer Challenges End Point Protection
• No holistic Security posture View • Manage McAfee tools : AV, HIPS, TiE and ATD
• No Proactive Monitoring Vulnerability Assessment
• High no of out of dated and noncompliant antivirus agents • Manage vulnerability management program
• High Business risk due to unknown vulnerable systems • Vulnerability discovery and closure tracking

Tools & Volumes Benefit


• Splunk ;200GB/Day • Proactive Threat hunting for identified use cases
• McAfee AV : 4000 servers, 16000 endpoints
• Reduce cost of security operations with Hybrid Delivery
• 70 IPS Fortinet
• Darktrace ATD solution Model(Offshore/Onsite)
• • Improved security posture
Nessus Vulnerability management
• Enhanced compliance to regulatory requirements
• Reduced MTTR for security incidents

21
Thank you

Copyright © 2022 Tata Consultancy Services Limited

You might also like