Godrej Industries leverages Microsoft services to modernize cybersecurity in the hybrid normal

In March 2020, when the nation-wide lockdown was announced, it seemed that it would last for a few weeks or a couple of months.

Godrej was moderately prepared to deal with the uncertainty both in terms of remote collaboration and security. The organization’s journey of enabling its employees to work from home had started years before the pandemic. Therefore, adapting to the sudden unprecedented change was easier. 

A shift to cloud-based security 

In 2018, the company had identified certain challenges related to identity and security with some of its SaaS based solutions, including attempts at identity theft. It was at this point that it was decided to adopt an enterprise-wide security solution and Godrej zeroed in on Microsoft’s Enterprise Mobility and Security platform, along with Microsoft ATP for email security. As the company was already using Office 365, the integration was seamless and complete with multi-factor authentication and advanced email security.

In 2020, when the company decided to shift to complete remote work, it needed a mass rollout of remote collaboration solutions for the entire workforce. But since it was a SaaS-based solution, Godrej was able to roll it out in a short period of time and enable all employees to work seamlessly from their homes.

With a stable and mature solution running for three years, it was business as usual in no time. More than 150 SSO-enabled applications were implemented using Azure AD, while policies like conditional access were enabled. These solutions were end-to-end, not just for employees, but also extended to Godrej’s partners, vendors and consultants.

Satyavrat Mishra, Head Corporate IT, Godrej Industries, says, “Before laying down our security infrastructure, we understood that five or six different solutions will have to be implemented and experts on these would need to be hired for managing, monitoring and integrating the services. All this would have taken one-and-a-half to two years to roll out across the entire organization. But with Microsoft services, we covered Azure AD in three months, and soon implemented Intune and other services. The complete integrated system was deployed in a short span of six months.”

Since the solutions are deployed on Microsoft cloud, Godrej does not need to manage or maintain these solutions. Being a SaaS-based solution, the logs are already available, and there is an automated integration with Godrej’s Security Incident & Event Management (SIEM) tool. The end-to-end integration and a 24x7 SOC help monitor these incidents and take action on alerts.

The evolving role of cybersecurity

Prior to the pandemic, 80 to 90 percent of Godrej’s workforce worked from offices or factories. Now, except those handling manufacturing operations, employees have the flexibility of working remotely. The way applications are accessed has undergone a significant change. Godrej has implemented the zero-trust principle in managing access and controls, making security as granular as possible. This is achieved largely through micro-segmentation – dividing the network into isolated segments, so that the traffic for each segment can be monitored easily.

With a shift to hyper-digitalization, everything is on the cloud. To ensure security, Godrej adopts Cloud Security Posture Management with Azure. It identifies misconfiguration issues and compliance risks in the cloud and continuously monitors cloud infrastructure for gaps in security policy enforcement.

Mishra adds, “Earlier the focus was more on securing perimeters. Now, the discussions are around zero-trust and enabling employees to access from anywhere in the world, guarded by access rights and strong access protocols. Before, security was a blend of managing physical as well as software controls. Now it has completely moved to software access controls. This calls for a new cybersecurity arsenal that we are building as the new normal evolves.”

Employees as champions of enterprise security

Digital risk management is another area of importance. Employees freely enable SaaS or PaaS applications as per their requirements, and it becomes crucial for the organization to have a stock of their digital footprints within its purview and to ensure that they are all secure.

In pre-pandemic times, things could be physically monitored and controlled through various security checkpoints, surveillance, access cards, etc. In today’s remote workplace, security oversight is limited and dependent on the cyber-hygiene habits of users and how they uphold the security of data assets. Employees have a new role of being security champions. A cultural shift is needed around the understanding of cybersecurity, and behaviors and habits need to be shaped to safeguard company’s assets.

Godrej has launched an integrated security solution to monitor, record and improve the digital habits of users. Instances such as visiting a possibly malicious website or failing to recognize a phishing e-mail are recorded and later presented to the users to increase awareness. Phishing simulations and similar campaigns are conducted on a quarterly basis and users are assessed on their performance in their individual security scorecards. Based on user behavior, Godrej runs poster campaigns and trainings programs to improve the cyber awareness of its employees.

The view forward

Currently, workloads and emails of around 12000 employees across the world are protected with Microsoft solutions. Godrej is now looking to strengthen its security infrastructure in the new hybrid landscape.

Among its new initiatives, Godrej Housing Finance has deployed Microsoft Data Loss Prevention service, and the conglomerate is considering implementing it on an enterprise-wide basis in the near future.