Vulnerability Management

The vulnerability management program at Infosys follows best-in-class industry practices coupled with top-notch processes that have been evolving over the years. Rich experience of deftly managing end-to-end vulnerability life cycle of Infosys Network and the constant hunger to stay abreast of the latest tools, technologies and related market intelligence have acted as a catalyst in fortifying the overall vulnerability management program.

A robust enterprise vulnerability management program builds the foundation for healthy security hygiene of an organization. The following practices have been put in place at Infosys for,

1. Real time asset discovery followed by instantaneous identification of vulnerabilities, misconfigurations, and timely remediation
2. Automation of vulnerability management, configuration compliance, security assessments and review for assets, applications, network devices, data, and other entities in real time
3. Close coupling of detection and remediation processes; auto prioritization to reduce the turnaround time for closure of detected vulnerabilities
4. Continuous monitoring of all public facing Infosys sites and assets for immediate detection of vulnerabilities, ports, or services
5. Regular penetration testing assessments and production application testing for detection and remediation of vulnerabilities on a real time basis

The vulnerability remediation strategy of Infosys focuses on threat-based prioritization, vulnerability ageing analysis and continuous tracking for timely closure. We have successfully eliminated the ticketing system for vulnerability tracking by establishing a continuous detection and remediation cycle, where the IT teams are enabled and onboarded onto the vulnerability management platform. A Cybersecurity awareness culture is nurtured, and teams are encouraged to proactively remediate the vulnerabilities reported on their assets or applications.

Supply Risk Management

A comprehensive supplier security risk management program at Infosys ensures effective management of potential security risks across the various stages of supplier engagement. The process comprises of,

• Categorization of the suppliers based on the nature of the services provided and the sensitivity of the data involved.
• Defining standardized set of information security controls as applicable to each category of supplier
• Defining, maintaining, and amending relevant security clauses in the supplier contracts as applicable to each category of supplier
• Due diligence, security risk assessment for effective management of the information security risks associated with suppliers

Defining and monitoring of key security metrics for suppliers (e.g., background check, security awareness training completion, timely interventions with regard to information security incidents etc.) threat intel tracking and governance further strengthens the Infosys supplier security risk management program.

Cybersecurity skill management

With the increasing demand for Cybersecurity jobs and a skilled workforce, Infosys has taken several measures to counter the Cybersecurity talent crisis as well as in skilling, retaining, and diversifying its Security workforce in areas such as application Security / Secure development lifecycle.

Cybersecurity team members undergo technical as well as behavioral trainings on an ongoing basis. Infosys internal training programs, as well as external bodies with Cybersecurity subject matter expertise, are leveraged for the same with a strong focus on learning through the classroom as well as on-the-job trainings.

• Over 4,400 professionals underwent Purdue training on Cybersecurity
• Infosys utilizes its partnership with NIIT to have its professionals undergo a Cybersecurity Master’s Program

Building, Strengthening, and Upholding a Positive and Sustainable Cybersecurity Culture

At Infosys, driving a positive and sustainable Cybersecurity culture is one of the key constituents of our robust Cybersecurity strategy. While we embrace top-notch tools and technology to bulk up our Cybersecurity stance, the ‘human factor’ is equally an area of sharp focus for us. Various measures are in place to nurture a confident and empowered Cybersecurity mindset, and we believe in democratizing security in its truest sense. We have embraced the Secure by Design (SbD) approach at an organizational level and offer multiple trainings/drive awareness on SecureSDLC, as part of this initiative. Diverse and proactive communication campaigns are driven across the organization by leveraging various awareness means / tools, including – posters, advisories, emailers, push messages, mandatory awareness quizzes, gamification, SME Cyber Talks, awareness sessions, videos, podcasts, fireside chats, panel discussions, focused social engineering awareness, security courses on the internal learning platform, thought leadership messages, survey, annual cybersecurity week celebration etc. There is also an interactive 3D animated e-Learning certification program that helps drive positive security behavior amongst the Infoscions.

Innovations for our clients

Infosys innovation-led offerings and capabilities:

Cyber Next platform powered Services help customers stay ahead of threat actors and proactively protect them from security risks. Our pre-engineered packaged and managed security services help monitor, detract and respond by getting extensive visibility and actionable insight through threat intelligence and threat hunting. Our offerings ensure risk-based vulnerability management by providing a comprehensive single pane of glass posture view. We have made huge progress in the Cyber Next platform powered service delivery through various modules - Cyber Watch, Cyber Intel, Cyber Hunt, Cyber Scan, Cyber Gaze, Cyber Compass, Cyber Central that ensure comprehensive Managed Protection Detection and Response (MPDR) for our global customers.

Zero Trust Security architecture and solutions to navigate our customers to embrace zero trust security. Key innovation and offerings include Secure Access Service Edge (SASE) delivered as-a service. With SASE as-a Service, we ensure strengthened overall security through cloud delivered security controls and capabilities. Infosys innovation in policy standardization enforce controls at access level, accelerate rollout of service thereby reducing or eliminating legacy tools allowing our customers to reduce overall costs while enhancing end-user experience.

Secure Cloud transformation with Cobalt assets drive accelerated cloud adoption. With Secure Cloud reference architecture and Secure by Design principle we ensure security is embedded as part of cloud strategy, design, implementation, operations and automation.

Industry recognition

• Analyst recognition: Positioned as a Leader- U.S, in “Cybersecurity - Solutions & Services 2021 ISG Provider Lens™ Study“
• Client testimonies: Infosys Cybersecurity services was recognized by two of our esteemed clients bpost and Equatex
• Cummins and Infosys: Securing Identities Together
• Client testimonies: Infosys provides Managed Protection, Detection and Response to bpost (Belgian Post Group)
• Client testimonies: Infosys secures MS Amlin's digital transformation journey
• Analyst Testimonial: Infosys is among the world's leading providers of Managed Security Services (MSS), says Frank Heuer, Cybersecurity Analyst at Information Services Group (ISG)
• Analyst Rating: Infosys positioned as a Leader in the ISG Provider Lens™ Cybersecurity – Solutions and Services 2023 for U.S.
• Analyst Rating: Infosys positioned as a Leader in the ISG Provider Lens™ Cybersecurity – Solutions and Services 2023 for Europe
• Analyst recognition: Infosys CISO crowned as “The Cyber Express Cybersecurity Persons of 2023(India)”