Cyberattacks rise by 630% amid covid- Win the Cyber War

Hi everybody, very good morning to all of you. Thank you for joining us. Just about a minute away from 11am to just 11am. We will wait for a couple of minutes for others to join in and then we'll get started. Thank you so much. Hi a bit shake. Good morning. Can you hear and see me?

Hey, good morning.

goes I guess I can hear and see you. I thought I'll come on get on video myself, but I think you've blocked Oh, is it just take care of that. Just give me a second.

Can you try showing a video now be sick?

Yep, I think you should be able to see me now.

Yes, we can. Hey, good to see you, man. Good to see you.

So you're based out of Hyderabad. I am based out of Hyderabad. Okay.

So I think we're gonna get started. I hope people can see the screen as well.

Yes, in the chat window would be good.

Great, thank you. So we're gonna get started the wound want to get people keep people waiting.

My name is Robert Acharya. I'm the Senior Director for admissions at talentsprint

has more than decade of experience

in primarily counseling professionals to make better career choices. That's so I before I joined talentsprint, I have worked with the Indian School of Business where I headed the admissions for both the flagship MBA program as well as their flagship senior executive program. And before that, I have had a long stint at Pearson, where I've had the privilege of working with almost 3040 fortune 500 companies primarily consulting around human capital consulting, leadership identification, assessment centers, etc. So I'm very passionate about helping professionals upskill themselves make better career choices make career transitions, so to speak. I am joined here by Abhishek today. He's with unisys, India, and he's also the alumni of our first IIT Kanpur cybersecurity cohort. Abhishek, would you want to give a small introduction about yourself before we get this rolling? Sure. Glad to. Thank you for inviting me to the session and

welcome to everyone who's looking to build a career in cybersecurity. So my name is Abhishek kellele. I've been in the IT industry for around 18 years now. I started my I'm a computer engineer from Mumbai University. And I started my career doing software development in a company in Mumbai.

I slowly then moved into management type corporate management type roles. I'm a Six Sigma Black Belt and a lean, Lean Six Sigma Black Belt as well as an ITIL expert.

I've recently moved into the cybersecurity area, I've actually now belong to the office of the seaso in new in unisys. And I've been with the group for about five years now, but very recently moved into the cybersecurity space.

Excellent, thank you. Thanks. Thanks, Avi shake. So what we're going to do is the the plan for the webinar today is that I have a very small presentation, just about six slides, if I'm not mistaken, on certain trends that we are seeing in the cybersecurity domain. I'm also going to be asking a lot of some questions to appreciate as a part of this interaction, which, which are questions that we get from a lot of the participants that, that want to enroll for the program or that are looking for a program like this. So I'm assuming that will take care of a lot of the questions that you may have in your mind. And then the audience q&a part where that's at the end of it where you know, we will be able to

take your questions, you can send your questions via chat once we get once we get to that part of the presentation. So that's going to be it we probably we are going to try and complete this by 12 o'clock.

It may spill over if there are some questions. So, you know, without further ado, I'm just going to talk a little bit about talentsprint because it's it's good to have that context.

And whatever we do is kind of built on this DNA. So we are an edtech company 10 years old. Now, one of the things about talentsprint, which is very unique as an edtech company is we are probably the only a tech company which works with the top, a top tier MD, a top tier, I am a top tier your it top three or triple it. And with ISC, there's no other management. There's no other ethics company in the space that works over here. And we have we have over these years, created very niche programs in areas of deep tech. So for example, with IFC, we have launched a program on digital health and imaging basically, using AI in digital health. And in the healthcare sector. We just launched it a couple of months back in the midst of the pandemic, you know, it's received a great response, but I am Calcutta we are we are working on a program on global economy in digital money, which will kind of take participants through blockchain centrally central bank issued digital currencies, etc. There's a program on AI, us and marketing. Similarly, it can pull, very proud to have the cybersecurity program with them. It's gotten off to a roaring success. The second cohort is also in VR, we are starting the marketing cycle for the third cohort. I'm going to talk a little bit about that. And the triple it we've also had our relationship where we have the IML blockchain programs with them. We also work with global corporations for augmenting their talent supply. This is specifically for college students. We have a program with Google, where women engineers, underprivileged women, in engineering colleges, they get to apply in the second and third years or third 40 years and and then they are trained by us for two years. And most of them get jobs in Google or another top companies. And we work with a lot of robotic process automation, companies need automation anywhere blue prism pega, in again, training people for in their technologies, and they can come and pick up these people after their colleges are done. And they are trained. This is a study that I was going through this is a study by cyber Ark, global, the advanced tracks and landscape report and the reason. So if you want to really look at it, this seems to be good, right? $1 trillion has been spent over the past seven years in cybersecurity, this report came out, I think, towards the middle of end of last year 95% success rate should be very good, right? But the success rate was for the attackers.

So if you were to look at it, if you analyze the statement, companies, governments organizations are spending big money

on cyber security. And that's a given right, with the world changing and with things going as it is, most of us are working from home. And this never was a concept before, which has brought in new challenges. I'm going to ask abishek a little bit about that, when we get when we when we get to him during the course of the presentation. So companies are spending now as a professional or as somebody as an aspirant who wants to get into this, it's a great opportunity for you. And the fact of the matter is,

this is again, I'm going to talk about I'm going to keep talking about opportunities that that are there for professionals. And this is not only for working professionals, we are seeing a lot of undergraduates in the third or fourth year actively looking at building a career in cybersecurity. So this is a part of the same study that was there. And I'm just trying to set up the context in terms of the opportunity size of the market. And as professionals, it's very important to understand when you are thinking of getting into a sector if you're planning to do something in a sector, there are two things that you should look at. One is the opportunity that's there. And secondly, the resources that are available, the resources that are available in the sense that how many other professionals are looking are available. So it's it's it's a function between demand and supply. So if the demand exceeds the supply, then it's probably a great career choice to make because you know, you will end up making money you will progress a lot in your career. So coming back to this, this presentation over here this again a continuation of these slides of the

The report that was there 26% of the enterprises saw an increase in security related incidents. And but their budgets have been increasing 9% year on year. So in spite of spending more money, the number of attacks have gone up. Now hundred percent of the Chief cisos, who were managed, I believe this report had had interviewed close to 200 250

chief security officers, information security officers of companies, all over the world, that 100% everybody believed that

off the numerous attacks that come in probably one of those attacks would be a successful attack on their global on their corporate systems or their networks. And 46% of them unfortunately said that, you know, they do not have the necessary skills, beat manpower, beat other skills to prevent a successful attack.

So this is this slide is primarily kind of talking about, you know, opportunities that are there, my takeaway that I would want to have from this slide is the fact that there are huge opportunities that are there companies are spending yet it's it's not worth to the way that companies would like for it to do now if you look at it, what are the broad level cybersecurity challenges that are there

devices and users visibility now you we are in a situation now, where every device is connected between smartphones, smart watch smart TVs, smart AC refrigerator, you know, car, everything is becoming smart. Now unfortunately, while it makes our lives much more easier, but it comes at a cost and the cost is that somebody is able or maybe able to have that. So, devices and with newer devices coming into the system, your smart plugs, I mean, and what is what is not smart these days everybody probably if you look at it, there probably are 100,000 odd companies which are thinking of making everything smart. So these bringing new challenges you know what if your car gets hacked, you can you can you can get into an accident kill people. Anyway, organizations, countries, so to speak, have been attacking critical infrastructure. It's the railways, ports, and all of that, that infrastructure, Metro Dale, all of that, these are nuclear reactors, power plants, these are these are known space, you know, the space research organizations out there, these are known corporate attacks have been happening. So and with the fact that we are in the midst of the pandemic, everybody's working from home, which is a new paradigm again, because most cases, very sensitive data, you would have people going and sitting in companies inside secure networks. That is not possible anymore. People are working from home. And that brings in new challenges of security securing information and ensuring others do not have access to information etc. So that's one challenge that is that disjointed security products. Well, most cases security products that are there, and there's one

one, and this is something that you know, Professor Shukla, Sandeep Sokolov, who is the head of the cybersecurity program at IIT Kanpur. He always mentions this most cases, people think that

I will become a cybersecurity expert. If I you know, I'll have software, I'll install some software, off the shelf products available in the market. And I will, and I am a cybersecurity expert. And, and this this is one question, or one comment that we have always received, when we are talking to professionals think that, hey, I have 15 years, 18 years, many years of experience, you know, I get these offers installed and and you know, it can be done. But the thing is that you need much more you need the basics to be done. And I'm gonna ask Abhishek about his take on this as well in the next couple of minutes. But

security software, if you install that it's third party software, they don't talk to each other, which which primarily been, which then means that your security operations center the SOC gets a lot of false positives, and you have you install a lot of software, lots of false positives comes comes up and you there's a possibility that you may miss that one true positive or that attack in this interview.

entire set of false positives that keep coming in.

Privacy is an issue that we've always had. I mean, you know, the most security, if if you could, as security professionals, if if we could track, you know, what, every what ever, someone is doing, etc, that would be an ideal situation, we could probably secure people better. But the fact of the matter is, you have privacy concerns, you have regulations around privacy, which we know we can't circumvent. So that that kind of is an inhibitor, new technologies are coming in, you know, with AI with,

with the advent of AI, deep learning coming in, you have deep fakes and other things which could, which could make things, you know, seem absolute real. I mean, you could have somebody could create a website, which, which probably is a carbon copy of the website of a leading bank. And, and, you know, take information from thousands and of people and cause huge financial damage, you could have a news article, which could probably look like a news article, absolutely authentic news article in one of the leading dailies of India, or of that of the country or the region. And it could, again, spread false news, cause riots cause a run on banks, financial ruin, etc. So that's something that's possible. So these are the first the top two challenges. And then finally, then you have ransomware, you keep hearing of these attacks that are happening a couple of months ago, you had Cognizant being attacked by ransomware, multiple times.

And it was not very pleasant

thing to be in, and I have friends who work there, a lot of you know that there are challenges in working in that kind of an environment led to a lot of production delays, loss of productive time, etc. So that's also something that's there and work from home. That's just set to go up. And the challenge that the other thing is that you have a huge talent shortage in this entire space. Companies are desperately looking for professionals who have the correct skills. And I'm using air quotes because most cases, people considered the correct skill is I am going to be able to install, you know, some software and secure the systems. That's the skill that's needed. Unfortunately, that's not we want to talk a little bit about that as well. And the other thing is institutions, top institutions in the country are not providing a talent pool, bhph IITs beat and IITs etc, where Anyway, you have the cream of the engineering crop talent studying over their IITs anyway, taking a miniscule number of people, few lakh students will sit a few thousand will get in, of that a fewer number will come into cycles into into computer sciences. So the pool of talent that is coming out from top institutions is very small. But programs like this, where now the government has allowed all the IITs leading institutions to actually start these kinds of executive programs

gives any aspirant an option to be taught by the same faculty who will teach who's teaching the full time students at IIT. So for the IIT Kanpur program, I can speak about that you have the option you will have the opportunity of being taught by the same faculty.

The similar content or the same content is actually taught to students of computer science in it can't cool without having that entry barrier that people have. One is the age barrier, which if you've crossed a certain years of experience, age, you know you can't get in, but programs like this help with the opportunity. This is the last slide which I have in terms of the opportunity and then I'm going to move to abishek.

Globally, wF is the World Economic Forum. This was a study that was done sometime last year where they were talking about the skill shortage in in various sectors all over the world. cybersecurity worldwide is one sector, which has the highest skill shortage. More than 3.5 million unfulfilled cyber security jobs are going to be there in by around 2021. This was a report by New York Times. WTF also had a similar number if I'm not mistaken at that point in time it was around $2.8 million

to 32

Point 8 million jobs that were there if you want to come to India, India has contributed to the largest growth of shortage of skills in the world. So in India, the skills is the shortage of skills is the highest in the world. We, this was again India from 2017 onwards, this was a report again from cyber security ventures, India will need 1 million professionals by the end of 2020. This was a report last year, that number has gone up, I believe there was a report that study that came out by

sharing my course semantic I am keeping on forgetting that. And it was in conjunction with one of the big four consulting firms where that number has gone up to almost 20 lakhs now. So 15 to 20 lakh job openings are going to be needed at the end of 2020 2021 in India. And professionals are not dead. This was the kind of,

you know, the job opportunities that this was just one website, we had done this small search around cybersecurity jobs. This is one website in India only. And these are the number of job openings that are available. We have done this sometime, I guess, last month in the month of August. So if you look at it, the opportunities available for you are huge in in us in in cybersecurity. So this is something that I was there and the other opportunities that are there. I'm sure Abhishek would have seen this slide somewhere appreciate. Have you seen this slide?

I believe this is one of professors who class line. Correct. They talked about the opportunities in cyber security. This is something that he talked about. Yeah, exactly. So you know, this, the NIC framework, again, is being created by the United States Department of Labor. It's for upskilling professionals, it's a framework for upskilling professionals, if you look at it, broadly, every column is an area in in cybersecurity. And under that you have various roles that are available. So it's it's huge opportunities are available for professionals who want to get in most cases, what happens is that people think that it's very glamorous to you know, get into AI ml, you know, data science, so to speak. And then cybersecurity, it's still not reach that level of glamour. But having said that, if you really look at it, this is in terms of hiring in terms of requirements, this is as good as HTML. And it's a lot less competitive than HTML, because you have every Tom, Dick and Harry today wanting to get into HTML, we run our own AI ml courses, we'll be doing that for almost two and a half, three years now more almost more than three years now, actually. And, and, and I know the volume of people that come through just our program, the market is very cluttered these days, cybersecurity is still not reached there. So from a professional strategy, or from a career strategy, if you were to really look at it, this is a great sector to get in. And, and now I'm going to talk a little bit while this slide is there, you know, I'm going to talk a little bit about officiate. abishek, you know, you You said that you've been working for around 18 years in the industry, what made you get into cybersecurity considered this at a at a pretty late stage in your career.

Yeah, so,

in my background and working for corporate departments like quality,

I was also responsible for

you know, ensuring that the company gets certified on standards like ISO 9001 and 20,027 K and 22 301. So on.

There was of course, the,

you know, having moved away from a technology or technical role and moving into some of these management roles for quite a number of years,

gave a lot of exposure to you know, the company as companies as a whole of the industry at a at a higher level

business units working with business leaders, and getting an overview of the of the the market or getting a sense of what an organization and how an IT organization adds value to their customers.

Now what we use, so you also get a sense, I also get a sense over time of the trends in the market, whether it was cloud, which was a big trend, or which is a big trend and you know, continue to grow.

And then there's of course, cyber security, which is a recent.

It's, it's, it's, I use the word recent. But, of course, cyber security has been there for a while. And all security as a topic has been there for a while, but off late with the combination of cloud, and then of course, security, cyber security has become such an important factor for organizations. And whether these are clients who are looking to secure while looking to move to the cloud, and then secure their services that they're providing to their end customers, or whether it is it service providers like our company, that are looking to provide solutions to their customers who can then support their end customers. So it was definitely something that, you know, I became aware of, and then I got the opportunity. So I was, of course, fortunate that I got the opportunity to move from a quality corporate quality department into the office of the seaso.

So it was more of an opportunity that presented itself rather than something that I actively pursued. But once I got that opportunity, I was keen to take it up. And that's how I, I became a part of the Office of the CSO.

Initially, my, my role was to, in some ways continue that compliance role of ensuring external certifications.

I work with the our vendors who conduct our external audits. So I work very closely with them and the organization to ensure that those audits take place. But slowly, I've got involved in other topics, which are more cybersecurity related. And I can get into some of those as we talk. But just to name a few when you're talking about governance risk and compliance, when we look at compliance to policies, or whether you're looking to identify risks, when there is non compliance. And then, of course, there are other groups within the Office of the seaso that work on things like

threat intelligence, incident response, or wonder ability response, there's groups that work on identity, access management, and so on. And there's, of course,

the groups that work on,

you know, ensuring that we are compliant with policies, so defining policies at a corporate level, and then ensuring that the organization and different business units are compliant with those policies. So, yeah, being a part of the Office of the CFO. Now, you know, I, there are a lot of other areas, which are interesting and exciting. And

cybersecurity as such, is a is really a battle between attackers and defenders. And we are on the on the defender side, but the attackers, of course, from, you know, could be outside or within the organization. Right, so there was a slide where you talked about fishing. Right, and, you know, fishing,

I think there was a mention of the reference to that you will, you will fall attack, you will fall victim to an attack by fishing, at least once, or, and there's actually some referencing that 30% of all attacks happen because of insider attacks. And those insiders generally fall victim to phishing. So even even phishing and, you know, how do we how do we raise awareness about phishing and ensure that the organization is is protected against phishing attacks? And basically,

you know, primarily looking at people becoming aware of when they have

when a phishing attack has happened, or is come to them? And then how did they react, respond to that or react to that? So these are some of the things that, you know, we do as part of the Office of the CFO and things that got me excited. Absolutely. Wonderful. So, and just tell us a little bit about the emerging threats that you are seeing in this space? Since we've been talking about you know, what's going on with work from home? I'm sure you're working from home as well. What are the challenges that you are seeing?

Yeah, so working from home now, you know, so, of course, people have been working from home at different times, in the past as well, that people who work from home because of their specific, kind of, you know, situations or work from home from time to time, I mean, everybody has worked maybe once a week or once a month. But now the challenge really is that everybody is working from home all of the time. Right? And that places a huge constraint on technology as well. I'll give you a couple of couple of things that we start becoming aware of, as we have this new normal of company, you know, continuously working from home.

One is if you look

At the, you know, of course the bandwidth be utilized by the, you know, at at home your family is looking at Netflix is looking at other platforms, they're utilizing bandwidth, right? Ie, when you're working you are on these calls, you're also utilizing you know, video, like you're using video chatting here, that's utilizing bandwidth. Now, that becomes a, you know, a sort of a struggle there to ensure that you have adequate bandwidth so that you can have these things in a smooth way and continue doing your work. But that's also an opportunity for an attacker to, to enter your environment. And and take control of your system, for example. And one of the points of entry is the Wi Fi router.

And, in many cases, the Wi Fi router, once we've installed it probably has a default setting default username, password. And I don't know how many have gone in there and had a look whether that same password still exists, whether it's a easy to guess, password, and have you really actively followed the discipline of changing the password every 60 to 90 days.

So these are some of the things that you start becoming aware of. The other thing that we've become aware of is that many people are now working

with their own devices at home. And they're on the same network as other members of the family. And they could, for example, be using devices which are not as secure as your office device. So they could they could inadvertently become victim to an attack. malware could drop into their system, which could then be a part of your network, and then enter your office system, and from your office system could then enter your office environment. Now, how do you protect against that? Now these are the questions that we start thinking about and start asking. And then we of course, internally as an organization, we have actively become aware of it and also try to respond to that. And there are of course, certain actions that we can take, whether it is hardening your own environment, or becoming more aware of what are the other systems connected to your network to your home network and seeing that they are also compliant with some basic requirements, whether it's antivirus, or having the latest patches of your operating systems and so on. So it's about becoming more aware of your home environment, as you are of your office environment.

Right. Right. So that that's that's actually very practical stuff. Most cases, it's quite basic, but then most professionals and most of us as laymen, you know, kind of ignore that, and we're not aware of it. I'm hoping that I say immediately after this or during

people go and check their Wi Fi router, default passwords.

Oh, yes, absolutely. So in terms of if you were to talk about your decision of joining the IIT Kanpur talentsprint cybersecurity program, you were in the first cohort, that of the program, why did you choose to do this program instead of any of the other programs in the market? Did you consider any other programs? And while you were taking a call on joining this program?

Yeah, definitely, I think. So being the first cohort, obviously, this was, you know, the first time that a course like this was being made available.

But at the same time, there were other choices and the general choices that people might have things like

to show that capability in the cybersecurity space would be something like a CISSP certificate or a C H course and a certificate and so on. So, yes, I did look at those. But then I looked at I came across the program from IIT Kanpur and Firstly, the fact that it was associated with IIT Kanpur was grabbed my attention and I took a closer look at it.

I looked at what was required from the program, and then the structure of the the topics that will be covered. And that, that intrigued me that definitely got me very interested.

I then had some interaction with the settlers being presented by talentsprint. So I had some interaction with the talentsprint team to try and understand what is being what is going to be covered, and there was a lot of information available on the portal on the websites. So, we could get a sense, I could get a sense of clear sense of at least to what extent the topics will be what are the extent of the topics being covered. So whether it is network security or application security or web security, and what are the aspects or contents of the course within each of those areas, which will be covered. So I think that the the Portal was quite comprehensive and being very transparent in laying out what all will be covered. So that sort of was the initial sense and initial

impression and with that,

and I think, in my, in my own experience, the fact that was associated with a top Institute, like IIT Kanpur

was a big factor in making that decision to go ahead with the program.

Obviously, after I got into the program, there was no doubt. But if we talk about the initial impression in the initial

sort of decision, that those those were the key factors, right. And, you know, in terms of the program itself, during How were your interactions with your peer group, I would also want you to talk a little bit about the outcomes of the program, I believe,

all of you will become authors very soon.

Yes, so talk a little bit about that. But just to talk about the peer

interaction interactions. So the course itself as you as you get into it, and I'm, of course, talking to people who are considering

here considering their careers in cybersecurity, or, you know, getting into a career in cybersecurity, and looking to evaluate the options in terms of education to build that capability and, and credibility.

When we got into the course, the course is very well structured in the sense that there are lectures, which we go through.

There are, there's a lot of opportunity to ask questions, get clarifications, on your doubts,

not only professor but also, other members of the of the team, the teaching team, are very open to answer any questions. There's also,

you know, as you build that group, you interact with people who have coming from different backgrounds, and, you know, from all parts of the country. And actually, in some cases, they might be even people outside of the country who are part of this course, as I believe is the second cohort has some international members as well, yeah, almost 10% of them have international exam. So there's a lot of interacting with people from different backgrounds,

you know, and from different parts of the country, and so on,

we get an opportunity to start, as you start learning about the subjects, there are also going to be different people with different levels of experience in the area already, right. So there's someone who's perhaps got no background in cybersecurity like me, right? Initially, when I started off

to someone who might be already a certified CISSP, or CH, who has a lot of knowledge and know how.

And there's a little bit of learning exchange that happens from both ends. So somebody with a lot of technical background can from, you know, Bear, with interacting with someone like me could learn more about the corporate side of things, or the business side of things. And for me, it's more about learning about more of the technology II and the technical aspects of cybersecurity. So there's a, there's a good mix of people that I that at least, we experienced the first cohort to learn from each other. And that was tremendous. The other thing about the course itself is in terms of the structure, which allows a lot of peer interaction is, as I mentioned, that we have a lot of opportunity to ask our doubts and questions. And in many cases, those doubts and questions get answered by members of

the also had the opportunity to work on projects. So those projects, you could choose to work in a group. And we actually did choose to work in a group. And we worked on very exciting projects, I don't know whether we'll get into some of those details later on. But we did work on a lot of projects as a group, and they actually, before the covid Time we who were in Bangalore, we were able to meet up, you know, in a Starbucks and, or in somebody's house, or some get together place and really interact and, you know, look through what problems were being asked or what was being asked from the assignment. And then, you know, share our ideas, brainstorm, and then come up with solutions, and work on those. And then ultimately, we also have a capstone project, which is the final outcome. And you basically get to do a project on any one of the selected areas that Professor puts out there. And that also be worked as a group and a lot of interactions, a lot of brainstorming a lot of teamwork and coordination. And then basically a lot of learning together an experience of very learning together, that that we experience. So I think that's it to answer your question about peer interactions. There's a lot of peer interaction. There's also of course, you know, beyond this building of a network. So as I mentioned, there are people from all across different backgrounds and different parts of the country doing different things. But as we get together, we start building a network and that sort of stayed with us and we

Continuing with that, so the book that you mentioned, basically professor and a few of the batchmates are working on a book

on how cybersecurity tools can be developed using open source systems. And this is, I think it's going to have about eight or 10 chapters. And our group that was that had worked on the capstone project together, we are presenting or putting together one chapter in that book. But of course, they are interacting with others who are also working on their chapters. So that's one. The second thing that we are also doing and just to give a little more detail, we also worked on a project which,

which was

what was called a honeypot. And I'm sure as some people might be familiar as they get in the course, they really find that very exciting. So we built a honeypot as our capstone project. And incidentally, there were five other groups that also build a honeypot. And there was a lot of intelligence that we got

through our project, and they were also

literally other projects that captured a lot of threat intelligence, what went on all of the intelligence that we have captured from all of these groups, and then putting a white paper across, which potentially could be shared with the agencies in the Government of India, to give them a sense of where these threats are coming from, or what those threats, what are the nature of those threats, whether it's a ransomware file, or whether it's a malware, malicious IP address or malicious data source, and then give them a sense of where these threats might be coming from. So that's another white paper that we're working on and be actively sort of, again, interacting with

almost 13 or 14 members from the batch collaborating on a particular project. Yes, I was talking to Professor Shukla, he mentioned that he or it's going to be presented to the Ministry of Information Technology, once it is complete.

And and in terms of a DD projects that you mentioned, I think every chapter is one of the presentations one of the group correct is writing of the chapters. Correct. So as you know, we of course were. And as a as an experience, it was sort of going back to college. Because there is a of course a there's with the course and with the discipline of and I want to commend on that point that out that IIT Kanpur, there is an academic discipline that is there.

And I think it's it's peerless in that way. The IITs are the top institutes. So there is an academic discipline that gets is there. And it was sort of an experience of going back to college.

And

as college students, let's put it that way, we needed to leverage when we were doing these projects, we look to leveraging open source systems. So we don't have to pay a lot of money to get licensed tools, of course.

But there's a lot of value in these open source systems. And effectively, if you look at government agencies, or even small and medium scale industries, they may not have a lot of budget to spend on a lot of these tools which have carry a very high license cost or maintenance cost.

So the option of using open source tools to implement cybersecurity solutions is something that we experienced through the course. And that's where the the idea of this book also came out. And I think Professor Shukla had this idea for a while. And as each of the each of our groups came up with a project using open source tools, he really hit upon the idea of putting that into a book. So each one of the groups that worked on their individual projects, we sort of, you know, somebody built a ideas system, somebody built an application firewall system. There were multiple groups that worked on honey pots. So we are all basically working on a chapter and presenting, you know, sort of how to guide of how you can use open source tools, what are those tools? What are the combination of the students, because not just one, it could be multiple tools that you're using to sort of put them together, integrate them and actually develop a solution. So how you can do all of that, and then, you know, replicate similar similar solutions, similar outcomes. Right? So for the people who are asking the questions, we're going to get to your questions in the next five to seven minutes. This this question that we have always faced in abishek, you will be the best one of the best people to answer that. And I briefly touched upon this when I was talking about a lot of us think that, you know, coding is something that is not necessary. And I have I've interacted with a couple of students who from the second cohort who have already

Done programs from other institutions, etc, where they were told that coding is something that is not a part of cybersecurity.

What is, I mean, you guys did a lot of coding right there. These were basic exercises that you were doing. Can you just comment a little bit on this aspect of the program? Yes, sir. So it's a very interesting aspect really.

And in my experience, the last time I did coding was almost 15 years back, right. But it's right, like riding a bicycle. And, you know, once you get back into it, you know, how to balance yourself.

Quoting becomes, again, it depends a lot on the area that you're working on. And I'll give you my experience, and a couple of things with my experience, what what happened in the course. And then I, you know, if anybody has any more specific questions, we can get into those. So one of the aspects that we learned was about application security. Now, in application security, one of the key vulnerabilities that an application could fall victim to is a buffer overflow overflow, or a Stack Overflow kind of problem.

Now, theoretically, you can, of course, learn a lot about that. And you can understand, you know, how that works. And you know, how the stack identifier or you know, buffer, fires can can interact with each other and how that one durability works.

But only when you so

in the goodwill file. And we were asked to

be harassed to actually compromise that binary, and override the buffer and compromise that binary and to redirect its its execution to another part of the application and was actually

caught, you know, an interesting exercise. But unless you actually did coding, and you got into the debugging mode, you did, you know, use the GDP application and actually read through the code, you couldn't crack the problem, right. So while you could understand, theoretically, what was needed and what was required, and what that runnability would look like, and so on, but unless you actually did that hands on, it doesn't stay with you. Right. So that was one, perhaps, example of coding or knowledge of coding, that was a key aspect. The second aspect that I'll talk about is, again, an interesting problem that professor had given us, which was to, it was given as a part of an assignment. And he made it optional. But I took it up. And this was to write a artificial intelligence or Machine Learning Program, to analyze

malware files, and to identify which files are malicious or benign.

And he left it up to us, choice of technology, choice of algorithm was really left to us. But I built I went into Python, so I had never done Python before. But I had worked on c++ and Java and Visual Basic. So I had some, like I mentioned 15 years back, I had some work on that. But I picked up Python. And, you know, once you figure out your way, what you want to do, you want to you know, read a file, you want to read through a folder, you want to crawl those files and paths, some information. So they were basically JSON files, and you have to pass some information from those JSON files, to build some features, and then feed it into a machine learning algorithm, and then get an output and that output would basically be that whether it's, it's a malware or it's not a malware. And I wrote that program, it took me quite a while to get through the whole process, but there was a lot of learning involved. And it was successful. So I did get a sort of a 93% accuracy on the machine learning algorithm. And that was only possible, you know, by doing the coding. Now, again, theoretically, you could you would understand what the concept was, you could understand feature engineering, you could also understand where malware analysis fits into a cybersecurity environment.

But again, theoretically, you would understand that, but when you actually do it practically, and you know, coding plays a big part in that it stays with you. Right. And I want to build on that just a little bit because we're on the topic of AI ml. That particular exercise got me very interested. And I'm actually now looking at doing more work in AI ml, not necessarily it doesn't have to be necessarily in the cybersecurity or malware analysis stage. But there are other use cases where AI ml can be used. And I'm now

exploring

some collaboration within my organization with the AI ml

Technology Group. And we're looking to see if there is something that I can contribute over there. So just that one experience that one project, which required some coding work. And I, like I mentioned, Professor left it optional, but I took it up. And I learned a lot in the process. And it got me excited in that space, and now I'm doing some more work in that area, potentially. Absolutely. That's that's a wonderful anecdote to share. And this is not just you, I think I was speaking to value. Again, one of your peers in the batch, he is also looking at now get doing more research into the areas of cybersecurity newer areas of cybersecurity. So yeah, that's that's what to be, you know, a venue or a part of a cohort like this, a peer group like this, and a program like this, you know, you you get to

probably, you know, going to newer areas that you probably would not have thought that, you know, you would have gone before. So that's that's one common theme that I can see across, you know, the the entire first cohort. Also, I believe there were two startups that started as a part of,

I mean, from your cohort.

Yes. So

an interesting one of them was, was Professor recommended our project or our team to

look at starting a venture. So and I won't give too much detail here. Because I don't have the rest of my group here to also talk about it. But

because we worked on the capstone project, right, and we again, and actually all of the groups did a fantastic job. And I think everybody initially was apprehensive whether we'll actually come up with something practical, as in, or whether it's going to be a theoretical project,

giving a lot of industry knowledge, and doing market analysis kind of thing. We did all of that. But we also actually developed the solution and a working solution at that. And we had also leveraged in our project, open source technology that I mentioned,

and cloud based technologies. So it was something that could actually be taken to the market.

And so ours project was a honeypot. And that was one project, which professor, you know, given the level of maturity we had reached in the solution, the professor actually asked and recommended that we take it up as a venture. And incidentally, we are working on it very actively, we are looking to prepare our project proposal to see how we want to take it forward.

There are other groups as well who have done some fantastic work and grow and and really,

you know, right from the ground up, like, there was a group that actually built a very, actually one individual who had built a very comprehensive simulator for Red Team attacks. So if you want to simulate if a if an organization wants to simulate an environment, and then apply different types of attacks, and then build defenses from there,

this person had actually built using, again, open source technologies and his own

code from scratch, had built

machines that simulator solution. So there were multiple solutions, which Professor actually recommended to take up as a venture. And at least our group is taking it up. And we're working on like I mentioned, the project proposal, and let's see how that goes. All the best to you, I'm sure, you know, it's going to add a lot of value to the, you know, the entire ecosystem, when we've been talking about the professor, etc. So what's it like to be taught by professors and we've shipped lab, you know, one of the foremost authorities in India on cyber security. So what was the experience like, of being taught by him?

Yeah, I mean,

in just one word, fantastic.

Professor comes with, I mean, I don't have to be talk about his credentials, but

there is

a balance that has to be made, because of the different groups and the backgrounds. And, you know, we, like I came from a corporate background and a corporate program background, where we look at more of policies and compliance, you know, at a business unit level at an organization level. And then there are people who had coding experience who will network engineers or security engineers. So that's sort of the spectrum of people and they will also actually in our cohort,

some people from a sales background marketing background. So all this

They are in the cybersecurity space, they're selling perhaps cybersecurity solutions. But, you know, they depend on engineers and solution engineers to sort of provide the technology inputs. So professor, with his background, the reason why I mentioned that was that Professor comes with that, you know, he's, of course taught in universities abroad. And then he's been in India for a few years now and be a part of IIT, Kanpur.

But he's also worked, and is very closely associated with government agencies. Right? He understands the market very well.

So the reason why I mentioned that is that he was really able to cater to inputs or, or questions and, and sort of the learning needs of this broad spectrum of people who are part of the group, right.

As far as his teaching style goes, you know, it's been, it was a fantastic experience learning from him, he's a, he's an absolute,

ocean, or Encyclopedia of knowledge in the cybersecurity space, he brings in a lot of context to the topics. So it's not just about going through the technology aspects, or the cybersecurity, you know, aspects, but also, where does this fit in into the overall cybersecurity and it space or a business space. So whether it's banks protecting their customer information, whether it is government's protecting their citizens information, and the challenges that they face, and how these technology solutions can support them, and I mentioned, basically private or public, you know, customers, he can bring in a, he brings in a lot of context, and that context, helps your learning and understanding.

And I think in his teaching style, he's extremely mega mentioned, he's, he's an encyclopedia of knowledge, but he's also very patient in the way that he teaches. And also the way a patient in the way that he takes, you know, questions and queries and response to them. And he provides a lot of additional input, again, depends on how you, you know, what you ask, and what more you want to learn. So there was a lot of additional material that he provided to us, whether it is papers, whether it is

documentation, whether it is something that he's been working on, we're collaborating with, you know, his peers and his colleagues, from universities in India as well as abroad. So he provides a lot of that additional context and additional material. He also does a lot of webinars and a lot of talks. So he would very openly share links to those or recordings of those that that are available. So just give us that context. But in a nutshell, the thing that I would say, work, you know, learning from Professor was that he built a great passion, I mean, he shows a lot of passion for the subject. And that sort of then translates or transfers onto you, because his energy and his passion, sort of then transfers on to, you know, transfer on to you as students, and then you know, once you have the passion or the zeal for learning, then this is, you know, you can take off on your own.

And at least in my experience, that's, that's my personal experience. I mean, for me, now, there are things that I want to learn, and I know, that, that learning a passion has come from, you know, learning from him, and seeing him and, you know, the way that he looks at the subject and looks at the, you know, where these, the the value of the importance of that subject. And that sort of kind of come in or transfers onto you, I'll say one thing about some of the things that he would keep talking about, and that sort of also now transfers on to

what we are doing as, as the as the book and, and the paper is that he's got a mission to develop cybersecurity professionals in India.

So there is a, there's a, there's a huge need, of course, to, to develop that and, and so on.

But as an individual, as a professor, he's seeing that there is a huge need for the country, to protect itself from cybersecurity attacks. And cyber warfare is a reality.

And there are state actors that are tactically that act against the nation. And he has a mission to do that. So that's something that again, shows, you know, a lot of passion and focus towards the nation. And it's also something that is part of nation building. So, to that extent, you know, I I personally really appreciated that and that passion transferred over to me and you know, I'm hoping to kind of develop on that. Absolutely.

That's wonderfully put. So, Alicia can just come into a couple of questions, you know, that I am seeing from the audience and this one is addressed to you, why did you decide to do the IIT Kanpur course, instead of, you know, other accepted programs like CISSP, ch, etc.

Yeah, so, as I mentioned earlier, so when you look at the structure of the program, and as opposed to presented, so, when you look at cis cis to speed, you know, it's a certification, I am I have some experience with certifications, I was a PMP certified, I am also an ITIL expert, I'm also a six sigma, Lean Six Sigma Black Belt. So I understand how certifications work and, you know, there's of course, a lot of breadth of knowledge.

But then you go and give an exam and basically, you know, you're certified, and then it's up to you how you utilize it.

But, and also have been a computer engineer and having done my engineering through Mumbai university, I also appreciate academic discipline.

And to me, when when the when the program was associated with IIT Kanpur, there was all magically an expectation and an understanding

would be some level of academic discipline.

And that, at least I appreciate, for a subject like this, if you really want to build your understanding from the ground up, you need some level of that Academy discipline to be to be there. So that you are put into a structured learning structure that forces you to learn

and learn through experience. So some of these assignments, projects that we worked on all of that, you know, as I mentioned earlier, with the few examples that I gave, that you learn more from experience that from doing than from anything else, you know, you can, you can learn something theoretically, but you might forget it over over a while. But if you learn something by doing then that stays with you for a longer period. So that was the expectation that I had looking at the course content, and also the structure of the course, as it was presented on the website. And also based on some of the discussions that I had with talentsprint.

So that was sort of the reason why I got in to the course.

And then I think, and I speak for myself, but I'm sure that many would agree that having a an organization like it can put on your profile adds a lot of value. And this was, you know, a six month course as it was presented. So you could expect that you've anybody looking at that food, know that you've spent time, it's not just a, you know, a three day or a five day kind of thing that you didn't really get

through the rigor of an IIT Kanpur type course. So it's a six month course, it's done by IIT Kanpur, so that when you put that on your profile, it gives you a lot of credibility, that was my impression. And that was the reason why I got in. But I let me add one thing, and because there was a reference to CISSP, and ch. So I am now pursuing CISSP. And having done the course and having gone through the experience and learnt a lot, I'm now also going for the CISSP certification. And I looked at the CSS CISSP course. And, you know, initially when I looked at it before the course it was look like, you know, you have to climb a mountain. And now when I look at it, it's like a small mound.

So and, um, and again,

you know, when I look at the book, you look at the content and and you look at all the training material out there, whether it's the Sean Harris book, which is, you know, it looks like, it's like a very thick and big book, and you'll wonder whether you'll ever be able to get through it in time. But the confidence that this course gave me to even take on the CISSP certificate in a short period of time has been tremendous. So I'm actually targeting doing it by the end of October, and going through it quite smoothly. And I'll give you one one, just one example.

As part of the course, one of the things we worked on was something called the dam vulnerable web application Divi web.

And what we do with the Divi web application is basically a look at different abilities, things like SQL injection, command injection kind of vulnerabilities or excesses attacks, and so on. And you basically, this application is designed it to be a vulnerable application, you try out different attacks, so you learn what kind of attacks are possible and how the application responds to those attacks. And then how you if you learn over time, how to protect against those attacks and so on.

One of the sections in CISSP is application security. And they basically talk about dv wha and these kind of

tax in the course, we actually, as an exercise, we're given an we're given a web application. And we were asked to do a complete vulnerability and penetration attack penetration testing and vulnerability analysis on that application. So we went or, you know, to the to as much detail as record and I tried to identify as many wonderful cities as possible. In the cssp, the expectation is not to go that deep, but to basically have some basic understanding of what kind of attacks are possible on a web application. So now, having done the course, that part of CISSP, seems like a breeze. So that's one and I can also speak to some of my other other peer, the batchmates, that I know at least have one who's also going to do a CH certificate.

And again, the the the outcome of the course is that these these certificates now just seem a lot more easier. And at least I feel a lot more confident now to be able to take them on, and do it in a shorter period of time than I would have been had I not done the course. Yeah, absolutely. That's, that's wonderful. Actually a lot of questions around ch CISSP, we always get these questions. Let me let me just say one thing there that

obviously CISSP has been there for a while. And ch also has been there for a while now, I would say this, then. And you know, don't hold me to it. But I am confident that over time, the this particular course from IIT Kanpur would also be out there. This is of course, the second cohort that has started and there's a long way to go. So obviously, the other courses, other other certifications have had the benefit of being around in the industry for a while. So therefore the industry recognizes those certificates.

But when you come down to doing the practical work, and you know, they when you interact with your peers in the cybersecurity area,

this course gives you a lot of confidence. Having said that the industry, like I mentioned, the industry recognizes the certificates like C CISSP and ch. So when you say that you you know you show that on your profile there is there is an understanding that yes, you have this kind of knowledge. So don't get me wrong, there is of course, recognize recognition by the industry of the certificates. And they are important. But I want to point out, like I like I said that, having done this course and having learned that the knowledge would stay much longer. And what would happen is that with a course like CISSP, when you get certified sort of a more well rounded, it gives you that well rounded, saying that you've you've know covered all of these subjects. And that's, of course adds value to your profile as well. So that's the reason why I'm going for it. But I hope I made my point that while those certificates are recognized by the industry today, I hope and I'm confident that this course over time will also be recognized by the industry and if not at par even higher than the existing certificates. Absolutely. And one, you know, one thing that I want to talk a little bit about, you know, this, this entire aspect of we get this question a lot from people, you know, is the certificate on the certificate itself. But what most people don't realize, or what most people fail to kind of understand is the fact that and this is not only for this certificate, it's for any thing that you do is that the knowledge is more important or gaining the knowledge is more important than just a certificate. You know, you may be certified from the best institution in the world, but unless you can showcase your knowledge, you will not be considered as a working professional, it will not get you very far. So that's just one aspect that I you know, I thought I will talk about couple of small questions before we wind up. You know, they there's the question, which is, which is asking about the kind of free open source tools that were used. Can you talk a little bit about that?

Sure, absolutely. Again, it depends on what

you know, what you're trying to do in the cybersecurity space. I'll talk about a couple of tools that we worked on. For example, when you're doing one ability analysis, there is a tool called overspill zap. So Vash is the open web application security protocol. And they have there's a tool called SAP which is aligned with the OWASP framework.

What Avast does is provides guidelines of what are the top one abilities that

a web application could have, whether it's SQL injection or cross site reference forgery or cross site scripting. And then it tells you for a particular application

How wonderful it could be to these kinds of attacks. So I'll give you one.

one instance.

We were given a website. And we basically, were told to do a vulnerability analysis of that website. And I used vasp. Zap, it's an open source tool, you can download that and use it. And it ran through the entire website and and did the scanning of all of the the files, the folders, subfolders, and all of that, and gave an output of what are the critical, the high, moderate and low criticality wonder abilities across each of these areas. It also gave an output of what was the attack that are the payload that was used by the application to perform the attack. So you could go back and replicate it if you want. So that's a great tool.

Absolutely, you know, I would say, industry class tool, and it gives you a great output. Another tool that I had used was called burp suite. And burp suite is a proxy tool. So basically, now you can set up set it up as a proxy. And so any traffic from your browser that goes to any web site will be intercepted by burp suite. And then you can read, what is the command that is being sent, whether it's a post or get, you can see what are the parameters. And then you can also change those parameters before it gets submitted to the website. So you could actually do, you could simulate and do a man in the middle kind of attack and do that.

The third tool, that open source tool that we use, and this we used for our capstone project, which was the honeypot was the elk stack. So this is the Elasticsearch LogStash and Kibana stack.

This is a tool again, that

tags, log files from different systems. And then it parses those log files to identify, you know, whether what kind of traffic has come in what kind of web traffic has come in, where that traffic has come from which IP addresses which DNS servers, and then the Kibana application is the one that visualizes it. So it gives you a different charts, it gives you a geo IP,

you know, chart of different IPS, from where they're, where they're located, whether it's China, whether it's Russia, whether it's us or India, it also gives you a lot of charts, bar graphs or pie charts, to show you all of that data in a very visual format. So that's another open source tool that we used

to do the to the project, there are, of course, many others. And I think for looking for a more comprehensive list, I can

me or anybody from the C three IIT Kanpur team can provide that.

So I but these are three tools that we use very actively. There are of course, others like SQL map, and,

you know, security onion, and brozik, wasa and so on, which we use for different purposes. But these are some of the tools that we used.

Excellent, thank you so much. Appreciate that. That's a lot. I let me see if I can squeeze in

about a question in terms of I mean, there are questions about your career office, I think he's already answered that.

interested in doing PhD in the field of cybersecurity, from Sheila Varma, I believe somebody is already doing that, if they knew if I am not mistaken, I think, from your cohort, is that are you aware of this? wishek? No, I'm not aware of anybody doing Ph. I don't know the venues

going through with a PhD.

But I can definitely say that, you know, like I said, that the once the zeal for learning comes in, then there's, you know, the sky's the limit. And I haven't been a part of an academic, you know, for the past 18 years, the last year academic rigor I had was 18 years back, when I did my engineering.

And having done this course, I was excited to you know, being in an academic setting, being in a formal sort of college setting in a way where you have lectures, quizzes, tests, assignments, projects, and also working with peers and you know, working with other people on those projects. So, all of that was and also I know when you when you go back and present some of these things, you are challenged. So not only professor would ask you questions or ask you to defend what you have done and you need to be able to present your case. It is also feedback that you get in strong feedback, whether something is working or not working. So, some of these things, you know, kind of

give you that, you know that feeling that you can again, after having been in corporate for a while and having been working for a while that you could again, explore being in an academic setting. So I don't know, we know what his plans are. But yeah, if somebody wants to pursue doing a Master's or doing a PhD, you know, I think this kind of gives you that confidence to do that. Absolutely. Thanks. Thanks, appreciate. We we've already crossed some 17 minutes before. So I'll just take a just broadly a couple of questions around the eligibility for the program. Though, on paper, the eligibility is that you need to be a working professional with a year of experience at least in a B shakes cohort, there was a very bright student who was given special permission to do that, in the second cohort also we have

the I believe, we have some four to five such students who put in special requests to be a part of this program and we have accepted them. So if you are pursuing your under graduation,

I am not too sure of schools, but we can if if you can predict present your credentials to IIT Kanpur being an institution of excellence, and if you can, you know qualify, you will be a part of this cohort. Other than that any working professional specifically with knowledge, some knowledge of programming is required. Though one change that has happened from Abhishek batch to the current patches, we have also started an orientation module, where we are giving people access to or training on certain prerequisites for the for the course. So that's been one of our learnings from his cohorts to this cohort, I'm sure we will adapt the program much more depending on the feedback that we get from the second cohort, but we are going to provide some you know, basic training, but the cohort is going to start sometime in the month of January. So you have some time if you want you can prepare for

your your programming and the basics part of it, and then you will be able to come in.

Other than that, if you want to, you know know more about the program, you can go to talentsprint.com and go to cybersecurity section on the website. It has a lot of details, including a video which covers you know, most of the all of the project, at least the names of the projects, and the people who have done it from rubbish x cohort, Professor Sandeep Shu class take, and we also conduct, you know, regular webinars around that. He was in one of our webinars. In the month of July, end of July, he was there, I'm sure in one of our upcoming webinars, depending on his availability, we get him to come along with one of our other alums, and we'll have an interaction. So look out for that. In the meanwhile, if you have any questions, you can email us at it get talentsprint.com or reach out to Harsha, who is the program lead for this program. And she and her team will be happy to help you out with any queries that you have a bishop, thank you so much. It's been wonderful having you today, spending an hour and a half with us, sharing your experience of doing this wonderful program. And I wish you all the best. And I thank everybody who has spent this time with us. We look forward to seeing some if not all of you as a part of one of our future cohorts at IIT Kanpur.

Thank you.

Thanks, everybody. Have a good day. Stay safe. Thank you. Bye bye.

Watch the entire interview here https://www.youtube.com/watch?v=5bcKACRwdh4&feature=emb_logo