Nishith Desai Associates keeps business risk at bay with infosec |
 |
By Dhwani Pandya, Principal Correspondent
18 Dec 2009 | SearchSecurity.in |
|
|
Milind Mundarkar, the CTO of Nishith Desai Associates has a tough job.
His firm deals in a lot of confidential information, which consists of
legal agreements and sensitive
data of many organizations — Mundarkar's team is the custodian.
"Before signing business deals, our clients enquire about our
information security practices," says Mundarkar.
As a leading legal firm, Nishith Desai has to ensure that all document
exchange happens in a highly secure manner. In its early days, the
firm realized that it needs a strong network security framework. Its
information security policy (which came into existence in 1990), is
regularly updated to compensate for growing automation of processes and
introduction of new devices. Surprisingly, although it deals in
sensitive information, the company has developed an open, transparent
and trust-based work culture. "In this work culture, we have to be
careful while implementing certain information security policy and
restrictions for people," says Mundarkar. "We have to justify the
reasons for certain restrictions." Although it's contradictory to
company's nature of business, it has been able to successfully maintain
a trust-based work culture. Nishith Desai has not experienced any
misuse of information by employees. However, Mundarkar believes that
from a system point of view, information security cannot be ignored;
his firm has taken several efforts to secure even minute details.
In order to ensure confidentiality of information, Nishith Desai
decided to host its Microsoft Exchange and database servers in-house,
instead of using a third party data center. The company has established
VPN
connections between all the office locations (which include Mumbai,
Bangalore and California). Besides, it also has MPLS VPN connectivity
between its Mumbai and Bangalore locations. The firm ensures that there
is no use of personal mail. Since every Nishith Desai employee has a
Blackberry device, the firm has a separate corporate policy on Blackberry
usage. The Blackberry servers have an integrated system to monitor
logs. Nishith Desai uses a solution from Ironport for policy based
email monitoring and blocking spam. "Our prime aim was to ensure that
no traffic moves through the public Internet," explains Mundarkar.
Nishith Desai has set up two data centers (at Mumbai and Bangalore).
These data centers are claimed to be protected using Fortigate
firewalls with Z level security. To ensure the security
of endpoint devices like CD-ROM and USB drives on the network,
Nishith Desai uses Symantec's Enterprise Suite (for virus protection
and device blocking). The firm also uses Microsoft System Center
essentials for patch management and health monitoring. This system
generates e-mail alerts that provide details about all systems on a
daily basis.
|
|
|
|
|
Although it deals in sensitive information, Nishith Desai has managed to develop an open, transparent and trust-based work culture.
|
|
|
|
|
|
|
|
|
|
In order to ensure smooth and secure document exchange with its
clients, the Nishith Desai uses digital signatures from Verisign.
"Certain clients who are apprehensive about confidentiality of
information want us to authenticate and upload the information directly
on their server," says Mundarkar.
According to Mundarkar, although its current network security
framework sufficiently protects his company, security
is a perpetual challenge. Due to this realization, Nishith Desai
believes in keeping at least 60% of its technology budget for
information security.
Even after setting up all these network security controls, Mundarkar
wants to offer maximum flexibility to its users. The company has a
work-from-home policy for lawyers who are often on the move. The
company uses Elite 3E software to track the time spent by lawyers on
each case. In order to secure remote log-ins of this particular system,
Nishith Desai plans to use an authentication solution from RSA, which
uses "digital cards". This digital card will provide a third level of
authentication for system log ins. Nishith Desai plans to provide these
cards on Blackberry devices, so that users don't need to carry
traditional smart cards. Besides, he is also looking forward to invest
in a document
rights management solution to further secure Nishith Desai's
intellectual property.
|
|
|
|
