Inside OYO’s InfoSec team: Making our lives hard so stakeholders sleep easy
By: Jagbir Singh
Tags: Cyber Security Services, Privacy Protection, Data Protection, Infosec, Appsec

One of our biggest assets is the trust our customers, partners and employees place in us. We understand that trust is hard to earn and easy to lose. One key responsibility in earning this trust is protecting the data our customers and other stakeholders have with us from any unauthorized use. Our team of 1100+ world-class security, network, software engineers and external partners across multiple geographies is at work 24x7 ensuring the protection of this data, so our customers and stakeholders can rest easy.

Security is an integral part of any process at OYO; beginning from the collection of data, during transfer and processing to storage at rest. We follow a comprehensive information security framework based on version 1.1 of the NIST (National Institute of Standards and Technology, USA) covering all aspects of information security:

We are PCI-DSS (Payment Card Industry Data Security Standard) and GDPR (General Data Protection Regulation 2016/679) compliant and closely follow the ISO 27001 framework. We have a comprehensive information security policy in place since the inception of our company that’s based on the ISO 27001 framework and other stringent industry standards. The policy is revised periodically to ensure it encompasses the latest information security practices.

According to recent research by VPNPro, more than 2.7 billion people were affected by the data breaches in 2019. Today, it is imperative for technology companies to stay updated with the latest tools and technologies to mitigate against any unauthorized data access and breaches.

Our internal compliance team is responsible for ensuring that all our systems and processes adhere to this. Zero tolerance for violations is a good thing when it comes to data security. There are a host of measures that we adopt to make this possible. These include -

1. Access based on “Least privilege” and “Need to Know” principles along with Multi Factor Authentication(MFA)

2. Appropriate Data Classification

3. Incident Response and Plan

4. VAPT Exercises at regular intervals

5. Password Management using Industry Best Standards

6. Regular Education, Awareness and Acceptance to enterprise policies and procedures

7. Appropriate measures for Endpoint Protection

It’s never too early to start with the right education. All our new joiners go through information security training as part of the New Employee Orientation. Our software developers and other Information Security personnel also attend a mandatory quarterly refresher since the technology in this space is dynamic and evolving very quickly. We have also recently started an annual mandatory refresher training for all existing employees. All of our developers are trained on the OWASP top 10, SANS top 25, WASC Security Standards which are being deployed in some of the best technology companies, world over. For the larger employee base as well, our security governance team regularly sends security advisories to the entire organization educating them on Information Security best practices; how to prevent getting tricked by phishing emails, maintaining password confidentiality, etc including consequences of non-compliance including up to termination.

The best defense starts with limiting exposure. At OYO, access to all resources/systems is limited to need-to-have basis and requires manager approval before grant. The access is kept up to date as any employee changes their role or takes on additional responsibilities. We use industry best, next-generation antivirus and malware protection solutions to protect user’s devices. Our offices and development centers are protected with the latest next generation firewalls, IPS, IDS, VPN devices in compliance with our Information Security policy and stringent perimeter security recommendations of Industry.

All our systems are on a highly secure cloud platform, using robust network architecture including separate VPC for each critical system. Our Websites & Applications are using strong SSL encryption to protect data during transit. All sensitive data is encrypted at rest in the cloud. All public traffic is scanned through the industry-leading web application firewall (WAF). Connection to cloud is allowed only through MFA enabled VPN tunnels.

Our sophisticated WAF service with custom rules thwarts millions of attacks every month:

All code changes go through automated and manual security testing before getting deployed to production. Our code is stored on secure Github private repositories protected through MFA (multi-factor authentication) which is a step above the commonly used two factor authentication. We carry out static code analysis and dynamic testing of our Applications, Websites and services using both internal teams and external security partners. Any new application has to go through mandatory Vulnerability Assessment/Penetration Testing(VAPT) and certification before the public launch.

As per the Vulnerabilities Trend Report 2020 from SkyBoxSecurity, there has been 3.8% vulnerabilities increase i.e. 16391 in 2018 to 17220 in 2019 at the infra, application and OS level. These ever increasing numbers have been the primary driver to take the VAPT process on highest priority. This exercise has helped us:

1. Identify, detection and remediation of most recent bugs existing in the environment to prevent any current and future exploits/attacks

2. Efficacy and Validation of Security Controls currently implemented

3. Enumerate Risk associated with application, systems and information

4. Attain and Sustain various compliance requirements

Regular vulnerability assessments and penetration tests are conducted both by our internal staff as well as external partners on our behalf. Our 24x7 SOC is constantly monitoring for any threats and suspicious activities and proactively protecting against those. In addition to PCI-DSS and GDPR, we are regularly audited for information security as part of ITGC (IT General Controls audit) and various statutory audits.

“OYO has been successfully running its 2nd year of PCI Compliance. Adherence to Payment Standard is of utmost importance to our business, non-adherence or non-compliance to any of the payment requirements is just out of question” says Arpit Jain, Sr. Engineering Manager, Payments

“With the majority of our Infrastructure on Cloud, we take enormous caution and controls before exposing any of our assets publicly. All such requests go through a thorough need vs risk logic.” says Nitin Nagpal- DevOps Architect

True to our core leadership principle of “We make our lives harder to make our customers and partners life easy”, our information security experts spend sleepless nights protecting your data, so our customers, partners and employees can sleep easy.