Ambassador

Sriram Lakshmanan

Deputy CISO at Genpact

IndiaVerified Community Ambassador

Identified Expertise

Content Sriram is Following

Please join or sign in to view Sriram's full profile

By joining the Peer Community, you'll get:

Peer Discussions and Polls
One-Minute Insights
Connect with like-minded individuals

Do you trust the data & reports from the big analysts?

Strategy & Architecture

Yes

Sometimes

View Results

111.2k views126 Upvotes59 Comments

How much time do you spend evaluating vendors each week? E.g. Reading up, having phone calls and demos etc.

Strategy & Architecture Financial Management Security Strategy & Roadmap+1 more

<1hr

1-3hrs

3-5hrs

>5hrs

View Results

7.7k views1 Upvote3 Comments

What feels like the most difficult part of starting a company?

Culture & Values

Raising funds

A good idea

A good team

High probability it fails

Other (please comment)

View Results

8.5k views4 Upvotes11 Comments

With the increased amount of cloud computing and the number of services available through cloud providers, do you think that in the next 10 years the world can go zero on-premise infrastructure?

Cloud Network

Yes

Unsure

View Results

5.5k views2 Comments

As a security professional, do you currently feel as though you have a place with your executive team/board as a business advisor?

People & Leadership Strategy & Architecture Process Management+10 more

Yes

Yes, but not as much as I'd like

No, but I'm expecting that to change

View Results

1.3k views1 Upvote

How long does it usually take you to fill an open cybersecurity position?

People & Leadership Security & GRC Talent Management & Performance

<1 month

2-3 months

4-6 months

7-9 months

10-12 months

>12 months

View Results

3.2k views

Data scientists are in short supply. Is your organization trying to fill the gap by setting up training programs internally to re-skill employees for data science roles?

Data & Analytics Business Intelligence Talent Management & Performance+2 more

Yes

Not currently, but we would consider setting up training programs

No, and we don't have plans to

View Results

2.5k views

Do you know if your employees store their passwords in any of the following places?

Security & GRC Identity & Access Management (IAM)Data Privacy+3 more

In their browser's password manager

On sticky notes

On their phones or devices

Unsure

View Results

7.5k views

Do you have remote employees on your team?

Talent Management & Performance

Yes

131.9k views209 Upvotes64 Comments

Should all employers adopt a four-day workweek?

People & Leadership Culture & Values Talent Sourcing & Hiring

Yes, that's what's best for employees.

No, that would disrupt business.

6.8k views5 Upvotes4 Comments

What are some of the on-the-ground suggestions you have for implementing DMARC/DKIM-SPF in hard fail mode? Have any of you implemented hard fail for subdomains like "SomePurpose (dot)MyDomain(dot)Com" where such subdomains are allowed for specific external service to send emails on behalf of the primary domain? Suggestions?

Process Management

Sriram LakshmananDeputy CISO at Genpact3 months ago

Any new domain should start as hard fail. This will force application owners through whatever your internal process is to send as x domain. If you have existing domains that you switch over you want to review for compliance ...read more

1.5k views1 Upvote1 Comment

What are some of the DNS security practices that you have employed? Given the noise of DNS traffic, what are some of the methods you've used to handle it better for threat detection.

Security & GRC Infrastructure Data & Analytics

Sriram LakshmananDeputy CISO at Genpact4 months ago

Block 8.8.8.8 and 9.9.9.9 as an example

5.4k views1 Upvote1 Comment

What are the 3 most important sub-projects / workstreams you have instituted in your journey of stronger cyber resilience for your organization and why?

Security & GRC

2.7k views

Does anyone use a commercially available Control library and also us the same for audit management/policy and effectiveness metrics. If yes would also like to discuss and brainstorm on how are you using the same for threat modeling and any other area?

Security & GRC

Sriram LakshmananDeputy CISO at Genpacta year ago

I have some idea around Azure auditing, can brainstorm on your use case.

1 Reply

Read More Comments

768 views1 Upvote4 Comments

What advice can you offer security leaders currently trying to win executive support to create a secure behavior and culture program? How should they frame the business case for an SBCP?

Awareness & Training Security Strategy & Roadmap People & Leadership

Sriram LakshmananDeputy CISO at Genpact2 months ago

Security awareness in most org is seen as a check in the box compliance requirement and a bit as nice to have. For me, security is part of value system, much like integrity is or focus on workforce engagement might be. And ...read more

Read More Comments

299 views5 Comments

In your opinion, what are the biggest hurdles getting in the way of wider adoption of metaverse across industries?

Disruptive & Emerging Technologies

Sriram LakshmananDeputy CISO at Genpact7 months ago

Just my opinion, but, one of them is how it can be used in ways that move it largely beyond novel. A more immersive, interactive engagement is nice, but, how does it contribute to industry or business goals (increased profitability, ...read more

Read More Comments

2.2k views5 Comments

My organization is in the process of establishing an information Security directorate. I was tasked with proposing an ideal structure for the Information Security function. Currently my proposed design has 2 main components: 1. Security Management (reporting to CISO) 2. Security Technical Operations (reporting to a Senior IT Security Manager) Furthermore, the Security Management functions will lead the security infrastructure, IAM and SOC capabilities and Security Management will drive the implementation of ISMS, Gov, Risk and compliance and Strategy and Policy. Would like to hear what other organization are doing in term of organizing their resources?

Security & GRC

Sriram LakshmananDeputy CISO at Genpacta year ago

Some perspective you might find useful here: https://www.fncyber.com/web-of-trust-article/the-3-must-have-cybersecurity-roles-in-your-organization

Read More Comments

3.2k views2 Comments

Can anyone recommend application security best practices for generative AI tools?

Disruptive & Emerging Technologies Security & GRC Security Strategy & Roadmap

Sriram LakshmananDeputy CISO at Genpacta year ago

I would say quite the same as a standard application with an additional focus on data exposure. My main focus when my company started using Generative AI was focus on data ingested by the AI (we are an EU based company), ...read more

2 1 Reply

Read More Comments

3k views3 Comments

I would like to understand matrix reporting success in organization design. Specifically, if there are views of having dotted line reporting from a different location into the US? Does Line management and dotted line management work in your experience?

Process Management Team & Organizational Design

Sriram LakshmananDeputy CISO at Genpacta year ago

IMHO,
1) for anything to to succeed the outcomes and how it shall be measured will become relevant. I suggest to think thru what is that subteam / team supposed to deliver and what will success look like. For instance ...read more

Read More Comments

3.1k views2 Comments

Purple teaming — can anyone recommend best practices for getting your org started?

Secure Code & Automation (DevSecOps)Security Strategy & Roadmap Threat & Vulnerability Management

Sriram LakshmananDeputy CISO at Genpacta year ago

New term for me. Interested in everyone's comments. Let's discuss!

Read More Comments

2.9k views4 Comments

Why has strategy evaluation become so important in business today?

Process Management People & Leadership

Sriram LakshmananDeputy CISO at Genpacta year ago

With stakeholders expecting more from companies and sustainability becoming a priority, evaluation helps align strategies with long-term goals and social responsibility. By fostering a culture of continuous improvement, businesses ...read more

Read More Comments

3.9k views4 Comments

My security analyst is recommending we shut off access to third-party personal email accounts to reduce the risk of attack as a result of phishing attempts through these platforms. Is this something many companies do?

Relationship Management Security & GRC Data Protection & Encryption+11 more

Sriram LakshmananDeputy CISO at Genpacta year ago

yes - no personal email (ex. gmail), collaboration sites (google doc, for instance), and social media except where we have a presence (LI, Twitter...),

Read More Comments

4.9k views9 Comments

Where do HR and other non-security/IT departments fit into your insider risk management strategy/program? What role do they currently play?

Security & GRC Risk Management Threat & Vulnerability Management+1 more

Sriram LakshmananDeputy CISO at Genpacta year ago

It is challenging, but sometimes very important for HR to work with IT and Security for scenarios where employees will be laid off, etc. as those people are often higher risk for performing unauthorized or malicious acti...read more

Read More Comments

5k views1 Upvote7 Comments

How often do you do phishing campaigns?

Security & GRC

Sriram LakshmananDeputy CISO at Genpacta year ago

Are we sure that phisingtests are not doing more harm then they solve? Business is bussy and those test dont reflect the reality of nowadays stellar phishs. I think better to invest in phishing resistant authentication so ...read more

Sriram Lakshmanan

Identified Expertise

Content Sriram is Following

Do you trust the data & reports from the big analysts?

How much time do you spend evaluating vendors each week? E.g. Reading up, having phone calls and demos etc.

What feels like the most difficult part of starting a company?

With the increased amount of cloud computing and the number of services available through cloud providers, do you think that in the next 10 years the world can go zero on-premise infrastructure?

As a security professional, do you currently feel as though you have a place with your executive team/board as a business advisor?

How long does it usually take you to fill an open cybersecurity position?

Data scientists are in short supply. Is your organization trying to fill the gap by setting up training programs internally to re-skill employees for data science roles?

Do you know if your employees store their passwords in any of the following places?

Do you have remote employees on your team?

Should all employers adopt a four-day workweek?

What are some of the DNS security practices that you have employed? Given the noise of DNS traffic, what are some of the methods you've used to handle it better for threat detection.

What are the 3 most important sub-projects / workstreams you have instituted in your journey of stronger cyber resilience for your organization and why?

Does anyone use a commercially available Control library and also us the same for audit management/policy and effectiveness metrics. If yes would also like to discuss and brainstorm on how are you using the same for threat modeling and any other area?

What advice can you offer security leaders currently trying to win executive support to create a secure behavior and culture program? How should they frame the business case for an SBCP?

In your opinion, what are the biggest hurdles getting in the way of wider adoption of metaverse across industries?

Can anyone recommend application security best practices for generative AI tools?

I would like to understand matrix reporting success in organization design. Specifically, if there are views of having dotted line reporting from a different location into the US? Does Line management and dotted line management work in your experience?

Purple teaming — can anyone recommend best practices for getting your org started?

Why has strategy evaluation become so important in business today?

My security analyst is recommending we shut off access to third-party personal email accounts to reduce the risk of attack as a result of phishing attempts through these platforms. Is this something many companies do?

Where do HR and other non-security/IT departments fit into your insider risk management strategy/program? What role do they currently play?

How often do you do phishing campaigns?

Engagement Stats

Content Sriram is Following

Do you trust the data & reports from the big analysts?

How much time do you spend evaluating vendors each week? E.g. Reading up, having phone calls and demos etc.

What feels like the most difficult part of starting a company?

With the increased amount of cloud computing and the number of services available through cloud providers, do you think that in the next 10 years the world can go zero on-premise infrastructure?

As a security professional, do you currently feel as though you have a place with your executive team/board as a business advisor?

How long does it usually take you to fill an open cybersecurity position?

Data scientists are in short supply. Is your organization trying to fill the gap by setting up training programs internally to re-skill employees for data science roles?

Do you know if your employees store their passwords in any of the following places?

Do you have remote employees on your team?

Should all employers adopt a four-day workweek?

What are some of the DNS security practices that you have employed? Given the noise of DNS traffic, what are some of the methods you've used to handle it better for threat detection.

What are the 3 most important sub-projects / workstreams you have instituted in your journey of stronger cyber resilience for your organization and why?

Does anyone use a commercially available Control library and also us the same for audit management/policy and effectiveness metrics. If yes would also like to discuss and brainstorm on how are you using the same for threat modeling and any other area?

What advice can you offer security leaders currently trying to win executive support to create a secure behavior and culture program? How should they frame the business case for an SBCP?

In your opinion, what are the biggest hurdles getting in the way of wider adoption of metaverse across industries?

Can anyone recommend application security best practices for generative AI tools?

I would like to understand matrix reporting success in organization design. Specifically, if there are views of having dotted line reporting from a different location into the US? Does Line management and dotted line management work in your experience?

Purple teaming — can anyone recommend best practices for getting your org started?

Why has strategy evaluation become so important in business today?

My security analyst is recommending we shut off access to third-party personal email accounts to reduce the risk of attack as a result of phishing attempts through these platforms. Is this something many companies do?

Where do HR and other non-security/IT departments fit into your insider risk management strategy/program? What role do they currently play?

How often do you do phishing campaigns?