HOME | ABOUT US

Case Study – Prescribing efficiency at one of India’s fastest growing pharmaceutical companies

Adopting growth as a standard operating procedure

Today, as one of the fastest growing pharmaceutical companies in India, NATCO Pharma began operations in Hyderabad in1981 with an initial investment of INR 3.3million. From a single unit of operations with 20 employees, today NATCO has seven manufacturing facilities spread across the country with dedicated modern research laboratories and capabilities in new drug development. With their exponential growth, the NATCO Pharma family now consists of 5000 employees and is well recognized for its innovation in pharmaceutical R&D.

Mr. M Prabhakar Rao, Associate Vice President at NATCO Pharma, is a veteran IT leader in the Indian pharma industry, and he has been the driving force behind the digital transformation of the company.

Calibrating the problem

In early 2019, while Mr. Rao was evaluating the IT infrastructure to modernize the Kothur site — one of the seven facilities of NATCO, he found that the older generation3-tier IT infrastructure was having constraints in terms of scaling up and resilience.

The performance issues at the Kothur facility triggered Mr. Rao to start looking at various options to solve the inefficiencies in operations. He was aware that the hyperconverged infrastructure (HCI) was quickly becoming commonplace in the pharmaceutical industry.

This idea was discussed internally with Dr. B R Reddy — Director FDF, who always welcomes change for the better. A joint presentation was done by Dell Technologies, VMware, and the scientific application vendor team to all the stakeholders. The idea was principally agreed upon, following which Mr. DVV Satyanarayana — Manager (IT)from the Corporate Team and Mr. N Ashok— Manager, IT — Kothur plant, discussed and worked on the architecture, data lifecycle from creation to backup and archive, verified the architecture from all internal and external stakeholders, and sized it for present and future in tandem with the compliance requirements.

After several deliberations, Mr. Rao was convinced that he needed to modernize his existing infrastructure. For which he appointed Dell Technologies and Gowra Bits& Bytes — the partners he had worked with earlier during the successful VDI deployment at NATCO Pharma’s Vishakhapatnam facility using similar HCI technology. NATCO Pharma had experienced strong quantifiable benefits of this exercise, and it gave him the confidence to involve the same team again.

True to form, Mr. Rao was committed to ensuring that the highest levels of process documentation and compliance were also to be followed at NATCO Pharma, in line with its reputation as a responsible organization.

Prescribing the right solution

NATCO Pharma, as part of their IT modernization plan, wanted to evaluate various solutions on a comprehensive5-parameter matrix: scalability, agility, data security, availability, and more importantly, a future road map for the solution to avoid bottlenecks and better return on investments.

Discussions on the requirement and implementation started in July 2019 and focused on core requirements, RAM, the amount of storage backup, and the type of backup — tape or disk.

This required collective inputs and efforts from all stakeholders — scientific application vendors, end-users, business leaders, the quality assurance team, and the IT team under the leadership of Mr. Rao. To gain a better understanding of how the solution must be implemented, the project teams at Dell Technologies, VMware, GBB, and the scientific application vendor team engaged in a site visit and proposed the benefits of VxRail to all the stakeholders. Additionally, the team from the existing scientific application vendor shared their experience with other similar projects, implications of HCI solutions, and compliance-related guidelines. Dell Technologies and VMware presented the solution that meets the 5parameters of the evaluation and GBB shared their deployment plan covering the solution implementation plan. With all these factors in mind, the Dell EMC VxRail powered by VMware vSAN technology was deemed as the best possible solution for Natco Pharma. The proposed HCI solution, was highly scalable, agile, and furthermore, would also cover the compliance norms of US FDA 21CFR Part 11 and other pharmaceutical-related compliances. Above all, the scientific application that was part of NATCO’s IT infrastructure could also seamlessly function on the proposed VxRail solution.

All these discussions and practices were vetted and approved by the NATCO QA team.

The responsiveness of Dell Technologies to queries and the process documentation expertise of GBB was a major point of success during this whole exercise. GBB, as an implementation partner, played a massive role in identifying and understanding the flow of data — how the data is written, how it flows into the functional system, and then back to the IT hardware, and finally how it is stored at various levels.

Above all, the challenge of process documentation required close monitoring as it has to be done during the implementation process. Dell Technologies and GBB’s prior expertise in the pharmaceutical industry was another major success factor during the implementation process.

Compounding benefits

The proposed VxRail solution is unique in its ability to manage multiple virtualization sat once. With all these factors in mind, the Dell EMC VxRail, powered by VMware vSAN technology, was deemed as the best possible solution for Natco Pharma. This was a huge benefit for the organization and coupled with the ability to be managed remotely has added great value to the implementation as a whole. As Mr. Rao had envisioned, the VxRail HCI solution had instantaneously benefitted them. The key benefits were:

“Virtualization in the GxP environment is a new concept for us. When we discussed it, we understood that we could utilize its intended features to increase IT productivity, efficiency, agility, and responsiveness for critical workloads. We could also exploit this for faster provisioning of applications and resources by developing internal procedures. This solution met our expectations and our future requirements. It also helped us to fulfil regulatory requirements by enabling its features such as High Availability, Scalability, and Reliability, etc.”

Dr. B R Reddy
Director (FDF)
NATCO Pharma

A cure for all ailments

The implementation was a huge success. All the parties involved are satisfied with the new IT infrastructure in place and the Kothur site is now able to handle workloads efficiently while delivering the best results and achieving an effective ROI with this exercise. Mr. Rao is a delighted man and is now looking to replicate this model for a centralized, efficient, and highly available IT infrastructure for other critical workloads, making this implementation a huge success for all stakeholders involved.

HOME | ABOUT US

How companies could prevent “SolarWinds Supply chain” kind of attacks

SolarWinds is a well-known company that provides the tools & offers services for real-time monitoring and analyzing the IT infrastructure & Applications, it’s “easy-to-use” interface makes it popular amongst many large-scale corporations, mid-market & small businesses across the globe.

In 2020, a major cyberattack (popularly known as “SolarWinds Supply chain attack”) suspected to have been committed by a group known as “cozy bear” backed by the Russian government penetrated thousands (estimated to be 18,000+) of organizations globally including the likes of Microsoft, Google, Intel to name a few. Even multiple departments of the United States federal government were not spared, Intelligence agencies also suspect that this attack could have stolen critical insights on covid-19 vaccine research.

Ironically the hackers first gained access to the SolarWinds systems in January 2019 and the attack not being publicly discovered or reported until December 2020, several months earlier than previously known , revealed Mr. Sudhakar Ramakrishna CEO @SolarWinds.

Just like programmers across the globe, even SolarWinds Orion programmers leveraged GitHub for distributed version control and source code management which mostly has sensitive information which unfortunately got compromised because someone mistakenly marked it public instead of private. According to the company sources one of their Interns (who is no more working) probably used a fairly simple password “solarwinds123 whichever the case maybe it opened the door for the hackers who could have then meddled with and usernames and passwords & even deployed malicious software update package called sunburst into the build process this then allowed them to target SolarWinds customers.

However, this intrusion was first uncovered by the cyber security company FireEye because it too was a victim of this attack & it was detected when one of the employees of FireEye got a request to reset their multi-factor authentication which they had not done.

Here is the list of practices Companies could adapt in order to prevent SolarWinds & similar kinds of attacks :

By deploying a proven Two-factor authentication along with a third-party password manager
By keeping their Security & Network Appliances (AV, Firewalls, Switches, Routers, etc. ) & Software (Applications, Databases, Operating Systems, etc.) patches updated
By training their employees using interactive training methods comprising of videos, simulations, quizzes, etc.
By making Network VA/PT & Application code reviews a regular practice

HOME | ABOUT US

All about Log4j Vulnerability

Log4j is a popular open-source logging library written in Java. It helps to organize and manage the flow of logs from applications ,filter them and send them to different output streams. Log4j solves the problem of having to choose between too many types of logging methods to use. It was designed for scalability and so it can log a large amount of information without slowing down or crashing an application. That’s why it is so popular – developers use it because it’s easy to set up and configure, yet offers advanced features for specialized requirements.

In December 2018, a new vulnerability in the open-source logging library Log4J was revealed by an independent security researcher. He discovered that a vulnerability in the way the library handles exceptions allows an attacker to compromise any log file with a crafted exception message. The researcher even tested this vulnerability on various applications and found that it affects more than 500 million endpoints & the list includes over 7,000 corporate networks and 4.7 million servers of even some of the large companies such as Amazon, Tesla, Uber, Netflix, Spotify and Microsoft. The risk of exploitation is high and the exploit is publicly available as well as being very easy to execute.

The Log4j Java library has a vulnerability that could allow attackers to take over systems running OS including Linux, OS X, and Windows. It’s ability to easily bypass even the firewalls and subvert any system makes it vulnerable to external attacks And it can be exploited by anyone who can access the machine via a local network or remotely through a VPN connection . It’s mostly used by hackers in attacks that allows hackers to install crypto currency mining software on systems. Recently an Iranian group of hackers has also tried to use this vulnerability to breach some government agencies of Israel according checkpoint cyber security company.

Vulnerabilities in Log4j allow denial-of-service attacks to be executed remotely, which can extract data from the logs. The following are the main consequences of this vulnerability:

An attacker can send arbitrary requests to the API, which allows them to execute arbitrary code on the system
A user may be tricked into opening a malicious file and executing any code included in it
An attacker may be able to use this vulnerability to cause denial of service among other things
Vulnerability may allow an unauthenticated remote attacker who sends specially crafted requests to force an application

The vulnerability has been confirmed in “Log4j 1.2.17” and “Log4j 1.2.6” & the bug was first identified on November 16th, 2017 by the researcher who goes by the online alias “gclayc.” . Thankfully the vulnerability has been fixed in “Log4j 2.8”, which is released on December 19th 2017 and is available from the Maven Central Repository . Security researcher, Denis Kutovoy from the Russian company Digital Security has recently published proof of concept for this vulnerability on GitHub.

The only protection against it is to update your Log4J installation to the latest version as soon as possible .If you are still not sure if your machine is vulnerable, you can test it by running “java -jar ds_log4j_vuln_poc1.0-SNAPSHOT-all

Want to know how our solutions can help your business?

SCHEDULE AN APPOINTMENT