Hi, this is Gita Nandikotkur, managing editor for Asia and Middle East with information security media group. I caught up with the Nikhil Vee-Baggle-Kotkur, pre-sales head virtualization, etc. to discuss how the digital shift instigated by cloud among today's mobile workforce is exposing corporate networks to more complex cybersecurity issues. Nikhil discusses a challenge faced by the information security practitioners in reducing the business risk and enhancing productivity, and also recommends essential steps to manage enterprise mobility risk on cloud.
Thanks Nikhil for joining the conversation. Thanks, Nikhil. Nikhil, what do you think the biggest challenges enterprises are grappling with today? When it comes to managing risk on cloud, especially in providing access to applications data on cloud.
Cloud represents a new frontier when it comes to essentially placing data accessing apps, and it disrupts the traditional way of looking at how the applications and integrity of data are accessed by the user. The interesting thing that happens as when you start moving towards the cloud is that all the control, all the security parameters that you've deployed inside your data center, inside your office, inside your office locations, they cease to exist because data applications move away from a current location to a location which is undisclosed. The account would be anywhere, so your data and applications would reside anywhere in the world and it would be accessed anywhere in the world. And the typical risk that comes associated with moving in this direction is how do we ensure that the security measures that we have in place within the organization, the security parameters, the policies that we've taken years and years to develop and deploy across the organization, how do we extend that to the cloud?
And that's one of the areas where enterprises are still interacting with adoption of cloud. Most organizations are worried about what happens to my data, once I place it on the cloud, will others be able to see it, access it? What happens if the cloud itself is compromised? So all of these security related questions come to form, whenever we start talking about big enterprises, cloud and critical data, and this is being made even more difficult by some of the larger regulators.
If you look at how GDPR is coming into effect or some of the regulatory norms by countries like South Korea around content isolation, it's putting even more doubts with respect to security. As you rightly said, there's so many regulations that GDPR are coming into focus. And so do you think, is there a corporate governance through our strong information security, which is critical to protect these data or digital identities on cloud? How can governance really evolve when it comes to moving to the cloud?
And especially with large enterprises that have data and applications being spread over something known as a cloud strong. So no longer do organizations just restrict themselves to a single cloud. You have multiple clouds each serving a specific purpose. So there could be a cloud which is dedicated towards games processing.
There could be another cloud that's dedicated towards CRM. There could be, again, another cloud that does your E&R applications. And what happens is as an organization chooses to move towards the cloud, they more often than not realize that it's not just one cloud that they subscribe to, but it is a combination of multiple clouds, each with their own capabilities and gaps. The security angle of this plays an even bigger role when you start considering, how do you ensure that the security parameters or the security posture that the organization has is consistent irrespective of where the application comes from, on-premise cloud data center could be hosted could be anywhere.
But the crucial part of it is ensuring that the secure perimeter or the security posture of the organization remains consistent across all the applications and across all of the data. And that's where strong corporate governance around information security comes into play. And going forward, we are going to see that a lot of organizations are going to play a lot more emphasis and put a lot more focus on information security and corporate governance around that because as soon as data bursts beyond the data center, the security of it has to be imposed in line with what the organization security posture is. And that's where most organizations are really putting in strong policies.
This would also mean that they would be increased to risk console, right? And now the challenge is that CEOs are grappling with to manage this risk. So what kind of risk management methods do you think would be adopted by these enterprises in protecting their apps and data from being compromised in the cloud environment? Very nice question.
What we're seeing risks are changing on a day-to-day basis. If you're a number of attacks that enterprise large enterprises are facing on daily basis are going up exponentially. A few years back, attacks would happen once a month, probably once a quarter, once in six months. Now, attacks are the de facto norm.
You look at what happened with API, what happened with Wanakai, there are a whole host of them, but essentially what organizations are realizing is risks and security loopholes are given. And what organizations are really working towards is working towards something on as an alternate paradigm of security. This alternate paradigm of security does not try to fight the attacks, but assumes that attack is going to go through and then works around preventing the exposure when an attack goes through. So, this is one of the core technologies around this alternate security paradigm has been network separation and network isolation.
And a very basic level, what it says is if you have an application or user talking to the internet, that application or user cannot talk to your internet or your corporate applications. It's easier said than done, right? Because I can easily say that you need to separate these two things, but when I actually go to implement something of these sorts, there's a whole lot of complexity that comes into the environment. Do I give everybody two pieces, one connecting to the internet, one connecting to the internet, how do I handle applications like emails, which even though they sit inside my data center, they still talk over the internet to exchange emails.
And all of these technologies together building a solution wherein we can deliver capabilities around network separation, network isolation. And the idea is always being that this is an alternate approach to security. We are going to assume that some of the attacks will get through because they are de facto attacks and nobody seen them before. But when they do get through, we will ensure that the exposure of the organization is minimal.
I wouldn't say zero, but minimal, 50 attacks goes through. And that means that you do segmentation, you do network separation, you do network isolation, air gap networks, the whole lot. And that's something that the industry is heading towards in terms of looking at an alternate paradigm of security, which can help them manage that is much better. The principle behind where it is always around like you're going to assume that one or two years will get fixed, but what you need to do is you need to isolate containerized and provide hard walls between key separate containers and such a way that even if one container compromise, the spread of the breach is limited.
This is something that, again, network isolation, network separation, application virtualization, application multiple technologies are playing a big role in this place. You heard of advanced protection, web application, firewalls. So all of these are mechanisms in which this layered security framework can be built and organizations, as of today, really are embracing this to the fullest. And going forward, we see these mounting as optional components to the security landscape, but being the basis on which the security landscape of enterprises is developed and created.
Yes, given these complexities against this backdrop of the various segmentation, layered security approach, what kind of security architectures and technologies are evolving? What we see right now is we are probably the most interesting times when it comes to security technologies. We've seen a lot of development, a lot of new startups, a lot of new established players in the technology field, venturing into cloud security and essentially enabling organizations to extend their security perimeter beyond their corporate offices and data centers. This is given to rise, this is given rise to something on a secure digital perimeter for organizations.
And this has also been fueled to a large extent by analytics, AI, big data, the whole lot. There are technologies today where they can monitor the security posture of a user in real time, based on all the activities that users do. They can monitor what IP the users are coming from, what are the websites the user access before they landed on their corporate website. They can take a call on the number of parameters that the user has come from, the network segment, the security of the network, the whole lot.
So you can analyze all of this data in real time. And why are the users connecting you with the organization can essentially take a call on what is the security posture should we allow them inside? Or do we just block them out? And all of these next generation security technologies are pushing the entire complex of security or rather the security landscape forward.
So I guess what would be the new authentication methods? Are there any new ones that are emerging to secure this data on cloud? Absolutely. And could you what this are?
Because the days of authenticating just the user are gone. People have realized that more often than not, the toggle maker is not the user but the device, all the platform is the user accessing his applications. In fact, in quite a few scenarios, like you have seen in case of one-appran, the system that is generating malicious content is the user is not aware of the intent and what the system is doing. So it is invisible to the user of sorts.
And that in mind, what the world is moving towards is moving to a multi-factor authentication model. You no longer authenticate just the user. You authenticate his security posture, what he has been doing so far. You authenticate the device from which he's connecting.
And you take into account all the thousands and thousands of factors that a user is associated with before we make a decision on whether to bring a user or not. So even though the user might actually be a valid user with the right user name and password, you may choose to not allow him inside because his IP is exic on top of you. And you wouldn't expect one of your users to be updating from that country. All of these aspects are evolving the space of their security and authentication again adds another layer.
We can no longer just rely on standard user name passwords or even your OTPs because, yes, what recently we've seen OTP is also being hijacked by doing. So we're looking at a multi-faceted security model. We don't just authenticate a user based on username and password. You look at what he's been doing.
You look at his security posture of the device. You look at multiple factors like the security posture of the network from which he's connecting and then take a call. And this new form or new mechanism or new way to authenticate users is what's essentially going to protect and secure it. And from your experience, you have been talking to a lot of customers in and day out.
So how do you think they are following the same kind of steps that you've discussed in terms of authenticating or in terms of layered security approaches? Or where are the gaps? So right now, as we speak, from a company specific standpoint, you've seen as well as still struggling to break the standard way of looking at security, finding it difficult to adapt to this concept that security has to be layered. Intrusion is a given and you need to start building layers.
You need to start looking beyond just regular user authentication. You need to look at multi-faceted authentication. And that's some of these areas where people are still getting their thoughts around this and trying to see the viability of bringing such a solution in their environment, which has a mix of, of course, cloud-based environments and legacy applications. So that's when enterprises are still while they are still having the old security framework in place.
The jump to the new security layered model is not going to be easy because it requires a completely different talk process, a completely different view to how security is supposed to function within the organization. Some customers get it. We've seen that cloud-first companies have been really helpful companies. Companies were just starting up in the security space.
They've been able to appreciate this. They've gone ahead and taken some robust measures to build these multi-year security models. But some of the older freaking model companies, or you would say some of the, some of the companies, which are really, really old, and they've tended to not evolve as much and embrace the cloud as fast as most others have. They still continue to struggle with these new security models.
And again, security cloud is this one part of it. Security is a given in today's world, where in almost every organization has to plan security as the primary initiative, and everything else is an add-on. So security becomes crucial because if you lose data, not only two organizations, it moves on their credibility and trust, but we've seen multiple organizations even having more severe impacts because of these security breaches. How do you think enterprises should manage third-party risk as users apply least resistance to share the data among themselves and third parties?
This is, again, a new trend that's emerging. As we see the new generation of workforce joining our company, this new generation is essentially our internet or digital generation as we call it. They were born on internet calls, and they think that everything is available at a finger to a thing should just work at the same time. Everything should be integrated with everything.
So when you tell them that the corporate CRM application is on your phone, guess what they will try to find the way to integrate that with their drum box or with their social media feeds or with some of the content that it is. The need to have a hyper-integrated environment is not going to go. And more and more of these new generation people who are joining the workforce, they will push the security frameworks that organizations have even further because the apps are becoming hyper-integrated. The environments are getting highly dispersed across clubs, and that's where coming in with a solution that's going to secure applications irrespective of the device that you're using.
And essentially, think of it like an invisible sandbox around the application, building something of that stuff is really where to define how organizations are going to be able to secure their applications, while at the same time, provide these next generation workforce people the capabilities to interact with the organization's apps. So thank you very much, Nikhil, for sharing your thoughts on the essential steps to manage enterprise risk on cloud. Thank you. This is Gita, and