Data resiliency: Protecting data in a difficult world!

Today’s data landscape is a hybrid, multi-cloud world, and it’s everything, everywhere, all at once, making data protection a big task for businesses and governments.

The challenge for IT and security leaders is to protect all data, no matter where it resides, and prepare for ransomware and other cyber threats! They need to do all of this at ever-shrinking budgets and skill shortages. Evolution of technologies has enabled approaches and tools that can help the CIOs and CISOs streamline data protection and security.

Dataquest, Cybermedia India Ltd, organized the Data Resiliency Road Show in New Delhi, India. It had a theme: Protecting data in a difficult world, along with Commvault and Lenovo.

Anil Chopra, VP, Research & Consulting, CyberMedia Research, welcomed everyone. This is an interesting theme. Data continues to grow, and could be 175ZB in two years’ time. There are people managing data in the background. We are living in hybrid, multi-cloud world today. We need to protect, secure, and make data available to the consumer. Data will continue growing in future.

Cyber security part of national security
A Bhardwaj, Joint Director, IT & Cyber Security, Ministry of Defence, gave the keynote address. India is likely to surpass USA to become the second largest economy of the world by 2075. India has jumped to 10 from 47 in the global cyber security index. Data protection bill was also approved last week by Government of India. Cyber security is now part of the national security. Cybercrime is the largest man-made risk for any country. India is the third largest country that is being attacked right now. We are now awaiting the arrival of Kalki Yuga. It will end the darkest, degenerating, and chaotic stage of the Kali Yuga.

We have now moved to the digital world. There are no checks and balances there. There is no security, but only opportunity. Cyber security is today mired in obscurity, more than ever before. We have ransomware attacks, disinformation drives, malware attacks via smartphones, supply chain disruptions, crypto-currency, and digital currency theft, etc. Man has been continuously evolving with the security issue.

The history of warfare has many facets. The fundamental is the same, but the execution has changed. Warfare has now become asymmetric, hybrid, and AI warfare. Russia-Ukraine war is already 500+ days. Ukraine was prepared, and had the backing of NATO. It also had dominance of technology. Covid-19 brought about WFH. If we look at the warfare landscape, do we have the fog of battle, or problem of plenty? War revolves around the passing of information. One who can provide right information will have the upper edge.

Brig. Phil Davies (Retd ) had said on data-centric security (2014): "We face an inflexion point between the industrial age and the information age. Defense will need to take the initiative if it is to retain its competitive edge relating to the utility and centrality of information."

DoD carried out data centric-security, and came out out with NIST-DCS. Data-centric security management depends lot of factors. We need to identify, understand, control, protect, and audit all data. We need to verify everyone, as we go forward.

Bhardwaj talked about data-centric security (NIST -DCS). It is an approach to security that emphasizes the dependability of the data itself rather than the security of networks, servers, and applications. Enhanced protection of information (data), regardless of where data resides or whom it is shared with. Data-centric security management necessarily depends upon the organization knowing what data they have, what its characteristics are, and what security and. privacy requirements need to meet, so that the necessary protections can be achieved.

There are five elements of data-centric security -- identify, understand, control, protect, and audit. It is essential to have zero-trust security model.

Data-centric security model with applied access controls is necessary. The four Ws of data-centric security are: Where is the data? What is the data? Who has access to the data? Why do they need access to the data? Security paradigms that served in the past must evolve. Data loss prevention or DLP is the foundation for data-centric security.

84 minutes for incident response!
Aneesh Dhawan, Head, Enterprise and Public Sector Sales, India and SAARC, Commvault, delivered the industry keynote. Life has got transformed because of multiple things. Threat landscape has also changed completely over the last five years. Core of any transformation is data. Every IT leader appreciates the fact that the more technology is embedded in your daily life, the more valuable is the data. Leaders now need to think about how can they protect their data.

Data is everywhere! 89% of companies are today multi-cloud. 50% of enterprise-critical data will be outside the company's cloud. Also, 60% of companies lack complete visibility into where data resides. During Covid-19, so much of chat apps happened. Organizations also do not complete visibility of where their data lies. Governance and compliance are vulnerable, and that can lead to cyber threats.

In 2018, there were 2 lakh attacks. By first two months of 2022, it was 2.14 lakhs. 93% did not have proper identity access controls. 65% did not have proper information protection strategies. Attacks are now faster than ever. What once took months, now takes minutes. You now have 84 minutes for incident responders to react to any cyberattack. The pressure today is huge on teams protecting the data. They need to reduce the blast radius of the attack.

Speed complexity, sophistication, etc., have changed very quickly. Attacks are far more broader, than ever. There is increasing risk to backup and recovery data environments. There has been 83% increase in ransomware. 90% are now getting exposed to double and triple extortion. Data protection teams need to get out of regular work, join hands with security teams, and partner with NIST Security.

Commvault has been providing teams with the right tools to extend data protection with active defense. It provides next-generation data protection. You can stay resilient, anticipate threats, and respond with confidence. It provide proactive, multi-layered security for cyber resilience. We also have zero-trust architecture for users. We provide risk analysis. Security IQ gives you an insight into areas where you need to guard yourself. The solution provides auto recovery, threat scan, and backup and recovery.

We provide services in the way customers want to consume. Commvault is trusted by organizations around the world. The Commvault TCO is 3-5x better over cloud-native data protection tools.

Changing security landscape
Sanjay Sharma, Senior Solution Architect – North and East India, Lenovo, also delivered an industry keynote. There is the bi-modal challenge of an IT organization. Consumer pain points are cost cutting, technical debt, and talent. The emerging and accelerated needs are AI and sustainability. The security landscape is changing, and you need to be very protective.

We can take care of technical debt by modernizing IT. Clusters can be available with you forever, and that can bring agility. Lenovo ThinkSystem and ThinkAgile V3 delivers end-to-end security. There is built-in hardware and root of trust, firmware immutable root of trust, TPM 2.0, and new compliance, such as FIPS 140.3, enhanced NIST-SP800-193, etc.

We can also lower IT costs. AMD and Intel provide better performance per watt, and slash annual costs. SAP is the global partner, especially for ThinkSystem SR950 V3. We can also free up IT resources. You can have single-server deployment, centralized lifecycle management, data center integration, and edge and data center deployments. Lenovo XClarity Integrator looks after data center integration.

We are also witnessing the importance of AI. Lenovo has AI-ready platforms. It is partnering with 46 and growing best-in-class AI software companies. We also provide right software orchestration.

Containers are also top of the mind. We provide choice of container management. There is demand for workload agility. Lenovo is also managing edge transformation. Edge generates lot of data. We need to bring that to the core, and provide meaningful data for a company. We also take sustainability very seriously. We are reducing energy consumption, waste, and customer costs. There is energy-aware run time that allows better optimization. We also have liquid-cooling servers, rear-door heat exchanger, etc. Lenovo also provides CO2 offset services.

Protecting your data!
This was followed by a panel discussion around protecting data in a difficult world. The participants were Golok Kumar Simli, Principal Advisor & CTO, Global Passport Seva Program, Ministry of External Affairs, GoI, Vijay Kumar Devnath, GM-I&S, Centre for Railway Information Systems, Alok Pandey, AGM (IT) & CISO, Dedicated Freight Corridor Corp. of India, Dr. Sushil K Meher, Head-IT, AIIMS, Aneesh Dhawan, Head, Enterprise and Government, India and SAARC, Commvault, and Sanjay Sharma, Senior Solution Architect, North and East India, Lenovo.

Anil Chopra, VP, Research & Consulting, CyberMedia Research, was the moderator.

Golok Kumar Simli said we need to understand data sets very well. Once we have identified, we need to also have data strategy for people, processes, dealing with citizens, etc. Next, we have the rules of engagement. We need to be in compliance with the laws of the land. Last, comes tools and technologies.

We are dealing with massive data programs. We also need to take a look at the stakeholders involved. It's a three-tier architecture -- client, application that uses the data, and finally, data tier and managing that. We need to be aware of how to come out of a problem, should that occur.

Vijay Kumar Devnath added that the railways deal with different kinds of data. First, you should collect minimum data, especially, that is not available elsewhere. Next, we need to have master data ready. Third, we need to see what data is required to bring us back to feet. We have lot of transactional data, and we need to collect and protect all of that. We also need to know where the data is residing. We should try and protect data wherever it is. We have a distributed approach, with hybrid built-in. Present-day cloud infrastructure is more secure today.

Col. Alok Pandey stressed that the more he enters cyber warfare, it becomes easier for him. Both, attacker and defender, have good capabilities. We go back to the basics, as we need. We need to protect the data that is classified. We also need to distinguish between data and information. It is better to create a backup. Go back to basics, as it will help in digital world.

Dr. Sushil K. Meher noted that healthcare is a critical, and complex domain. You need to understand the health data and their owners. Hospitals are custodians of the data. Lot of healthcare organizations were compromised over the last few years. We need to protect data, and give access to someone.

Government is also suggesting the digitization of data. Demographic data has to be protected. Patient can be at risk if access to data is not available. We are pulling data from Aadhar. That also needs to be protected. We have also observed that two-factor authentication is not that secure. Identifying data, protecting that, how to defend data, how to recover data, and restore data, etc., are the five necessary steps.

Aneesh Dhawan said people continue to work in siloed environments. Uniformity in protection of data is less. Leadership also does not propagate down below. Passwords are given to at least 10 people. People are unaware what's sensitive for them. Nobody wants to label their data as confidential, and even own that. Data ownership decisions are also not there. People cannot take decisions to purge old data. Archiving that is a controversial decision. There is also lot of orphan data in organizations.

Sanjay Sharma added that inventory of data is very important. We also need to have proper reporting of data.

And, what about data governance? Simli said that in his case, the passport holder is the principal owner of the data. We become the custodian of the data. We are using the data for a purpose. We need to use data set for a secondary purpose. We are seeing more time for data collection. Ultimately, the user of the data should be more accountable. We also have transactional data. There is data lifecycle, as well. We should also protect the data. Data in transit, at store, and in use, all must be protected! We also need to create an encryption so that data remains safe at all times.

We are observing the phenomena of the democratization process. We need to follow democratization process when issuing a passport. We need to make data available 24x7 everywhere. We all need to work together, and assure business and technology. Next, we are observing -- mobility of workforce and workplace. We are also talking about cross-border collaboration. We need to keep laws of the land in hand, while doing so.

Devnath added that we need to differentiate between data we need to provide to passengers, and to the partners. You also need to look at your own BCP. PRS or passenger reservation system has data from last three months. If it is lost, there will be confusion. Data needs to be protected. Business also needs access to clean copy. Pilots are equally important, along with train pilots. We provide secondary mobile app that connects to mobile site. We also need to put mechanisms in place for business-oriented usage.

Col. Pandey said cyber physical systems deal with data valuable for that instant. The impact can be instantaneous, for the event. The operational technology (OT) should always be kept separate. Data can be monetized in secondary situations. We can get tempted to have additional streams of revenue. We need to keep them separate. Hence, IT and OT need to be kept separately. We also need to have the ability to stand up again, if we get attacked.

Dr. Meher noted that we need to understand medical data and their forms of availability. There can be no research without data. We can use that to gather intelligence. There is also IoT data, that is talking to each other. We have to also protect that data. Every quarterly, there should be test run.

Digital ethics necessary
Simli added that we need to have and build digital ethics. We have lot of digital warriors. We need to create a culture about how to develop them all. We also need to bounce back faster from ransomware attacks. We need a security assessment framework.

Devnath said we should also have risk assessment. Digital hygiene is abysmally low in India. Ransomware is a big threat for business continuity. We also try and keep backup, as required.

Col. Pandey said that we are responsible for the security of data. We need to build checks and balances in the process. We also need to protect critical data. Dr. Meher noted that data protection bill has been passed by the cabinet. IT security will be a continuous process.

Dhawan said we need to look at our resiliency on coming back. SaaS data remains your responsibility. You have to be aware of the products you are using. You need to get intelligence in one place. You need a platform-approach. You are also a partner in monitoring, and defending your data. You also need to reduce your attack surface.

Sharma added that you have a process. People also need to be educated about that.