Cybersecurity no longer limited to building a moat and a castle wall to ensure compliance: McAfee MD

Venkat Krishnapur, Vice-President of Engineering and Managing Director, McAfee India shares how CISOs can mitigate cyberattacks, secure the cloud, and more.

Cybersecurity no longer limited to building a moat and a castle wall to ensure compliance: McAfee MD Venkat Krishnapur, Vice-President of Engineering and Managing Director, McAfee India shares adopting an active hunting approach can help CISOs develop an operational cycle to plan, execute, and review intelligence-driven activities, strengthen defences and stay a step ahead in the game.

CISOs constantly find themselves under growing pressure to deal with a constant barrage of new cyber threats and they always find themselves playing catch-up. Is there something which CISOs can do to prepare in advance?

Cybersecurity in the digital age is no longer limited to building a moat and a castle wall to ensure compliance. The cybersecurity framework has evolved towards deployment of a sustainable, proactive approach for enterprises to adapt intelligently, and quickly as advanced threat forms are identified. This progression demands that the CISO’s shift their mindset, that has been traditionally focused on the prevention portion of the ‘prevent-detect-correct’ threat defence lifecycle to a balanced focus on detection and correction to supplement the prevention efforts.

Identifying user behaviour aimed at exfiltrating an organisation’s digital assets by using continuous monitoring techniques to proactively spot abnormal patterns, can counter threats to valuable digital resources. Adopting an active hunting approach can help CISOs develop an operational cycle to plan, execute, and review intelligence-driven activities, strengthen defences and stay a step ahead in the game. The industry needs to adopt and implement the Zero Trust model, that does not automatically trust anything within their internal or external network. From an industry point of view, implementing security by design is the most effective way to drive privacy and security, as data protection strategies are integrated into the technology, as the product or service is created.

What could be the steps to keep in mind while securing the cloud?
The use of cloud services has empowered organisations to accelerate their business with more agile technology at a moderate cost. However, security of data has also taken centre stage as enterprises migrate to cloud-based platforms. Keeping data secure in the cloud is a function of visibility and control.

The first stage of cloud computing security must focus on understanding and assessing your current preparedness and evaluating risk. Identifying sensitive or regulated data, understanding its accessibility and shareability, discovering shadow IT, and auditing infrastructure-as-a-service (IaaS) configurations can mitigate both internal and external data loss.

Once the cloud security risk posture is understood, the second phase involves applying data protection policies, encrypting sensitive data and limiting it from moving to unmanaged devices, to strategically applying protection to the entire cloud infrastructure. In the third phase, enabling controls for additional verification for high-risk access scenarios, adjusting cloud access policies to cope up with new services and removing malware from a cloud service can help organisations address their security issues on an ongoing basis.

Implementation of technologies such as Cloud Access Security Broker (CASB) further cement these efforts towards enabling data loss prevention, access control, and user behaviour analytics. As cloud services evolve, Cloud Workload Protection, Virtual Network Security tools scan moving network traffic and simplify security management across IaaS environments.

How according to you, Machine learning and automation is impacting security strategies?
While many traditional defences, including sandboxes, utilize rules and automation based on behaviours and static features to detect malware, use of machine learning dramatically scales this technology’s ability to identify malicious markers. The strategy of using both static and dynamic machine learning offers a more complete and effective solution by providing the depth of creative problem-solving capabilities, and automation to help security teams gain significant ground against attackers.

Machine learning enables real-time detection and remediation, along with a reduced burden on security analysts. CISOs can benefit from the power of machine learning owing to its ability to detect never-before-seen threats that human analysts would be unlikely to discover, as we lack the capacity to visualize and process large-scale data sets in the same way. Cloud-based machine learning can further enable the scale when dealing with the quantum of threats that are relevant today.

Automation with continuous updates and cloud sourcing, with no maintenance or effort from security teams will help them focus on strategy and process improvement, without spending most of their time addressing high priority/ emergency issues that can be automated.

Why do the Indian enterprises need to increase security budgets and how should CISOs go about ROI justification for security?
While cyber threats continue to grow at a significant pace, IT budget allocations have remained relatively flat. However, IT security budgets are likely to increase two folds compared to regular IT budgets. Financial decision-makers are asking for detailed justifications for new purchases. The potential harm of a data breach is a threat that not only concerns IT security, but one that also affects other business areas including brand reputation and customer loyalty. Additionally, the government of India is also developing stringent policies to curb data breaches under the IT act by holding companies liable and imposing heavy penalties for non- compliance.

Organisations must avoid getting into the viscous cycle of investing in new products that have a short-term success rate to keep up with cyber attackers for getting ahead of the tools they previously invested in. Instead of trying to clarify security budget increases and purchase decisions with an unattainable goal, organisations should focus on objectives such as continuous improvement of security effectiveness and operational efficiency. As an industry, we need to emphasize on the value proposition that secure enterprises attract. The C-suite must perceive cybersecurity not as a necessary cost of doing business, but as a competitive strategy that enables growth and innovation.

What according to you is the future of risk and the need for an evolved defence suite?
Confidential information continues to be extracted from organizations around the world, despite the evolution in security technology and increase in security budgets. Corporate data, home IoT devices and brand reputations will be under siege, with cybercriminals largely relying on social media, the cloud and mobile phones as key attack vectors. Accessibility to technologies such as artificial intelligence-as-a-service will enable cybercriminals to develop attacks with increasingly sophisticated evasion techniques and target victims more proficiently.

Greater collaboration among cybercriminals exploiting the underground market will result in development of efficient products and this market economy is only poised to grow. We also foresee a significant increase in targeted attacks on the large amounts of corporate data now residing in the cloud. Weak APIs or ungoverned API endpoints and leveraging cloud as a springboard for cloud-native man-in-the-middle attacks will equip cybercriminals with the ability to focus their attacks on broader and more complicated targets. Fake news and extortion campaigns via social media will continue to attack brands, originating from nation-state actors to criminal groups.

The rate of evolution of cybersecurity threats makes it imperative for organisations to develop a robust security framework. One must always remember that in an increasingly connected world, you are only as strong as your weakest link.

How can enterprises confront data exfiltration risks in the cloud?
Data exfiltration refers to any unauthorized movement of data. An essential function of a network security architecture is to prevent unauthorised third-party access to sensitive data. McAfee’s Cloud Adoption and Risk Report revealed that 21 percent of data in the cloud comprises of critical information such as intellectual property and customer data, vulnerable to exfiltration.

To minimise data loss, organisations must consistently evaluate the risk at every touchpoint with networks, devices, applications, and integrate security consciousness into their culture. Technology, people, policies and processes are the key elements that comprise an effective defence. Implementation of security technologies such as DLP, EDR and CASB have a high probability of combating data theft. Enhancing people’s skills and evolving business processes should take up priority in the organisation’s security efforts to keep up with the evolving threats.

Follow and connect with us on , Facebook, Linkedin


Sponsored Stories