The Stakes Are High and India Inc Needs to Revamp Data Security

The year 2020 was marked by unexpected, world-changing events that left enterprise customers in unchartered territory – from a massive rise in the numbers of cyberattacks to cybercriminals attaining newer levels of complexity and sophistication in their attack modes, COVID19 has undeniably changed the security game forever.

More lethal modes of attacks such as AI to scan for and automate penetration or using metamorphic and polymorphic malware to avoid detection – are becoming predominant, with attackers choosing to blackmail enterprises by releasing tranches of sensitive data in the glare of publicity, rather than doing so quietly behind the scenes.

As the threat landscape continues to evolve, resiliency will be critical to India Inc.’s success in the new normal. According to International Data Corporation (IDC), enterprises focused on digital resiliency will adapt to disruption 50% faster than ones fixated on only restoring existing business/IT resiliency levels. Hence, Indian enterprises must strengthen their digital resilience to deal with the expanding threat landscape.

Knowing ALL of your Data

In the digital world, it is not an organisation’s physical assets that catch the eye of cybercriminals. When cyber-attackers aim, the main target is usually data – the lifeblood of a digital economy. Data is produced and collected in aggregate across the companies, creating large volumes of data daily. Hence, companies must have a complete and updated overview of their data.

This is a wake-up call for organizations that have placed too much focus on daily operational needs at the expense of investing in digital business and long-term resilience.  While organizations continue to deal with disruptions due to social distancing norms and intermittent lockdowns, they also must focus on building resilience and formulating policies in their Information Technology (IT) architecture to ensure continued access to business applications from anywhere, anytime to employees, vendors, and partners.

The first step in building clear data management policies and standards is to properly classify data based on how vital or sensitive it is. Policies for information assets, such as user access management, should be established based on the security categorization of data. This assures that only necessary access to sensitive data is allowed, limiting potential attack sites that cybercriminals can exploit.

Resiliency at the core

Unfortunately, for most organisations, exposure to a data breach or an attack seems highly plausible. In such a situation, maintaining system availability will be key to organizations’ keeping up with their operational capabilities. Resilience must be an integral part of the data management strategy to rapidly combat a cyber threat – a robust backup and recovery plan must be in place to secure the organization’s critical data.

Taking a layered approach to securing data, such as immutable backups and air-gapping, also help companies ward against malicious threats. For this, companies must explore Backup-as-a-Service (Baas) options for backup, recovery, and data protection to store an airtight copy of their data in the cloud.

Furthermore, it will immensely help them in maintaining a state of recovery readiness, regular monitoring, and evaluation of their processes. Cyber security roundup should involve regular threat hunting, vulnerability evaluations and penetration tests. Besides that, IT teams must check redundancy in all essential, high availability IT systems.

Eventually, organisations must have a strategy in place in case of a data breach. When data is compromised, such as by ransomware, disaster recovery is critical to mitigating the effects of the breach and resume normal business activities.

The Human Touch

75% of CIOs will be integral to business decision-making by 2023 as digital infrastructure becomes the new business ‘operating system’, reveals IDC. In this age, the CIO does not just lead the organisation’s digital transformation but is integral to spearheading its business recovery practices.

Enterprises must have qualified CIOs at the helm to lead the risk assessment and identification, and drive organization recovery in times of attacks. The CIOs must be given the authority to decide on and implement appropriate internal controls to mitigate technological risks. When it comes to cyber security, long-term investments pay off – which means the CIOs must have the authority to make spending decisions that may not provide immediate results.

Finally, the buck does not stop at senior management. While the onus is on CIOs to cultivate a culture of technology risk awareness and management, cyber threat awareness and education must be extended to the rank and file. Employees must be educated about their roles and responsibilities in cyber security risk management. Regular education and training that is updated to reflect on evolving attack strategies is the most effective strategy for businesses to maintain strong defences.

Lastly, ask the correct question

The appropriate question to ask in the current cyber threat climate is “When will (not “if”) a cyberattack happens to my organisation? The stakes are high and enterprises have too much to lose in the event of a disastrous or high-profile data breach. As our threat canvas is expanding and cybercriminals develop new ways to penetrate cyber security defences, we need to stay one step ahead of the threat actors. With an experienced leader in charge who ensures essential and sensitive information assets of the company are not exposed to any risk, we have the best chances of being prepared if we realize that it’s us who are in the firing line.

The author of the article is Pradeep Seshadri, Director – Sales Engineering, Commvault India & SAARC