ManageEngine's Subhalakshmi Ganapathy on Data Leaks, Breaches and Adaptive Security in Southeast Asia

Descriptions of data in the digital transformation era vary, but they tend to agree on one point: data matters enough to push a business ahead or to hold it back, and even send it into decline. It is highly valuable now and is expected to be more so later, as the volume of data is forecast to grow exponentially.

That growth brings problems with it, and protecting data is the largest. Because data is worth so much, it attracts people who want to steal it or tamper with it. Southeast Asian businesses have learned this painfully. Breaches in the region have risen over the past couple of years as companies sped up digitalisation during the pandemic and turned more and more to the cloud and other digital tools.

Why the region is exposed

Subhalakshmi Ganapathy, Product Evangelist for IT Security at ManageEngine, told Data&Storage ASEAN in an exclusive interview that one reason Southeast Asia sees so many attacks is that enterprises across the region are, on the whole, not ready for them.

Readiness and resilience differ from country to country, she said, and the gap comes down to the absence of a strategic mindset. Security is still treated as a problem for the IT department and not for the business, so many companies in the region, particularly small and mid-sized ones, have no security strategy at all. Large enterprises face a different issue: they run products from many vendors, which makes operations complex. Without an overall strategy, handling operational and security problems at the same time leaves many gaps that attackers exploit.

Her prescription is for organisations of every size to adopt a broad approach to security that keeps pace with new technology. As companies take on new technologies, she said, their threat monitoring and response should mature as well, along with the protection of multi-cloud deployments and the Internet of Things (IoT). She wants enterprises to be willing to invest in comprehensive security tools and in developing the skills of their security staff. In her words, "realigning corporate security strategy with a risk-centric approach and adopting cybersecurity as a culture will improve the readiness factor."

Leaks as well as breaches

Breaches deserve attention, but Ganapathy argues that companies should also worry about data leakage, which she defines as the accidental or deliberate disclosure of confidential data to unauthorised people inside or outside the enterprise. She identified three main causes:

1. Insider threats. A common source of leaks is a malicious user with access to sensitive internal information who releases it on the dark web.
2. Misconfigured security settings. This is unintentional disclosure. When the IT staff who set up security systems configure the policies wrongly, defences weaken and a loophole opens.
3. Weak third-party systems. Leaks can occur when an enterprise uses outside applications or systems with unpatched vulnerabilities.

An adaptive approach to protecting data

With breaches increasing and leaks a constant possibility, strong data governance matters more than ever. A central part of it is a solid data protection strategy, and that calls for a capable technology partner. Ganapathy noted that businesses hold huge amounts of data and depend more and more on advanced analytics, artificial intelligence and machine learning to raise revenue and work more efficiently. The downside, she said, is that breaches and data loss worry organisations everywhere, Southeast Asia included, and a single incident can do serious financial harm and cost a business its customers' trust.

She explained that until recently a static approach to data security was enough, because the network perimeter was clearly drawn and user access and behaviour were fairly easy to follow. Remote work and cloud adoption have produced networks without a perimeter, which makes monitoring very hard. Enterprises therefore need a dynamic, adaptive approach to protecting data, above all sensitive data held in the cloud. According to Ganapathy, such an approach should include:

• investing in tools with Cloud Access Security Broker (CASB) and Data Leak Prevention (DLP) capabilities;
• building the skills of security professionals, particularly in securing multi-cloud deployments and remote working;
• putting proactive measures in place, such as adaptive authentication and zero-trust models;
• reviewing and managing the use of shadow IT on a regular basis.

How Log360 has changed for remote work and the cloud

ManageEngine, which makes one of the widest ranges of IT management software on the market, offers such tools, including its own Log360. The company describes Log360 as a simple but powerful Security Information and Event Management (SIEM) product that helps enterprises deal with network security challenges and strengthen their security posture. It has been updated to deal with the security issues raised by growing cloud use and the spread of remote work.

Ganapathy said ManageEngine responds quickly to changes in what the market needs. When enterprises abruptly moved to remote work and the cloud, the company adjusted its security products to protect the decentralised environment. The Log360 framework was upgraded to handle threats including VPN exploitation, detection and correction of cloud misconfigurations, and the discovery and management of shadow IT. She said it addresses one of the main problems of a decentralised setup: poor visibility into security.

Log360 includes a security automation module that carries out remediation on infected machines with no human involvement and helps restore affected resources. Its search module lets teams test threat hunting hypotheses as part of a proactive strategy, and an end-to-end incident management console lets security staff track, triage and neutralise incidents through automated workflows.

The broader point is that companies of every size will have to spend more on data-centric solutions if they want to get value from the data they collect. Ganapathy describes Log360 as different from traditional security products because it "strikes a right balance between offering prepackaged detection logic and options to customise to suit every enterprise's unique security needs."