Although India today is the sixth country in the world in terms of economic power, in the cyber index they are far and further behind. Government and enterprises are going digital fast but cybersecurity isn’t developing fast enough, which means they’re more exposed.
Why has cybercrime been on such a steep rise across the globe in recent times?
Cybercrime is on the rise and it’s getting more organized and more sophisticated for a number of reasons. This has an impact globally but also as an India. Cyber crime is increasing because it’s getting easier for the bad guys to be bad guys. It’s getting organized and if you go to the dark web and you go on to some of the websites, it is getting well organized. Today, it’s actually not so difficult to be into cyber crime. As an example, it was coincidently in India, we had recently held a CIO event and we had one of our technology people over and he demonstrated on the stage in front of those people how easily a criminal can go in to the dark web and get some money from websites that sell stolen credit cards; from the stolen credit cards buy some bitcoins. From the bitcoins, cybercrime services can be bought. There would be people online who’d run a ransomware campaigns against the targeted companies. As he was doing that and he also took down a few encrypted laptops on the stage. The obvious intent is for these people to pay bitcoins with which they can buy stolen iPhones and iPads online and then sell them in the real world and make money. Unfortunately it’s relatively easy to be into cyber crime today.
[quote font=”tahoma” font_size=”13″ font_style=”italic” color=”#262626″ bgcolor=”#f2f2f2″]
“It’s often a priority in fast developing countries to develop and leapfrog to latest technology because of the business benefits. Unfortunately cybersecurity often is not as high on the priority list.”
Joergen Jakobsen
Regional Vice President
Asia Pacific & Japan, Sophos
[/quote]
Which means that today, two biggest threats in the cybersecurity landscape: Ransomware because it’s an easy way for the bad guys to monetize their trade and the other one is more the traditional hacking where people are stealing information which could be industrial espionage or state owned organizations spying and stuff like that. So this is happening to everybody across the world and it is becoming more visible with a couple of big wakeup calls early in the year, Wannacry which was very broadly disseminated as well as Petya or NotPetya. Such attacks hit everywhere.
With the number of hacks and breaches growing almost every week, why do you think security is coming out as such a big challenge for Indian INCs?
In India, we are going into digital transformation everywhere with digital societies and digital Governments. The more we go digital, the more exposed we are to cyber crime. Although India today is the sixth country in the world in terms of economic power, if you look at the cyber index they are far and further behind. India is developing really fast economically in the government and in enterprises but they’re not developing as fast in cybersecurity, which means they’re more exposed. For example, in India, a number of companies still that run on older software. That was the issue with Wannacry with old versions of Windows. It’s often a priority in fast developing countries to develop and leapfrog to latest technology because of the business benefits. Unfortunately cybersecurity often is not as high on the priority list.
So unfortunately, some companies will learn it a little bit the hard way. A big wakeup call came a few weeks ago with US Company Equifax and the C.E.O. had to step down. It’s a big impact on a company. The stock prices dropped. It is unfortunate but it also is significant to peers in the industry which is probably a good thing because sometimes people kind of need a wakeup call. In India there is a lack in terms of the cybersecurity compared to the economic development which exposes Indian companies a bit more.
Do you see any change in their outlook after these recent breaches?
We saw a lot of demand from our customer base in India and outside coming to Sophos after Wannacry to rethink their cybersecurity strategy. That meant that a lot of customers were looking for solutions. For a cyber security company like Sophos that’s obviously good but it is also bright that a lot of companies understood the threat in a much better way. In recent interactions, we have also seen many of these customers are elevating cybersecurity to be at a high level in the organization with a board of director’s subcommittee around governance and risk in cybersecurity. Given companies are now become more digital enterprise and if they get attacked it’s a very significant risk to the business continuity for them.
On the good side of the table, protection technology is getting more advanced and sophisticated as cyber crime is evolving and getting more sophisticated and organized. So it is a bit of an arms race between the bad guys and the good guys on how fast they can develop the technologies to win. It has been an ongoing race but a part of being accelerated over the last few years.
Where are the cybersecurity companies like Sophos in this race compared to the bad guys?
A number of new technologies are becoming available. In the old days, things were signature based understanding a bad file from a good file but today and you can spot a bad file much more accurately with behavioral aspects. Machine learning, deep learning and artificial intelligence techniques are being built into products. You need to have a high detection rate and a low false positives rate.
The other thing, we as Sophos have focused on because of the structure of our company is network security. Specifically in India, with very strong firewall and endpoint security, we have very strong positioning and though we have very good and different set of competitors on both sides, it’s unique that we have more or less fifty-fifty of our business on each side. The products we have in network security and endpoint security are market leading in their respective Magic Quadrants
It allows us to have a portfolio and integrate them in what we call synchronized security so that the different security products can interact with each other. We’re the only one in the industry that can do that which is a huge value proposition to a number of customers especially in the mid market where a lot of customers work without cybersecurity experts and staff but have generalist I.T. people that manage the infrastructure. Having an integrated, sophisticated, automated cybersecurity solution is really valuable to them. So we have a lot of investment in to establish what we call it the heartbeat between the different products so they actually can communicate it in an automated fashion without really intervention of the people.
What is your advice to CIOs and CISOs?
There are two types of companies: companies that have already been breached and companies that have been breached but don’t know it yet and typically the average time to discover being breached is hundred forty two days. What we recommend to customers, how they should think. Most of the customers have been breached and they don’t want to talk about it because they don’t want to go public around it with the reputational risk. But even if you have not been breached, you should probably assume you already have been breached and think how you would want to protect yourself against it. It is more common than not that companies are is getting breach and that’s why people are nervous about it. CISOs and CIOs are nervous because they are often accountable to the governance and risk committee and the board. Their job is to keep the company safe but boards assume they always how to do that right and we have seen a lot of times that they don’t always know how to do it. It’s a very fast evolving industry as well. What you knew last year is not what you need to know this year and what you know this year might not be what you need to know next year. They need to stay on top of such things making ensuring cybersecurity a continuous process
