Rahul Agarwal,
Executive Director, Commercial Business Segment,
Lenovo India.
Last year has been an eventful year in the IT Security landscape as data became the most valuable & challenging asset for organizations while being boderless and dispersed, as cloud, mobility and “Bring your own device” took a stronger hold on businesses. IT Security has been immensely threatened with businesses, government and individuals relying on the internet for dynamic needs and cybercriminals have devised more sophisticated methods/techniques to trap victims. Blurring boundaries between consumer and business, sophistication in enterprise attacks and dispersion of authority for security within the ecosystem has led to growing concerns over data, financial information and critical infrastructure.
As per Gartner, the Indian security market has been growing rapidly at double digit Annual Growth Rate (AGR) and at a CAGR of 16.4% for the Indian security market from 2008-2013. The potential of the security market in India is huge as most organizations still do not have a complete understanding of various risks of fraud faced by them nor they have an efficient strategy in place to manage these risks.
 |
| Tarun Kaura, Director, Technology Sales, India and SAARC, Symantec |
 |
| Govind Rammurthy, MD & CEO,eScan |
 |
| Jagdish Mahapatra, Managing Director, McAfee India and SAARC |
 |
| Mohit Puri, Country Manager, WatchGuard, India/SAARC |
 |
| Navin Sadhwani, Head Channel & commercial business – RSA |
"Symantec's report findings also points at India as among world’s top five countries for the highest number of incidences of cybercrime such as Ransomware, Identity Theft and Phishing. India also witnessed a 280 percent increase in Bot infections, with a sizable percentage coming from cities emerging cities such as Bhubaneswar, Surat, Cochin, Jaipur, Vishakhapatnam, Indore, Kota, Ghaziabad and Mysore,” says Tarun Kaura, Director, Technology Sales, India and SAARC, Symantec.
Since the coming of the IT to the forefront of conscious attention, the IT security landscape is undergoing sea-changes. In the past, it was an easy proposition to keep business data protected by keeping it within an established perimeter- protected by established access controls and passwords.
In this information age, Data is the lifeblood of a business in this information age. With the proliferation in smartphones and tablets, that model has been blown apart. One who loses sight of the importance of data in business does at their own peril. Data is what gives one a competitive edge. Data is everywhere.
Naturally enough, the rapid evolution of the security landscape is the order of the day. This had led to a situation where security products and solutions have also witnessed changes over the years.
“Mobility, ecommerce, cloud computing, big data will be the key business drivers for IT Business in India. Investments in large infra and modernisation projects funded by the government will impact IT growth. Data security and compliance will form the underlying basis of all initiatives,” says Navin Sadhwani – Head Channel & commercial business – RSA
Organizations today have realised the need for a holistic and comprehensive approach towards security. They are not looking out for point solutions but a complete strategic approach which may include multiple products and solutions. Navin says, “Security solutions must be information and transaction-centric versus perimeter centric. Given the rapid proliferation of malware and attacks, and the increasingly dynamic nature of IT infrastructure, our solutions must take into account facts and circumstances that can be correlated to better mitigate risk. And few organizations have started to understand the changing face of security across.”
Navin maintains, “RSA’s focus will continue around intelligence driven security, big data utilization for security analytics and risk based authentication, maturing into GRC and cybercrime intelligence services.”
Encryption
With the proliferation in smartphones and tablets that model has been blown apart. Added to this, file sharing services which empowers users with accessibility and usability is adding to the concerns of information security managers. These are not trends that organizations can ignore at their disadvantage. They urgently need solutions to help secure confidential data and limit access. This is where encryption comes into play.
Encryption is primarily insurance for loss or theft of a device containing sensitive information; both encryption software as well as insurance are bought with the hope that we’ll never truly need it. When businesses lose a device containing data, such as the personally identifying information of their customers, the business (in many countries & sectors) is required to disclose the loss and notify all parties who may be affected. Needless to say, this can be time-consuming and costly and damages a company’s reputation. It’s therefore important to deploy encryption for intellectual property or other confidential information irrespective of the device or platform - desktops, laptops, data tapes, servers, removable media or the cloud.
Ace Data Devices which in the business of providing data backup, archival, storage and disaster recovery solutions that are specifically suited for business environment, offers cloud solution that is fully secure with FIPS certified AES 256 bit encryption before moving the data out of the customer’s network. This helps us ensure that data is secure. The encryption keys are defined by the customer’s system adminis trator. “Apart from these key software features, our environment is protected with firewalls, security tools and anti-virus tools being updated regularly to ensure that the data is safe,” says Neeraj Mediratta- CEO, Ace Data Devices Pvt. Ltd.
BYOD & Mobility
With an increasing adoption rate of mobile devices, the enterprises are focusing on applications and services that are usable on the mobile devices. As BYOD and mobility initiatives are gaining importance, the application management becomes important for employees in 2014.
As the adoption of BYOD continues in Asia Pacific, we expect a new trend to emerge in line with IDC’s predictions, whereby eligible employees are provided a choice of devices they can use for work. Termed “Choose Your Own Device” (CYOD), this model offers the benefits of management and security which can be standardized and guaranteed, and business processes can be mobilized,” says Rahul Agarwal, Executive Director, Commercial Business Segment, Lenovo India.
 |
Rajesh Maurya, |
 |
| Ashootosh Chand, Director of Business Development, RIPL (Ricoh Innovations Pvt Ltd.); |
 |
| Vamsicharan Mudiam, Country Manager, Cloud Solutions, IBM, India/South Asia |
 |
| Neeraj Mediratta, CEO,Ace Data Devices Pvt. Ltd |
 |
| Mohammad Salman, Sr. VP – HCL Services Ltd., wholly owned subsidiary of HCL Infosystems Ltd. |
BYOD’ (Bring Your Own Device) changes IT procurement – the company provided PC is becoming a thing of the past, as businesses increasingly allow, and even encourage, employees to bring their personal, consumer devices into the workplace and access corporate applications. This allows application availability at anytime, from anywhere, and helps business slash procurement costs. The Smartphone/tablet phenomenon has fueled this trend, and the drive uptake of Virtual Desktop Infrastructure (VDI), wireless networking and end-point security solutions in the corporate arena.
With the broad adoption of sophisticated mobile devices such as smart phones, tablets, and laptops, users are demanding that their own devices connect to and function seamlessly at work or across the university campus. From an IT perspective, sentiment is changing from initial resistance to a complete embracement of user devices with the anticipation of cost reduction and increased confidence in security solutions. Consequently, Bring Your Own Device (BYOD) or Bring Your Own Technology (BYOT) has emerged as a top IT initiative.
BYOD brings in a lot of flexibility for our employees as they complete their daily tasks with their own devices. “We see it impacts their productivity positively. However, we are cautious about data. For a global enterprise, data is of the highest value. Our approach to BYOD has been cautious where we try to balance mobility of BYOD with data security. Essentially, how we are coping with BYOD is by building a multi-tenanted IT infrastructure with each tenant having its own security mechanisms. So, security and access to data is layered from BYOD devices. Effectively, what companies are doing is balance BYOD mobility and BYOD security. Companies are making those trade-offs as we speak,” says Ashootosh Chand, Director of Business Development, RIPL (Ricoh Innovations Pvt Ltd.)
Organisations expect one single solution to address the overall BYOD challenge which is not practically feasible. BYOD needs to be looked at from different dimensions like Data Loss Prevention, Network access Control, Authentication system, internal intrusion prevention systems, internal firewalls, securing Wi-Fi etc. This demands that companies relook at the security architecture and rebuild it to fit BYOD needs” says Jagdish Mahapatra, Managing Director, McAfee India and SAARC.
In the past few years, cyber attackers have successfully breached large organizations, despite firewalls and antivirus security defenses. Outdated legacy defenses, misconfigured security controls, and oceans of security logs make it impossible for security professionals to protect their network and recognize important security events. “We believe that in 2014 more organizations will deploy security visibility tools to help identify vulnerabilities and set stronger policies to protect crucial data,” says Mohit Puri, Country Manager, WatchGuard, India/SAARC.
Virtualisation And Security
Today virtualization is playing a bigger role as IT organizations morph into more and more of a services management framework. Many businesses are quickly realizing the value in moving to virtualisation. Virtualization has been commoditizated. Fast becoming a natural way of doing business, today it is less about the process and more about the business enablement of what virtualization allows the clients to do that they couldn’t do before.
Virtualization facilitates consolidation of infrastructure and hardware by replacing physical servers with virtual machines, and by combining applications on virtual servers. Hence, it leads to reduced space and cost of IT infrastructure. Over the years, there have been many security concerns within a virtual environment. "Many incorrectly believe that just because the environment is virtual, it must be inherently secure. However, the fact is that virtual environment for the most part suffers from the same security concerns as does the physical environment," says Govind Rammurthy, MD & CEO, eScan.
Role of R & D
With the growing amount of malware in-the-wild, eScan realized it would be practically impossible to secure its clients using the traditional approach of detecting and preventing new threats. Antivirus laboratories normally follow a set of procedures in dealing with new malware: The samples are received (a new virus, worm, Trojan...), analyzed by a Malware Analyst and a corresponding signature is created. This is then uploaded to the servers, allowing users to update their database signatures, thus protecting them against new viruses.
This model, which without any doubt had functioned adequately in the past, became useless when laboratories went from receiving few samples a day to an average of 65,000 and more. This would require a whole army of Malware Analysts working against the clock to process all the new samples of malware received!
By taking situations such as these into consideration, “we, at eScan have developed a technology called eScan Security Network (ESN). This technology can automatically analyze, classify, detect and quarantine 99.99% of new malware we receive every day at our labs, keeping our clients protected in real-time.” says Govind Rammurthy of eScan.
Symantec’s Top IT Security Trends
1. “Targeted attacks” on the upsurge through sophisticated techniques
2. Perils of Social Networking - no matter how “niche” or obscure.
3. The “Internet of Things” becomes the “Internet of Vulnerabilities.”
4. Cybercriminals will target the weakest links in the Enterprise ecosystem
5. Cloud will be in the crosshairs for cybercriminals
Addressing the security concerns in Cloud
Also with the increasing adoption of Cloud technology, it has too become one of the prime focuses for cyber criminals. “Increasingly enterprises and individuals are using public clouds to store and access data. As per the latest Norton Report 2013, 29 percent individuals in India and 24 percent across the world are already practicing this trend. And with rise in usage of these platforms for both personal and private information, it is highly likely that we will see this as an easy target for cybercriminals to penetrate these data-rich cloud platforms for profitable motives,” says Tarun Kaura, Director, Technology Sales, India and SAARC, Symantec.
Notwithstanding opening up some new possibilities for businesses, cloud computing is also throwing up new challenges. These challenges range from the implementation of cloud technology, to securing application and infrastructure, ensuring interoperability and governance at the same time. Fundamentally it is important for the cloud services providers to be able to assure the security of these new models in order to build trust and confidence. “The key to establishing trust in these new models is choosing the right cloud computing model for your organization. Place the right workloads in the right model with the right security mechanisms,” says Vamsicharan Mudiam, Country Manager, Cloud Solutions, IBM, India/South Asia.
For the businesses that are planning to switch to cloud service and are looking for trust and assurance from the cloud provider, understanding the service level agreements and the approaches to security is the key. “Hence, using a proven methodology and technologies that candeliver appropriate security is the best plausible way to safeguard the business,” says Vamsicharan Mudiam of IBM.
According to Mohammad Salman – Sr. Vice President – HCL Services Ltd., wholly owned subsidiary of HCL Infosystems Ltd, “There is going to be a significant rise in the adoption of private cloud. Organizations are looking at building private cloud environments enabling them to charge-back specific business lines, achieve significant cost saving and also ensure the data security.”
Cloud security is not so much a technology issue as it is a trust issue. Much (though not all) of the technologies, services, methodologies and know-how needed to secure the cloud already exists and need to be extended from the enterprise into the cloud. What is needed to make cloud computing a truly ubiquitous services platform is a higher degree of trust, particularly between the owner-providers of cloud resources and the companies that use those resources.
There are many companies providing services through private and public clouds. Each has its own requirements and processes for authenticating and authorizing users. As these services connect and share information with each other, each service provider must be sure that it knows the degree to which it can trust the cloud, services and users — whether human or machine — with which it transacts. The services provider may have the best information security system in the world, but its efforts are useless if it’s granting peer-level access to cloud partners with less stringent security standards.
Internet of things
The rapid technological advances being made in Internet-connected devices like sensors, routers, smart phones, smart TVs and security cameras have all the potential of enabling the fast growing connected world as billions of devices collects exponential amounts of data. Internet is visibly making every object or machine around us smarter, right from connected smart televisions medical equipment, security cameras, routers, trash-cans, baby monitors, toothbrushes, sports gear with embedded sensors and smart refrigerators. We will soon live in an ecosystem where these ‘dumb devices’ would acquire intelligence through an inbuilt OS enabling the devices to get connected with other paired/authorized devices.
“Internet, ‘Network of networks’ may very well be termed as one of mankind’s finest inventions and ‘Internet of Things’ (IoT) could be pitted as the optimal enablement of this invention, owing to its scale and utility, says Tarun Kaura of Symantec.
Today 7.5 billion people are connected to the internet. As things stand today, some 50 billion things which will include non-people will be getting connected. “Use cases for IoT are plenty, be it for energy companies that can build smart grids to reduce T&D losses or for the food industry where there is a lot of wastage due to lack of proper warehousing and logistics,” says Cisco President India and SAARC Jeff White. Apart from helping companies plan better, smarter networks also cut operational inefficiency to size resulting in the increased productivity.
Security company WatchGuard expects white and black hat hackers to spend more time cracking non-traditional computer devices such as cars, watches, toys and medical devices. “While security experts have warned about securing these devices for the past few years, the market is just now catching up with the expectation. WatchGuard suspects that good and bad hackers will focus heavily on f inding holes in these IoT devices in 2014,” says Mohit Puri, Country Manager, WatchGuard, India/SAARC.
UTM
“One of the interesting trends we have seen is a demand from enterprises to opt for a single vendor to manage the firewall environments, rather than multiple vendors. Globally and in India, we are seeing several enterprises overhauling their perimeter and WAN security systems to move towards a single vendor. The main reason for this is that customers expect cost and operational efficiency in managing their security infrastructure,” says Rajesh Maurya, Country Manager, India & SAARC, Fortinet.
Security buyers are also seeking products that can provide a combination of firewall options such as NGFW (Next Generation Firewall), UTM, virtual and statefull firewalls to meet a wide range of enterprise needs from data centers to branch offices.
These solutions protect enterprises against multi-vector attacks, which are becoming more sophisticated and plentiful. In particular, there is a need for specialized web application firewalls with the growth of web applications.
India: A Key Threat Frontier
According to recently launched Symantec’s Internet Security Threat Report (ISTR), India emerged as a key threat frontier, ranking as the third highest source of overall malicious activity. While it continued to hold its position as the spam capital of the world with 9.8 percent of spam zombies; it was also the highest source of botnet spam, with 6.6 percent or close to 1.45 billion spams originating from its borders every day. India ranked especially high in the number of top botnets like Cutwail, Kelihos, GRUM and GHEG. Large botnets like Cutwail and Kelihos have made their presence felt in the threat landscape this year by sending out malicious attachments. According to the report, Cutwail which is the spam-sending botnet for the malware Pandex sends 8.06 billion spam messages every day, out of which the highest are sent from India (over 620 million).
New Era of ‘Mega Breaches’
“One mega breach can be worth 50 smaller attacks,” says Tarun Kaura of Symantec India. “While the level of sophistication continues to grow among attackers, what was surprising last year was their willingness to be a lot more patient – waiting to strike until the reward is bigger and better.”
Globally, there was a 62 percent increase in the number of data breaches from the previous year, resulting in more than 552 million identities exposed – proving cybercrime remains a real and damaging threat to consumers and businesses alike. The size and scope of breaches is exploding, putting the trust and reputation of businesses at risk, and increasingly compromising consumers’ personal information – from credit card numbers and medical records to passwords and bank account details. Each of the eight top data breaches in 2013 resulted in the loss of tens of millions of data records. By comparison, 2012 only had a single data breach reach that threshold.
“Nothing breeds success like success – especially if you’re a cybercriminal,” adds Kaura. “The potential for huge paydays means large-scale attacks are here to stay. Companies of all sizes need to re-examine, re-think and possibly re-architect their security posture.”
edit@varindia.com
