RAISING THE BAR

SASCHA GIESE, HEAD GEEK AT SOLARWINDS, EXPLAINS HOW THE COMPANY IS HELPING ITS CUSTOMERS MEET THE EXPECTATIONS FOR IT PERFORMANCE AND AVAILABILITY

Can you share with us SolarWinds’ overall regional product portfolio, its target end-user community, and the principal use cases that SolarWinds supports?

SolarWinds is a leading vendor for IT management and monitoring solutions. Our products have the individual IT professional in mind, and because their job can be quite stressful, we want to put the right tools in their hands to help them solve modern IT problems. We deal with all elements and layers in IT: the network, applications, on-premises or cloud infrastructure, and all sizes and forms of businesses. IT problems are always the same, independent of what business you’re actually in. Supporting IT professionals with their daily tasks is a great way for any organisation to see quick results in cost reduction, as less resources are spent on time-consuming or repetitive tasks.

How does SolarWinds engage with end customers in the Middle East? Is it through dedicated and specialised channel partners in the region, OEM relationships, two-tier traditional channels structure?

The Middle East is a particularly interesting region. First, a lot of the technical infrastructure is new compared to Europe or the U.S., which means there’s less legacy tech to maintain. Furthermore, the vendor landscape is more open, and we see a good mix of different tech in many companies, which is a challenge we happily accept as our tools are equally open and vendor-agnostic. The speed of change is remarkable, too.

SolarWinds has been active in the Middle East for many years now, and we built great relationships with many long-term customers. In fact, one of the top ten SolarWinds deployments sits in the region. We’re proud to help our local customers to grow and will continue to work with them and our regional partners, who together with the SolarWinds technical support team, provide service in language around the globe, including the Middle East region.

We run the traditional two-tier channel structure with two major distributors in the Middle East. Both are “value-added distributors,” and they employ many SolarWinds Certified Professionals (SCPs) to help their local resellers with excellent technical knowledge.

As a vendor, we also enjoy events like GITEX—these events let us get in touch with our customers directly, helping us get a better feel for local needs and how the industry is changing in the Middle East.

For example, two years ago at GITEX, we heard the reliability—and sometimes even availability—of internet connectivity for enterprises was a problem. Now, this is a thing of the past, as the local ISPs have already improved the situation. In addition, massive investments into technology are happening right now, like the rollout of 5G and an increase in regional data centres. These investments have already paid off and have had a significant impact on multiple industries.

E-commerce rose from next to nothing to a major revenue driver for the region’s economy within just a few years. This transformation isn’t going to stop soon, as many ME organisations started discovering international markets and are seeing exponential growth. We’ll continue to help them on their journey.

Would you please describe the relationship of SolarWinds with the IT industry, especially leading software and cybersecurity vendors, and the IT organisation?

We’ve been in the business for more than 20 years, and we’re well known in the industry. In fact, almost every IT professional on the planet has already used one or more of our tools in their career. We’re in touch with the IT community on multiple layers. First, there’s THWACK, our own online tech community of more than 150,000 registered members, to keep a finger on the pulse of IT professionals, so we know what they need. THWACK is a platform for IT professionals to learn, share knowledge, and unwind. Furthermore, we’ve been in strategic or technological partnerships with many other vendors for years. Our connections within the industry put us in quite a unique position.

Each year, we survey IT professionals in different positions and industries from all over the globe. We run a different theme each year, and for 2021, the theme was “Building a Secure Future.” The results provide great indications regarding where the industry’s going, what trends and challenges exist, and more importantly, how organisations intend to overcome these challenges. All the latest results are available at https:// it-trends.solarwinds.com.

What is SolarWinds Secure by Design service? What are the benefits and use cases in the region? What is the go-to-market strategy?

Secure by Design isn’t a specific service or product. Instead, it means we used this opportunity to reflect on our own security practices and found opportunities to enhance our posture and policies. We focused on our internal environment and our product development process to ensure the security and integrity of the products we deliver. These transformative efforts on the journey towards becoming Secure by Design will require tremendous focus on security programs, policies, teams, and culture.

What’s been the impact of the SolarWinds breach on the IT organisation, IT industry, OEM alliances, and what is the way forward from those consequences?

It has shown us the risk of supply chain attacks. To address the industrywide ramifications of the SUNBURST cyberattack and help strengthen its own security posture going forward, SolarWinds has introduced an initiative to become Secure by Design. Under this approach, SolarWinds is focused on further securing its internal environment, enhancing its product development environment, and ensuring the security and integrity of the products it delivers as it seeks to evolve into an industry-leading secure software development company. The learnings resulting from the SUNBURST investigation have also presented an opportunity for SolarWinds to lead an industry-wide effort around transparency and collaboration and for SolarWinds to develop a new model for secure software environments, development processes, and products.

What is the future roadmap of SolarWinds products and services, using AI, ML, analytics, IoT, dashboards, and the cloud?

Our vision is an even higher integration of silos than we see now. Though individual parts of IT are getting easier to use with each technical innovation, the increasing number of those individual parts makes it more complicated to keep everything under control. We’re already using machine learning in some of our products, and this is definitely the path to follow. As the underlying IT architecture evolves, so do our products. Integration and consolidation are high on our agenda, and we’re keeping up with the latest tech to help our customers solve their problems, whatever they are.

For example, our community asked for more help with their databases. It’s a complex problem starting with a lack of expertise, as dealing with databases is no small feat. Even experienced DBAs find themselves confronted with various database vendors and various locations, and the applications their businesses depend on need to talk to all these individual elements. It’s not easy. Therefore, we heavily invested into our database monitoring and management portfolio, and we still have a few more ideas. Maybe we can share a little bit at the next GITEX in October, and we hope to see you around!

PUTTING SECURITY FIRST

SEBASTIEN PAVIE, VICE PRESIDENT FOR DATA PROTECTION PRODUCTS, MIDDLE EAST, AFRICA AND SOUTHERN EUROPE AT THALES, EXPLAINS WHY WE NEED THE ZERO TRUST SECURITY MODEL TO PREVENT CYBERCRIMES.

What has been the impact of this pandemic on cybersecurity?

The rapid acceleration of digital transformation and remote working brought on by Covid-19, together with the proliferation of disruptive technologies, have made traditional boundaries of corporate networks disappear. Moreover, businesses no longer have sole control over a closed network, as the pandemic has shifted people from offices into dispersed environments.

As a result, organisations have had to increase their reliance on cloud platforms. Many are combining different methods across public, private, hybrid cloud, and on-premises solutions. This has made multicloud an increasingly essential part of everyday operations for many businesses in one form or another.

These rapidly changing and fragile ecosystems represent a real security challenge for businesses, as threat actors look to expose the vulnerabilities of distributed workforces operating in remote environments. Legacy security policies and practices based on trust have now been rendered obsolete. As a result, organisations should increasingly be looking at adopting a Zero Trust approach to their security operations.

Now more than ever, the ability to access data from any location and on any device is a top priority for enterprises. However, using a traditional castleand-moat security concept, people are unidentifiable and trusted once inside corporate networks – with the power to access sensitive data. Unfortunately, too many networks and applications run on an “assumed trust” system, which hackers can take advantage of with disastrous consequences.

How can users get started with Zero Trust security?

A Zero Trust model is based on the tenet “Never Trust, Always Verify” and views trust as a vulnerability – any user or device looking to access confidential data cannot and should not be trusted by default. Zero Trust is not a specific technology, rather a strategic, initiative-based security system that requires strict and continuous identity verification and control of data in the cloud to minimise trust zones.

With more companies now making a move to the cloud alongside the shift to homeworking, organisations are going to be exposed to new threats that go beyond their current or previous security strategies. Zero Trust helps businesses to maintain a high level of security remotely, without the need for a physical location to authenticate access. Thus, allowing organisations to grow securely in the cloud and adapt to the remote and dispersed environments in which we now operate.

This precedent also goes beyond individual organisations; the impact can be felt far wider. Recent high-profile cyber-attacks, such as the Colonial Pipeline cyber-attack, have reaffirmed the lack of resilience to security threats many industries still face. This incident was a strong reminder of the potential benefits of Zero Trust in mitigating the effects of ransomware, as the entry point was a legacy VPN. With Zero Trust it might have been possible to stop the attackers from navigating inside the network, whereas with a VPN once attackers are ‘through the door’ they’re already in a very strong position.

Accomplishing the principle surrounding Zero Trust is not without its challenges. Businesses will have to evolve their previously established perimeter security policies into location-agnostic ones. A significant challenge to achieving Zero Trust is finding solutions that cover identities and data end-to-end. SafeNet Trusted Access, Thales’s cloud-based access management and authentication service, is a strong starting point for effective Zero Trust security implementation. Enforcing access decisions dynamically at the application access point, irrespective of where the user resides and the device they are using.

However, the biggest challenge for businesses is understanding that achieving Zero Trust is an ongoing journey that has multiple steps. Though there are some foundational technology capabilities that are a must, organisations tend to equate Zero Trust to implementing a single capability. There is no ‘silver-bullet’ when it comes to achieving a Zero Trust security model. Individual enterprises will need to adapt their strategies based on their specific businesses needs and constraints. Thus, choosing the appropriate strategies and technologies that match the specific needs of their business.

How are you helping your customers in the Middle East protect their sensitive data across on-prem and cloud environments?

Complexity is the enemy of data security. It continues to make organisations vulnerable to attack because it is the top barrier to protect organisations’ most valuable asset – data, especially sensitive data.

This complexity comes in many forms, from the ways that data is created, shared and accessed to the various information technology systems where it is stored, analysed, and secured. Structured and unstructured data is produced and amassed today at unprecedented levels everywhere: in

email, applications, collaboration tools, chatbots and is stored in the cloud and on-premises. This sprawl, along with cloud adoption, indeed makes security more complex – especially when employees sometimes act on behalf of business continuity, not on behalf of data security.

The complexities involved with protecting data can create network weaknesses and poor security habits that bad actors can easily exploit. Last year some of the worst breaches involved server and database exposure because IT couldn’t see or find data they possessed. A cyberattacker only has to be successful once, but IT security teams have to be successful every hour of every day, and it is often complexity that keeps them from protecting an organisation’s data.

The fact is, a distributed workforce means more data is migrating to the cloud, and companies are using multiple IaaS and PaaS environments and hundreds of SaaS applications. Organisations must be able to safely rely on the cloud because its significance will only continue to increase. Breaking down the complexity barrier created in this environment will give businesses a clearer view of all of their data so they can better control and protect it.

When IT security teams are forced to piecemeal together various security tools to try to keep all their bases covered – frequently in response to a security incident – this further exacerbates complexity. This approach needs to change, and it can. The world’s brightest software engineers and network architects understand that the complexity barrier must be removed so that IT security teams can support employees who need to get their jobs done, no matter where they’re working or what the latest threats are. Providing common developer or industry-standard APIs and a broad ecosystem of partner integrations helps these engineers quickly adjust to these new complexities.

As noted above, sensitive data sprawl across the enterprise, the cloud and beyond. Typically, IT security has limited visibility into where their data resides. Some recent studies have shown that only 54% of organisations know where all of their sensitive data is stored and 52% of all data within organisations remains unclassified. And even when organisations protect their sensitive data in the cloud, nearly half of it is not encrypted.

While we can’t know what the future holds in the current environment, we do know that employees need to be able to work from anywhere, and digital transformation strategies must continue if businesses are to innovate and deliver new services. At the end of the day, IT teams need a data security solution that folds in all the tools they need – and without the complexity that creates vulnerability.

The evolving business landscape calls for simplified data security, especially as new challenges emerge. Thales’s CipherTrust Data Security Platform ensures organisations have a clearer view of all their data so it can be discovered, protected and controlled wherever it resides.

Why is it important for enterprises to develop enterprise-wide encryption strategies?

Key management – the processing, management and storage of keys for who can decrypt and access protected information – is an often-overlooked, and yet critical element of encryption. Many organisations left that part up to their vendors or stored them inconsistently

across their IT infrastructure in both hardware and software. This lack of centralised control can jeopardise the integrity of encryption. In fact, the management of the keys is more important than the encryption itself, because if something happens to the keys, entire sets of data can be stolen or lost, and there’s nothing you can do about it.

The fact that major cloud heavyweights are diving into this technology is a sign that key management is being taken more seriously. And rightly so. The ability to demonstrate control of data is critical to meeting compliance mandates. But how do you really own your data if you do not have total control and ownership of the keys?

With every passing day, an increasing number of organisations are migrating their sensitive data and business applications to the cloud for operational flexibilities, cost efficiencies, and quick scalability. To avoid vendor lock-in on a single cloud service provider (CSP), like Microsoft Azure, AWS, Oracle Cloud, and IBM Cloud, many organisations are opting to work with multiple CSPs in a multi-cloud environment.

As an increasing amount of critical data gets stored in the cloud, the prospect of cyber-attacks and data breaches rises exponentially. While most CSPs offer native data protection features, the “Shared Responsibility Model” dictates that the ultimate onus of safeguarding business and customers’ sensitive data rests with organisations. While there is a shared responsibility to secure data in the cloud, there is no shared liability. The impact of potential security incidents jeopardising sensitive data remains the responsibility of the company. It is the company’s responsibility to ensure compliance with the relevant privacy regulations such as the GDPR, the Schrems II ruling, PCI-DSS, HIPAA or CCPA.

While organisations are increasingly investing in perimeter security mechanisms, they fail to adequately invest in encryption technologies that act as the critical line of defence in the event of a cyber-attack. This is evident through the ever-increasing incidents of sophisticated cyber-attacks that result in data breaches costing organisations billions in losses.

To minimise the impact of potential security incidents and to optimise sensitive data protection, security and privacy regulations like GDPR, PCI-DSS, HIPAA or CCPA mandate the adoption of encryption.

However, merely encrypting sensitive data in the cloud is not sufficient. The Cloud Security Alliance recommends as an industry best practice for storing information in the cloud to put the customer in control of both the key management and the encryption process. Effectively managing the key lifecycle and being crypto-agile is paramount for establishing trust in the confidentiality, integrity, and availability of your data.

What are the barriers to multicloud data protection?

When it comes to cloud security and efficient key management, the 2021 Thales Data Threat Report reveals five major pain points organisations face today that prevent them from taking full advantage of the potentials offered by cloud platforms. Lack of visibility into security and encryption practices. With CSPs providing limited visibility and access to encryption practices and schemes, organisations’ risk management teams are reluctant to allow the storage of sensitive and missioncritical data in the cloud due to high impact in case of a data breach. Meeting compliance requirements. Security and privacy regulations mandate the use of state-of-the-art practices for securing the confidentiality and integrity of personal and sensitive data, requiring agility and strong control over key management. Lack of such controls entails big regulatory penalties. Managing encryption keys across multiple cloud environments. Organisations are embracing multi-cloud strategies to avoid vendor lock-in. The use of cloud-native encryption and key management solutions is a barrier to multi-cloud adoption. Custodianship of encryption keys. When organisations elect to use cloud-native encryption services, the corresponding keys are being managed by the providers. Not having direct control on the keys presents potential risks and vulnerabilities in the case of a security or cryptographic incident. Managing, monitoring, and deploying multiple cloud-native security tools. Since cloud-native key management services offer limited ability to automate the lifecycle of encryption keys, especially across multiple subscriptions, organisations are forced to implement labour-intensive, error-prone manual key management processes to meet their security requirements.

Lack of proper security and key management practices in a multicloud environment will only increase the organisation’s attack surface, with cybercriminals eager to take advantage of it as they get smarter and more sophisticated. Luckily, there are many industry best practices, such as Bring Your Own Key (BYOK), Bring Your Own Encryption (BYOE) and centralised and automated key lifecycle management that can optimise data protection in the cloud.

How are you leveraging AI and Big Data?

Artificial Intelligence (AI) can be the best weapon in a company’s cybersecurity arsenal and, thus, it is becoming increasingly integral to information security.

However, AI is not placed solely in the hands of the good. Malicious actors can and will adopt AI and machine learning (ML) technologies faster than the good security leaders can. The use of malicious AI and ML will create new challenges for all businesses wishing to safeguard their most precious asset, data.

Data security is not the only challenge businesses must face. Privacy should also concern business leaders for a handful of reasons, especially in the wake of cybercriminals taking advantage of COVID-19 to hack organisations and monetise stolen identities. In addition, consumers are deeply concerned with how their data is collected and used, including new COVID-19 contact tracing apps. A barrage of news about data breaches, government surveillance, corporate misconduct, deep fakes, and biases has soured consumer sentiment on current data practices. It has diminished the level of trust people place on new technologies.

In this rapidly changing environment, regulators and national or transnational authorities strive to protect consumer rights and business innovation by framing strategies and policies towards excellence and trust.