CXO DX March 2021

Things work better together when they work better together.

Firewall

Wireless

Email

Web

Encryption

Mobile

Server

Endpoint

Sophos Central

Our products are fully integrated to share information in real time, providing a unified, coordinated defense.

For more information, contact: salesmea@sophos.com © Copyright 2021. Sophos Ltd. All rights reserved. Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UK. Sophos is the registered trademark of Sophos Ltd.

» EDITORIAL

RESKILLING THE WORKFORCE While the industry adopts new generation technologies, leading to more automation in several roles, job redundancies are a reality that cannot be wished away. The Pandemic has further accelerated the disruption, changing almost overnight the way people work and the changes in terms of a split between staff that is remote working and those working at the office maybe a longer term, if not permanent trend.

Most job roles have evolved and require more from the individual in terms of technology knowhow. Training becomes a key part of keeping pace with changing expectations and with so many learning opportunities available online, the onus is on employees to put in a minimum number of hours of relevant earning that will help enhance their skillsets for the job roles they are in and for the roles that they can possibly grow into. There are companies who are taking efforts at upskilling their employees to make sure they are well aligned to future expectations.

For instance, Amazon's AWS has a program to provide education and training programs to 29 million people globally between now and 2025. Amazon also pledged $700 million in upskilling and training across several departments. It's Career Choice program, unveiled back in 2014, is an education program that pre-pays 95% of tuition and associated fees for permanent employees.

During the Pandemic’s early months last year, Microsoft had launched a global skills initiative aimed at bringing more digital skills to 25 million people worldwide by the end of last year and that continues into this year. This initiative brings together existing and new resources from LinkedIn, GitHub, and Microsoft.

IBM offers IBM SkillsBuild a free, online learning program to help professionals improve their job proficiency through different courses. IBM also utilizes AI to identify upskilling strategies to assist those who mayhave been made redundant.

As the above few examples above show, there are some tangible efforts towards reskilling but we could do with even more companies unveiling such initiatives. Perhaps there could be collaborative efforts as well between some of the vendors towards this end.

R. Narayan

......................................................

Pooja Panjwani Assistant Project Manager

Co-Founder & MD

saumyadeep@leapmediallc.com Mob: +971-54-4458401 Sunil Kumar Designer

210203 EN (DD)

PUBLISHED BY - Leap Media Solutions LLC

...................................

narayan@leapmediallc.com Mob: +971-55-7802403

SAUMYADEEP HALDER

............................................................

Co-Founder & Editor in Chief

MALLIKA REGO Co-Founder & Director Client Solutions

mallika@leapmediallc.com Mob: +971-50-2489676

...............................................................

RAMAN NARAYAN

...................................

Editor in Chief, CXO DX

Nihal Shetty Webmaster

REGISTERED OFFICE: Office 10, Sharjah Media City | www.cxodx.com MARCH 2021 / CXO DX

3

» CONTENTS INTERVIEW

14 » ENABLING APPLICATIONS IN THE MULTI-CLOUD ERA Mohammed AbuKhater, VP Sales, META, F5 discusses Application and cloud trends as well as highlights F5’s solutions

20 » DEMYSTIFYING XDR

16 COVER FEATURE

16 » TRANSFORMATION CHALLENGES IN THE ENTERPRISE Application integration is one of the key issues for Enterprises when embarking on transformation initiatives.

NEWS INSIGHT

12 » IBM STUDY: EMPLOYEE WELL-BEING IS MAJOR PRIORITY FOR MANY CEOS IN THE MIDDLE EAST

Yossi Naar, chief visionary officer and co-founder at Cybereason shares insights into how XDR has redefined cybersecurity

22 » THE SHIFTING SANDS OF CYBERSECURITY Dr. Mohammad Khaled and Kumar Prasoon share their views on the transforming cybersecurity landscape

INSIGHT

26 » SECURING A DISTRIBUTED WORKFORCE Jonathan Nguyen-Duy, Vice President, Global Field CISO Team at Fortinet discusses the Best Practices for Securing a Distributed Workforce Long-term

13 » VEEAM SAW 22% GROWTH IN 2020

4

CXO DX / MARCH 2021

Sameer Makhija, Business Development Director, Asset Management Solutions, IMEA, Infor shares his perspectives on reopening offices safely

30 » WHY MOST AI PROJECTS FAIL

Anas A. Abdul-Haiy, Director and Deputy CEO of Proven Consult says that while Premature failure of AI projects is a common concern, developing strategy and approach can set companies on the right path

32 » HOW TO PREVENT THE RISING NUMBER OF DDOS ATTACKS Amr Alashaal, Regional Vice President - Middle East at A10 Networks shares insights about defending against the increasing DDoS Attacks in the light of COVID-19 and 5G

34 » DUTY OF CARE: WHY IT’S VITAL FOR TRAVEL UNCERTAINTY Emma Shakespeare, MENA South Director at SAP Concur writes that the pandemic has been the catalyst for introducing robust duty of care and safety measures into corporate travel

C-Suite executives surveyed in the UAE are prioritizing the implementation of hybrid cloud strategies to help their organizations

The company’s vision for hybrid cloud drove the company to continued growth

28 » 5 STEPS TO SAFELY REOPEN OFFICES

REGULARS

26

06 » NEWS 36 » TECHSHOW 38 » TRENDS & STATS

POWERSTORE

Designed for the data era Data-centric design

Intelligent automation

Adaptability

Optimize system performance,

Programmable, autonomous

Enable speed and application

to support any workload

management and optimizes system resources

deployment models

Data-centric, intelligent, and adaptable infrastructure that supports both traditional and modern workloads Introducing Intel ® based PowerStore from Dell Technologies –

PowerStore is backed by the Future-Proof Program

» NEWS

PURE STORAGE ENHANCES UNIFIED STORAGE PORTFOLIO The updates further the company’s vision for a Modern Data Experience cloud-based apps, and make hybrid storage for both departmental and data center workloads obsolete with a third generation FlashArray//C all-QLC platform.

Ajay Singh

Chief Product Officer, Pure Storage Pure Storage announced enhancements to its unified storage portfolio. The updates to the flagship Purity software for FlashBlade and FlashArray accelerate Windows applications, deliver ransomware protection across file, block and native

“Pure is named a leader in the recent Gartner Magic Quadrant for Primary Storage Arrays and positioned highest and farthest in both vectors because we are chipping away at the complexity baked into legacy storage that is simply not designed for the digital age. Our vision for a Modern Data Experience empowers organizations to innovate by providing a dynamic, cloudbased storage experience that is flexible, on-demand, and delivered as code,” said Ajay Singh, Chief Product Officer, Pure Storage.

The latest updates, delivered through Pure’s Evergreen subscription model, further the company’s vision for a Modern Data Experience. This extends FlashBlade’s industry leadership with

new native SMB support. This provides simplicity and multi-dimensional performance for very high throughput and IOPS with low latency to support multiple workloads simultaneously. FlashBlade’s new Cross-Protocol File Security design allows access control interoperability between SMB and NFS users while preserving access control lists for both in addition to complying with federal security mandates.

FlashArray’s scale-up architecture balances performance and capacity, delivering operational file services for VDI, file server consolidation, user home directories, and file sharing. File capabilities in FlashArray enhance the value of inherent features such as deduplication and compression. FlashBlade and FlashArray are now both strengthened by SafeMode snapshots, delivering a complete portfolio of protection tools to ensure data is always safe and recoverable in seconds.

VMWARE REFRESHES VREALIZE CLOUD MANAGEMENT PORTFOLIO vRealize helps accelerate innovation with quick and easy access to services, gain efficiency and automation VMware has announced innovations across its VMware vRealize Cloud Management portfolio of on-premises and Software as a Service (SaaS) solutions.

The new and enhanced capabilities combine to enable customers to more securely deploy and operate their hybrid and multicloud environments.

VMware customers are using VMware vRealize Cloud Management solutions to attain greater IT and business agility for faster achievement of business outcomes.

“In today’s uncertain world, enterprises are seeking to increase agility and efficiencies to remain competitive and to drive faster business growth,” said Purnima Padmanabhan, senior vice president and general manager, Cloud Management Business Unit, VMware. “As more businesses pursue cloud as an agility strategy, vRealize Cloud Management helps customers run their applications anywhere

6

CXO DX / MARCH 2021

Purnima Padmanabhan

SVP & GM, Cloud Management Business Unit, VMware while maintaining consistent operations and common governance across all environments.”

VMware vRealize Cloud Management enables customers to consistently deploy and operate their applications, infrastructure, and platform services, from the data center to the cloud to the edge. It helps them accelerate innovation with quick and easy access to services, gain efficiency by improving visibility and automation, and improve control while mitigating risk through unified operations and governance. Today, VMware introduced new releases including VMware vRealize Automation 8.3, VMware vRealize Operations 8.3, VMware vRealize Log Insight 8.3, vRealize Suite Lifecycle Manager 8.3 VMware vRealize Network Insight 6.1 and VMware Skyline; along with enhancements across VMware vRealize Operations Cloud, VMware vRealize Log Insight Cloud, and VMware vRealize Network Insight Cloud.

» NEWS

DEPARTMENT OF DIGITAL AJMAN TRANSFORMS CITIZEN SERVICES USING IBM HYBRID CLOUD SOLUTIONS Using IBM Cloud Pak for Integration, Digital Ajman was able to create a centralized hub, based on a hybrid cloud environment Department of Digital Ajman, announced its collaboration with IBM to accelerate its digital transformation and paperless strategy, using IBM Cloud Pak for Integration. The move was designed to simplify and enhance citizen experiences in Ajman, United Arab Emirates (UAE) through the integration of services across different government entities in the emirate. To date, Digital Ajman’s paperless strategy has brought savings of approximately AED three million (US$ 816,726) and helped reduce paper usage, saving nearly 200 trees.

Digital Ajman was establised in 2017 with the mission of: “Together with our society we build the digital services ecosystem that drives Ajman’s competitiveness.”

“Digital Ajman launched the Digital

Transformation Plan over three years ago with the aim of leading the digital transformation across the emirate and developing digital channels that are capable of providing smart and proactive government services to the citizens and residents of Ajman. A key priority for Digital Ajman was to connect local, federal and private entities in Ajman and across the UAE in order to streamline existing government services, improve efficiency and cross-functional collaboration and reduce operational silos,” said Ohoud Shehail, Director General, Department of Digital Ajman. “IBM was the chosen partner to work with us to solve this challenge and help in achieving the set objectives and benefit from savings in the process.”

Using IBM Cloud Pak for Integration, Digital Ajman was able to create a cen-

tralized hub, based on a hybrid cloud environment, which supports integrations between various private and public entities and their data sources. To date, Digital Ajman connected around 200 integration points, enabling them to bring about financial savings and reduce the amount of paperwork required for government services.

NUTANIX TO CONTINUE CLOUD BUNDLES FOR THE SECOND YEAR RUNNING Nutanix Cloud Bundles help enable commercial customers to simplify the management of their infrastructure, ensure continued business operations Nutanix announced that it will continue its successful Cloud Bundles channel initiative for the commercial market segment.

The initiative will provide commercial customers with access to Nutanix cloud solutions and hyper-converged infrastructure software. Commercial customers can thus modernise their data centers and IT environments at attractive prices, drive digital transformation and support their business by becoming a faster and more flexible IT organisation. At the same time, distributors will benefit from more flexible options for marketing their offerings via the channel.

This is a seamless continuation of the successful initiative previously known as Nutanix Cloud Bundles.

Initially offered in 2020, Nutanix Cloud Bundles help enable commercial customers to simplify the management of their infrastructure, ensure continued business operations and deal with rapidly growing data

make IT teams more flexible and more productive. The role model here is the cloud, but not as a location, rather as an operating model. With our commercial packages, we are bringing the cloud and its operating model to commercial customers more easily and cost-effectively than ever before.”

Aaron White

Sr. Sales Director, METI, Nutanix volumes and the corresponding challenges.

That’s because the challenges commercial customers are facing are essentially the same as those faced by large enterprises.

Aaron White, Sr. Sales Director, METI at Nutanix said, “Automation is the key to

Nutanix Cloud Bundles help enable commercial companies to manage virtual machines (VM) and containers, files, computing resources, storage capacities and network services in a unified way. With these packages, Nutanix extends the access to its solutions and meets the requirements and budget restrictions of commercial customers.

The packages for medium-sized businesses are available in three different versions, Basic, Standard and Advanced. Nutanix Cloud Bundles are aimed exclusively at new customers.

MARCH 2021 / CXO DX

7

» NEWS

BESPIN GLOBAL ESTABLISHES MEA HQ IN ABU DHABI The company will also build two innovation centres – a Cloud Operations Centre and a Technology Hub for its cloud experts – in Abu Dhabi Bespin Global, a leading cloud technology consulting and management company, is setting up its regional headquarters and two innovation centres in Abu Dhabi to accelerate digital transformation from the UAE capital. The Abu Dhabi Investment Office (ADIO) and Bespin Global announced a partnership that will see the South Korean company receive financial and non-financial incentives from ADIO to establish in Hub71, Abu Dhabi’s global tech ecosystem. The partnership is part of ADIO’s AED 2 billion (USD 545 million) Innovation Programme, an initiative of the Abu Dhabi government’s Ghadan 21 accelerator programme.

Bespin Global was established in South Korea in 2015 and operates today with cloud consultants around the world. It provides end-to-end cloud services, cloud strategy, migration, implementation, DevOps and Big Data and has been listed on Gartner’s Quadrant Magic for Public Cloud infrastructure for last four years.

establish its MEA headquarters and build two innovation centres – a Cloud Operations Centre and a Technology Hub for its cloud experts – in Abu Dhabi to help drive advancements in technology and digital transformation. Bespin Global will grow its commercial and technical team as it taps into new areas such as Financial Services and FinTech.

Mouteih Chaghlil

CEO, MEA – Bespin Global ADIO’s support for technology-driven companies is part of Abu Dhabi’s commitment to fostering innovative ideas and solutions that are regionally relevant and globally exportable.

Under the partnership, Bespin Global will

Mouteih Chaghlil, CEO of Middle East & Africa – Bespin Global, said: “This strategic partnership between Bespin Global and ADIO ensures we have the support and enablement to grow our Middle East presence. We have shared goals to grow digital offerings and help enterprises leverage the full power of cloud. To do that we need to hire and train the best talent and provide them with the best place to live, where they not only perform their job, but also contribute in Abu Dhabi’s vision to become a regional innovation hub and help the UAE progress on the global competitiveness index.”

SALESFORCE INTRODUCES LOYALTY MANAGEMENT

This will empower companies across industries to create engaging and effective loyalty programs with clicks sumer goods, manufacturing, travel and hospitality, to increase customer trust and engagement. Built on the Salesforce Customer 360 Platform, Loyalty Management allows companies to build intelligent loyalty programs for both B2B and B2C customers with a flexible, configurable, and quickly deployable solution that fits their specific needs.

With Loyalty Management, companies can provide more personalized consumer experiences, evolve their loyalty programs to stay current with customer expectations and help drive business value by creating loyal, lifelong customers.

David Schmaier

CEO, Salesforce Industries Salesforce announced Loyalty Management, a new product for companies across industries, including retail, con-

8

CXO DX / MARCH 2021

Since the start of the pandemic, more than a third of U.S. consumers have tried a new brand, and 80 percent of them intend on sticking with it. While loyalty programs can help companies develop long term relationships with customers and drive

growth, many rely on outdated, fragmented technology that fail to provide integrated experiences and are unable to evolve with industry trends, such as the shift from traditional point-based reward programs to exclusive experiences and products. These loyalty programs end up offering little value to the business or the customer and actually lower consumer trust instead of increasing it.

“Organizations with high levels of customer loyalty outperform their competition, so it’s critical they provide their customers with valuable and memorable experiences to build trust,” said David Schmaier, CEO, Salesforce Industries.

“Loyalty Management allows companies across industries to evolve their loyalty programs from transactional to human-centric by delivering personalized, relationship-building moments to each customer.”

» NEWS

MINDWARE SIGNS DISTRIBUTION AGREEMENT WITH CIBECS The VAD will offer data management and protection technology from the vendor Mindware has signed a distribution agreement with Cibecs, a leading South African based provider of data management and protection technology. As per the agreement, Mindware will promote, distribute and provide implementation services support across the Middle East for the vendor’s flagship Endpoint Cloud solution.

Providing insight into the partnership, Silmi Khanfir, Director of Cloud & XaaS at Mindware commented, “During this year we have seen a shift in the way organisations operate. With the current remote working trend, workforces are highly distributed and critical business data is often inaccessible or at risk of cyberattack. IT departments often have very little visibility or control over endpoint data and devices. And this is where Cibecs’ Endpoint Cloud solution can play an indispensable role in helping customers to adapt for the new normal in IT operations. By providing a single, unified platform to discover,

manage, backup and secure business data, Cibecs delivers the most advanced data management and protection technology.

As Mindware builds out its security portfolio and capabilities, we see the new partnership with Cibecs adding considerable value to our offerings.”

Cibecs Endpoint Cloud is a powerful cloud platform built for Azure, allowing IT departments and MSPs to easily manage highly distributed and remote workforces, centralise, consolidate, and secure business data remotely, meet compliance regulations and drastically reduce desktop support costs. The vendor is a Microsoft IP co-sell partner with over 16 years of experience in endpoint data protection, backup & security.

Mindware will primarily target MSPs and the government sector – two areas where Cibecs has traditionally had great success.

MSPs need to help customers eliminate

Silmi Khanfir

Director, Cloud & XaaS, Mindware

risk, manage data efficiently, reduce spend and achieve compliance. Cibecs is helping MSPs solve data management challenges and save over 50% on their end-user data support costs. The solution can be deployed on-premise or in a locally hosted Azure cloud vault.

SOPHOS TO PROVIDE INTERCEPT X ENDPOINT PROTECTION FOR SNAPDRAGON POWERED 5G PCS Intercept X for Snapdragon compute platforms to be available in the second half of 2021

combines smartphone and PC technology delivers unique security capabilities and opportunities,” said Joe Levy, chief technology officer, Sophos. “Mobile devices historically have experienced far fewer security incidents than PCs powered by traditional architectures.

It’s certainly not because they aren’t ubiquitous, but rather because of their modern architecture that offers overall predictability relative to PCs, enabling application vendors to design high-performance and secure software.

Sophos, a global leader in next-generation cybersecurity, announced its plans to provide Sophos Intercept X endpoint protection for 5G PCs powered by Qualcomm Snapdragon compute platforms from Qualcomm Technologies, Inc. The combination of Sophos Intercept X with Snapdragon compute platforms will provide users next-generation security through an always on, always connected PC environment.

Snapdragon compute platforms enabling 5G connectivity build on smartphone technology to deliver premium performance and efficiency to 4G and 5G cellular-connected thin and light fanless laptops. Sophos Intercept X is designed to protect advanced computing systems and endpoints, stopping the latest cybersecurity threats with deep learning AI and anti-ransomware capabilities. Sophos expects Intercept X for Snapdragon compute

Joe Levy

Chief Technology Officer, Sophos

platforms to be available in the second half of 2021.

“An always on, always connected, interactive computing environment that

“Snapdragon compute platforms mark a major step forward because they provide all the utility and performance of a PC, but with many of the benefits associated with modern mobile computing devices.

Security loves predictability, and Sophos is excited to be a part of securing this next-generation computing platform.”

MARCH 2021 / CXO DX

9

» NEWS

NUTANIX EXTENDS RANSOMWARE PROTECTION The new capabilities are expected help enterprises prevent, detect and recover against ransomware attacks across multiple cloud environments access controls all natively built into the Nutanix stack.

Rajiv Mirani

Chief Technology Officer, Nutanix

Nutanix has announced additional ransomware protections in the company’s cloud platform. These include new threat monitoring and detection, as well as more granular data replication and robust

The Nutanix cloud platform now delivers anomaly detection based on machine learning and IP reputation services with the company’s security networking operations and monitoring solution, Flow Security Central, a feature with Nutanix Flow. Flow Security Central helps identify known attack vectors, including potential ransomware, at the network level before reaching the application and data layers.

Flow Security Central also monitors endpoints to identify traffic coming from disreputable locations, something especially helpful for defending Virtual Desktop Infrastructure (VDI) deployments that are prime targets for initial ransomware infection and spread.

Closer to the application layer, the Nutanix cloud platform now also includes na-

SENTINELONE ACQUIRES SCALYR TO ENHANCE XDR AND SECURITY ANALYTICS Scalyr’s SaaS platform unlocks the full promise of XDR to offer realtime threat mitigation SentinelOne, the autonomous cybersecurity platform company, announced the acquisition of Scalyr, a leading cloud-native, cloud-scale data analytics platform. With this acquisition, SentinelOne will be able to ingest, correlate, search, and action data from any source, delivering the industry’s most advanced integrated XDR platform for realtime threat mitigation across the enterprise and cloud.

Through this acquisition, SentinelOne sets the bar for the XDR market and solves one of the biggest challenges in delivering a fully integrated XDR platform: ingesting and actioning all operational data in realtime from a security-first perspective.

Born in the cloud, Scalyr’s SaaS platform unlocks the full promise of XDR. By eliminating data schema requirements from the ingestion process and index lim-

10

CXO DX / MARCH 2021

Tomer Weingarten

Co-Founder & CEO, SentinelOne

itations from querying, Scalyr can ingest massive amounts of machine and application data in real time, enabling organizations to analyze, query, and action data with unparalleled speeds and cost-effec-

tive ransomware detection for file storage services within Nutanix Files. File analytics, which is a feature included with Files, now detects abnormal and suspicious access patterns and identifies known ransomware signatures to block data access in real-time. To further protect application data from ransomware attacks, the Nutanix cloud platform now includes new features within the object storage solution, Nutanix Objects. Objects includes more granular permissions to access object data for primary and secondary storage.

Rajiv Mirani, Chief Technology Officer at Nutanix said, “Enterprises need a defense in depth approach to security, starting with their IT infrastructure. However, the right security tools need to also be simple and seamless to implement. Nutanix delivers a strengthened cloud platform out of the box, with an even richer set of ransomware protections available now.” tiveness. This provides SentinelOne customers with autonomous, realtime, and index-free threat analysis and mitigation beyond the endpoint – across the entire enterprise and cloud attack surface – something not possible with today’s human powered and schema-constrained cybersecurity products.

“Through our acquisition of Scalyr, SentinelOne is solving one of the industry’s biggest data challenges for delivering fully integrated XDR capabilities. Scalyr’s big data technology is perfect for the use cases of XDR, ingesting terabytes of data across multiple systems and correlating it at machine speed so security professionals have actionable intelligence to autonomously detect, respond, and mitigate threats,” said Tomer Weingarten, Co-Founder and CEO, SentinelOne. “This is a dramatic leap forward for our industry – while other next-gen products are entirely reliant on SIEM integrations or OEMs for point in time data correlation and response, SentinelOne uniquely provides customers with proactive operational insights from a security-first perspective.”

» NEWS

CYBERKNIGHT BECOMES SOLE MIDDLE EAST DISTRIBUTOR FOR NETWRIX AND STEALTHBITS, NOW PART OF NETWRIX Solutions will to identify and classify sensitive information with utmost precision reduce exposure to risk and detect threats in time CyberKnight has extended its relationship with one of its technology partners – Stealthbits to become sole Middle East distributor for Netwrix, following Stealthbits’ recent merger with Netwrix, a company that makes data security easy.

This partnership will enable CyberKnight customers to address challenges related to identifying and detecting data security risk as well as protecting, responding, and recovering from cybersecurity attacks.

“We are thrilled about a strategic partnership with the combined entity of Netwrix and Stealthbits, now part of Netwrix.

Their solutions will empower our regional customers to identify and classify sensitive information with utmost precision, reduce exposure to risk and detect threats in time to avoid data breaches – all while achieving and proving compliance”, commented Vivek Gupta, Co-Founder & COO at CyberKnight.

Gartner predicts that “through 2024 80% of information governance programs that do not include unstructured, semi-structured and structured data into the same governance program will fail, up from 30% today.” In addition, fragmented solutions in the data security market prevent organizations from building comprehensive security strategies to protect their sensitive and regulated data.

“Solutions often overlap in functionality, which means that organizations have to pay twice for the same features. Having merged together, Netwrix and Stealthbits are able to offer to their partners a comprehensive portfolio of security solutions.

We are confident that we will continue to drive customer value with CyberKnight through their deep-rooted channel partnerships, enterprise and government cus-

MCAFEE AND INGRAM MICRO EXPAND PARTNERSHIP The security leader plans to expand its footprint on Ingram Micro’s network of e-commerce platforms throughout 2021 McAfee and Ingram Micro Inc announced an expanded worldwide agreement that will provide access to McAfee products and solutions across Ingram Micro’s global distribution network, including its regional Cloud Marketplaces and Centers of Excellence.

McAfee launched its SaaS portfolio on the U.S. Ingram Micro Cloud Marketplace in late 2020, and plans to expand its footprint on Ingram Micro’s network of e-commerce platforms throughout 2021. Together, the two companies are working to help channel partners embrace these dynamics and enhance their offerings to address customer needs and drive intiatives to accelerate the opportunity by offering McAfee Device to Cloud Suites designed to help organizations accelerate cloud adoption.

Additionally, Ingram Micro is expanding

Kathleen Curry

SVP, GEC, OEM & Strategic Alliances, McAfee

its services capabilities with McAfee to provide migration services to move from legacy security technology to McAfee MVISION products.

Vivek Gupta

Co-Founder & COO, CyberKnight

tomer advisory relationships, strong cybersecurity expertise and local presence across the region,” said Rob Billington, Channel Manager, EMEA at Netwrix and Stealthbits.

“At McAfee, we are focused on empowering our partners to effectively address dynamic customer needs by providing industry leading security solutions, a strong eco-system, and programs that enhance profitability, ” said Kathleen Curry, SVP of global enterprise channels, OEM & strategic alliances, McAfee. “Our expanded relationship with Ingram Micro will help build on the transformation that McAfee has been driving and enable our organizations to reach a larger set of customers around the world in need of security protection.”

“We are proud to play an increasingly important role in McAfee’s global channel strategy and applaud its efforts to increase its channel partner engagement and enablement,” said Scott Zahl, executive director, global partner enablement, Ingram Micro. “Together with McAfee we are providing our mutual channel partners with access to one of the world’s most trusted cybersecurity solution portfolios and award-winning channel programs. ” MARCH 2021 / CXO DX

11

» NEWS INSIGHT

IBM STUDY: EMPLOYEE WELL-BEING IS MAJOR PRIORITY FOR MANY CEOS IN THE MIDDLE EAST C-Suite executives surveyed in the UAE are prioritizing the implementation of hybrid cloud strategies to help their organizations An IBM Institute for Business Value (IBV) study revealed that a top challenge for many surveyed CEOs in the Middle East over the next few years is managing an “anywhere” workforce. Additionally, many CEOs in the Middle East are prioritizing technology, people, and partnerships to position their companies for success post-COVID-19 pandemic. The new IBV study polled CEOs from nearly 50 countries, including the United Arab Emirates, Saudi Arabia and Jordan in the Middle East.

Empowering Employees the Hybrid Workplace

in

IBM’s annual study found that more than half of CEOs surveyed in the Middle East reported empowering a remote workforce was a very or extremely important priority during 2020. IBM recommends that leaders consider carefully the longer-term challenge of a hybrid work environment, which can include things like providing employees with digital, cloud-enabled tools for collaboration, preventing employee burnout or sustaining company culture with focus on diversity and inclusion.

In addition, over half of the CEOs surveyed in the Middle East report they will prioritize employee well-being even if it costs near-term profitability, reflecting that the surveyed leaders are heavily focused on their people in this moment.

“Many business leaders across the Middle East have faced the challenge that COVID-19 presented to them head on with new modes of working to ensure the safety of employees,” said Hossam Seif El-Din, General Manager, IBM Middle East and Pakistan. “While technology

12

CXO DX / MARCH 2021

has made distance working a reality for employees across the world, we are seeing that managing a remote workforce is a challenge in itself. We believe that utilizing the right technologies and adopting more empathetic forms of leadership can help ensure a positive state of mind amongst employees and a thriving business.”

Scalable and Flexible Technology Foundations

The IBV study also revealed that over 50 per cent of CEOs surveyed in the Middle East see technology factors and people skills as the most important external forces that will affect their business in the next few years, following the massive disruptions of 2020.

Across the board, surveyed CEOs in the Middle East said Cloud, AI, IoT and advanced analytics were top technologies that they believe can deliver benefits for their business.

Growing Importance of Partnerships

CEOs are also more focused on partnerships, according to the IBV study. 46 per cent of CEOs surveyed in the Middle East said partnerships have become more important for driving business performance.

Based on the results of this study, IBM’s thesis is that outperforming company CEOs globally are narrowing their focus to what they do best and relying on partners and ecosystems for access to broader ideas and innovation opportunities.

In addition, IBM notes that as many leaders increasingly see how their organizations can help address interconnected global issues like climate change, ecosys-

Hossam Seif El-Din

General Manager, IBM ME & Pakistan

tems may be able to play a pivotal role in driving lasting change.

The IBV study includes recommendations from IBM for how leaders can seize this moment to reset and focus on what may be essential for success: choosing flexible and scalable technology platforms like an open hybrid cloud, investing in the holistic well-being of their people, and partnering to win with an open innovation approach.

Methodology

The “Find your essential” study polled 3,000 CEOs across 26 industries and nearly 50 countries, including the United Arab Emirates, Saudi Arabia and Jordan.

It was conducted in cooperation with Oxford Economics and benchmarked against more than 20 years of IBM’s annual CEO surveys.

» NEWS INSIGHT

VEEAM SAW 22% GROWTH IN 2020 The company’s vision for hybrid cloud drove the company to continued growth Veeam reported results for its fiscal year 2020. Veeam kicked off 2020 with the completion of its acquisition by Insight Partners, which was announced on Jan. 9 at a valuation of $5 billion, setting the pace for a year of substantial growth and expanded success across all market segments, culminating with Veeam’s acquisition of Kasten, the market leader for Kubernetes Backup and Disaster Recovery (DR), in Q4’20.

“Even with the unforeseen challenges and circumstances that began in early 2020, Veeam continued its rapid growth with its second consecutive year of bookings over $1 billion and a 22% yearover-year (YoY) increase in annual recurring revenue (ARR),” said William H. Largent, chairman and CEO at Veeam.

“The Veeam EMEA team was focused on driving simplicity and consistency in the face of evolving technology demands and uncertain economic landscapes in 2020 to achieve 22% year-overyear (YoY) increase in annual recurring revenue (ARR) in Q4’20.

We continued to deliver and accelerate on our Act II journey by winning the hearts and minds of our customers, deepening our relationships with partners and successfully moving to a recurring sales model,” said Daniel Fried, general manager (GM) and senior vice president (SVP), EMEA and worldwide channels at Veeam.

During 2020, Veeam’s vision for hybrid cloud drove the company to continued growth, surpassing 400,000 customers. Specifically, Veeam Backup for Microsoft Office 365, Veeam’s fastest growing product for the past two years, reported 73% growth YoY. Veeam Backup for Microsoft Office 365 has now been downloaded by more than 154,000 organizations, representing over 15 million user mailboxes. Version 5, released in December 2020, adds purpose-built backup and recovery for Microsoft Teams, making it easier than ever for users to quickly find and restore Teams data, including entire groups, specific channels and settings. Protecting this data is more critical than ever, as the shift to remote working has created an explosion in Microsoft Teams adoption over the past year, with 115 million daily active users last month, up 475% from 20 million daily active users almost 12 months ago.

“Insight Partners’ acquisition [of Veeam] at the beginning of the year definitely fueled a fire within Veeam right out of the gate,” said Danny Allan, chief technology officer and senior vice president of product strategy at Veeam. “We then announced the general availability of Veeam Availability Suite v10 which included 150+ new features and set the bar for the next generation of data protection. Despite the challenges that were then presented by the global pandemic – to our employees, customers and

Claude-Schuck

Regional Director, ME, Veeam

partners – Veeam continued to focus on its vision and during the year launched 16 major releases to meet the new data backup and protection demands of our customers. As we continue our Act II journey into the hybrid cloud and containers, we’re embracing and developing new technologies. I’m very excited about the upcoming announcement of version 11 of our flagship product, Veeam Backup & Replication™ later this quarter, which will further strengthen Veeam’s commitment to modernize our customers data protection practices.”

Claude Schuck, Regional Director, Middle East at Veeam commented, “Despite the encompassing challenges that the pandemic brought to the entire world in early 2020, companies in the Middle East quickly mastered the transition to fully digitize their business operations. Our partners and customers were always at the forefront offering best-in-class products and customized services in a non-traditional business manner. Veeam contributed here by enabling and navigating them through these uncertain times to ultimately ensure availability and protection to the most critical business IP in the era of digitalization – data.”

MARCH 2021 / CXO DX

13

» INTERVIEW

ENABLING APPLICATIONS IN THE MULTI-CLOUD ERA Mohammed AbuKhater, Vice President Sales, Middle East, Turkey and Africa, F5 discusses Application and cloud trends as well as highlights F5’s solutions plication security and delivery technology solutions that support them—closer to users. Add to that the use of edge computing, and we’re starting to see incredible momentum for the emergence of truly adaptive applications that can grow, shrink, defend, and heal themselves based on the environment they’re in and how they’re being used.

The SOAS report found that the majority of organizations will continue to manage both traditional and modern applications and architectures. This expectation is supported by the 87% of survey respondents claiming that they now juggle both—an 11% increase over 2020. Nearly half of all organizations—30% more than last year—said they are managing at least five different architectures.

According to almost half of the survey respondents, the pandemic was the main factor in accelerating movement to the cloud and SaaS. More than two-thirds of respondents (68%) are now hosting at least some of their application security and delivery technologies in the cloud. Simultaneously, organizations are positioning themselves to address the architectural complexity that results from adding SaaS and edge solutions, maintaining on-premises and multi-cloud environments, and modernizing applications.

Mohammed AbuKhater

Vice President Sales, META, F5

Discuss major challenges from an application performance and availability point of view during various scenarios of cloud deployments?

COVID-19 has catalyzed the speed and depth of the world’s digital transformation efforts.

According to F5’s latest State of Application Strategy (SOAS) report, the need to improve connectivity, reduce latency, ensure security, and harness data-driven insights is intensifying. It also points to an elevated interest in cloud, as-a-service solutions, edge computing, and application security and delivery technologies.

Progress that might normally have taken a decade has leapt forward in a single year. In a short time, more organizations than ever have modernized and distributed applications—and the ap-

14

CXO DX / MARCH 2021

Application security and delivery solutions were also in the SOAS spotlight. The critical roles these enabling technologies play in customer experience and service level agreements (SLAs) are now recognized by nearly four out of five respondents. SaaSbased security was identified as organizations’ top overall strategic focus over the next two to five years.

How can organizations adapt to a multi-cloud environment?

Gone are the days when you could reasonably expect to keep track of and manually update policies individually across clouds without hits to security and performance. Instead, it’s time to implement a policy management strategy that fits your organization and your apps.

To get it right, it is crucial that innovation doesn’t outpace planning. The key principles to consider in the pursuit of multi-cloud success are: 1. Standardize. Improve deployment, management, and reliability of applications through standardization.

2. Automate and integrate. Don’t just automate what you have; automate what your business requires.

3. Embrace abstraction. Find the right level of abstraction to re-

» INTERVIEW duce complexity and increase efficiency.

4. Increase visibility. Deploy an analytics solution that gets the right actionable information to the right people.

5. Reimagine what’s possible. Don’t let a retrofit mindset obscure a chance to innovate.

Discuss your solutions for Multi cloud deployments?

Cloud decisions are often driven by what’s best for the application, even when different apps require different cloud services.

However, more cloud environments also mean more complexity.

To help simplify organisations’ cloud strategies, F5 offers a comprehensive set of multi-cloud application services and management tools that remain consistent across clouds. F5 services are highly programmable, API-accessible, and can be integrated with existing automation and delivery systems.

Do you have solutions for containers? Please give a brief Containerized application lifecycles are dynamic and transient — characteristics that do not mix well with traditional networking and security policies. Leveraging containers enables organizations to develop cloud-native apps with a “write once, run anywhere” methodology. Containerized applications need native application delivery mechanisms to deliver optimal performance.

Sticking with the traditionally static, IT-managed configuration is at odds with the agility organizations need to keep up with the spinning up and down of microservices containers that can happen on a minute-by-minute basis.

When organizations employ a micro-services-based solution, they need app security and performance solutions that are aligned with that dynamic architecture. They should be able to manage their app services as code and integrate them into the CI/CD workflow. In short, they need reliable application delivery services integrated with the container platform management plane.

F5 NGINX application delivery services are designed and optimized for container environments, making it an ideal choice when leveraging container platforms such as Kubernetes and Red Hat OpenShift. Furthermore, standardizing on NGINX for both container and non-container environments reduces complexity and ensures greater consistency and reliability.

As the top ingress controller for Kubernetes, NGINX Ingress Controller provides automated configuration for NGINX load balancers to ensure that applications in Kubernetes clusters are delivered reliably and securely without compromising performance.

Respondents agreed that the data collected by their tools is primarily used for troubleshooting, followed by early warnings about performance problems. Worryingly, a mere 12% report the data back to business units, whereas fewer than 24% of organizations use data and insights to watch for potential performance degradations. By contrast, when it comes to monitoring components that modernize apps, nearly two-thirds of respondents (62%) are measuring performance in terms of response time.

Conscious of a need to do better, over 80% of respondents said that data and telemetry are “very important” to their security plans, and over half are “looking forward” to the beneficial impacts of AI. Survey respondents also flagged platforms that combine big data and machine learning (also known as AIOps) as the second most strategic trend in the next two to five years.

At the same time, that enthusiasm could be blunted by a lack of emerging, relevant skillsets in the market. This is particularly true for those identifying AIOps as their top strategic trend. Half of those respondents cited a paucity of skilled professionals as their number one challenge.

Elaborate on the Big IP portfolio - what are the solutions in this range?

F5's BIG-IP is a family of products covering software and hardware designed around application availability, access control, and security solutions.

BIG-IP encompasses: • Application delivery controllers. BIG-IP Local Traffic Manager (LTM) and BIG-IP DNS handle your application traffic and secure your infrastructure. You’ll get built-in security, traffic management, and performance application services, whether your applications live in a private data center or in the cloud.

• Service providers. BIG-IP Diameter Traffic Management, BIG-IP Policy Enforcement Manager (PEM), and BIG-IP Carrier-Grade NAT (CGNAT) manage network resources to keep your applications performing at carrier-grade levels. They also help you identify ways to optimize and monetize your network, improving your bottom line.

Meanwhile, NGINX OpenShift Router provides advanced traffic management and security services for Red Hat OpenShift that improve your application’s performance, resilience, and reliability.

• Platforms. Whether you deploy your applications on-premises, in the cloud, or both. Hardware appliances include the BIGIP iSeries or our high-performing VIPRION chassis and blades.

Software options are available through BIG-IP virtual edition or BIG-IP Cloud Edition.

Discuss some of the major performance challenges for applications and threats While the recent SOAS report gave a lot of room for optimism, it also revealed some weaknesses in organization’s application strategies. Indeed, while more than half of SOAS respondents believe they already have the tools they need to report on the health of high-priority applications, 95% say they are missing insights from their existing monitoring and analytics solutions.

• Per-App Services in the Cloud. F5 BIG-IP Cloud Edition was built to help network operations teams and applications teams collaborate more closely together in the rapid delivery of secure, supported applications. BIG-IP Cloud Edition simplifies and centralizes core device and app services management functions and makes it easy for NetOps teams to focus on defining a self-service catalog of application services that developers can access on demand.

MARCH 2021 / CXO DX

15

» COVER FEATURE

TRANSFORMATION CHALLENGES IN THE

ENTERPRISE Application integration is one of the key issues for Enterprises when embarking on transformation initiatives

16

CXO DX / MARCH 2021

» COVER FEATURE

T

he year of the pandemic unleashed a sense of urgency in organizations to get on to the cloud in a significant way to achieve digital transformation because that was the key to remaining in Business for most. There have been several challenges to navigate along the way.

For instance, Application integration has been one of the key issues for Enterprises when embarking on transformation initiatives including a migration to cloud. With the adoption of the cloud and technologies including IoT, Big Data etc, organizations also need to implement Enterprise Application Integration (EAI) that helps in uniting the databases and workflows so that the information is consistent and reflected across systems.

In several scenarios, legacy applications can be the bottlenecks because they could be operating in silos and making dynamic flow of data to other systems as required for Business objectives impossible. There are also other challenges including getting the stakeholders of the organization to accept the shift to digital positively.

Ossama Samadoni, Sr. Sales Director – MERAT, Dell Technologies says, “For enterprises, being held back by their legacy IT infrastructure is one of the main roadblocks to effective digital transformation. This can hinder digital advances, as migrating to new systems can seem like a large feat to undertake. Enterprises also face obstacles in their organizational culture which may sometimes be resistant to change. They must actively engage stakeholders, from employees to management, and implement a transition plan for their workforce, in order to support the shift to a digital culture. It also takes having the right expertise and a clear roadmap aligned to business objectives to excel on the digital transformation journey. Enterprises can become overwhelmed with which technologies to implement and where to begin on their digital journey, as they are facing immense pressure to transform quickly. Additionally, data management can be more challenging for enterprises because of the sheer amount of data collected.”

On its part, Dell Technologies has a team of digital transformation specialists that help address the unique concerns of enterprises and provide them with specific guidance on how to enable transformation from the edge to the core to the cloud effectively.

The road to successful digital transformation is not an easy one.

It is best travelled together with trusted technology partners.

Ahmed Al-Faifi, Senior Vice President and Managing Director, SAP Middle East North says, “While the Middle East C-suite understands the importance of digital transformation, they need to work with knowledgeable and experienced technology vendors and channel partners to identify the business cases, the solutions that meet these business needs, and develop an iterative process that measures and adjusts the KPIs. The Middle East organizations also face challenges in the CIOs presenting the financial case with a focus on total cost of ownership, and skills development. Not every employee needs to be a data scientist, but analytics are increasingly part of every employee’s job role – especially when we get to more complex deployments such as IoT.”

Ossama Samadoni

Sr. Sales Director – MERAT, Dell Technologies

SAP has many stories of success digital transformation from its customers and has been Supporting Middle East organizations in their digital transformation though its initiatives such as the cloud data center in Saudi Arabia where it has been seeing strong demand for solutions running on cloud. The Communications and Information Technology Commission (CITC) of Saudi Arabia (KSA) has awarded SAP as the Kingdom’s first Level 3 cloud service provider, giving organizations greater confidence in embracing the cloud and to meet data residency and sovereignty requirements.

Since one of the significant challenges enterprise face would be around application integration, it is a sizable opportunity for enterprise application vendors and integrators.

Ossama says, “Globally, the Enterprise Application Integration market is expected to reach USD 22.69 billion by 2026 at a CAGR of 15.42%, according to research by Mordor Intelligence. For the region, the same trends are expected to be seen with increases in uptake of Enterprise Application Integration systems. With widespread use of cloud, we’ll see more enterprise architectures including cloud-based integration systems, which will continue to drive the market. At Dell technologies, we can help organizations determine how to execute their application transformation. In fact, in its 2020 Magic Quadrant for Enterprise Integration Platform as a Service, Gartner evaluated MARCH 2021 / CXO DX

17

» COVER FEATURE end systems together as we focus on providing the best customer experience front end applications.”

There have been a lot of investments happening on the Applications front. A recent survey by Oxford Economics and SAP shows that since the start of the coronavirus pandemic, 32 percent of organizations are investing in new technologies to analyze data. The top three technologies seeing investment are AI (34 percent), IoT (33 percent), and analytics (27 percent). 34 percent are retraining employees to work with data and 25 percent are extending data governance policies across the business ecosystem.

According to Ahmed, “The Middle East enterprise app integration market is rapidly growing, aligned with government-led nationwide digital transformation agendas. Coronavirus has accelerated the digital transformation of organizations to optimize costs, enhance employee and customer experiences, and drive busines competitiveness.”

“SAP and its channel partner ecosystem are helping to guide companies through their digital business transformation by redesigning business processes, enabling technical migration, and building an Intelligent Enterprises,” adds Ahmed.

IoT integrations Ahmed Al-Faifi

SVP & MD, SAP Middle East North 17 vendors on ability to execute and completeness of vision.

Dell Boomi was named a Magic Quadrant Leader in Enterprise Integration Platform as a Service (iPaaS) for the seventh consecutive year.”

The Boomi AtomSphere Platform has been solving the needs of Dell Technologies' customers with end-to-end capabilities by integrating applications, systems, and connecting people.

By delivering one platform for data discovery, application/data integration, API management, data quality governance, B2B integration, low code app development, workflow automation, and more, Dell is bringing integrated experiences come to life.

Enterprise application integration is perhaps now not an opportunity limited only to large organizations as smaller organizations adopt cloud-based applications and many which would require integration between backend and frontend to have seamless operations.

Sunil Paul, Co-Founder and CEO of Finesse Technologies, a leading integration company for enterprise software has this to say, “Enterprise Application market was applicable only to large size enterprises until recently. However, the adaption of digital transformation has forced every organization to install an interoperability middle ware / data exchange platform to ensure seamless processing of information from various back end systems to numerous front end applications and vice versa. We at Finesse always take a strategic architectural approach for all our digital transformation projects and consider enabling the back-

18

CXO DX / MARCH 2021

IoT deployments are on the rise in the region with several well-defined use case scenarios across verticals. The adoption rates have in fact gone up since the pandemic and integrating IoT into the network with a proliferating number of sensors, each a point of data creation, has meant that Enterprise Application integration has never been more essential.

Ossama says, “Million IoT devices will be connected to on-premises private networks by the end of 2030, up from 3 million at the end of 2019, according to a report by Transforma Insights. Some of the typical use cases for these in the region are in the manufacturing and transportation industry, typically for the supply chain purposes of asset and inventory management. Additionally, monitoring is another typical use case to be seen in the agricultural and retail industries, as well as in remote locations. With numerous amounts of data feeding in from IoT devices coupled with additional application programming interfaces (APIs), application integration becomes even more complex and essential. Integration Platform as a Service (iPaaS) can be leveraged to manage flows from both on-premise and on the cloud, in order to achieve actionable business insights. The adoption of technologies, including IoT technologies, has been accelerated by the pandemic, and has helped ensure business continuity throughout this time of disruption.”

SAP offers an IoT solution that provides a reference architecture that offers business services and specific capabilities, including cloud services, built-in Big Data, IoT data enriched with business context, and analytical services with live integration to the SAP Analytics Cloud solution.

Ahmed adds, “Across the Middle East, IoT deployments can cover all industry verticals – especially government and public

» COVER FEATURE sector, trade and logistics, utilities, and mega-events. One of the best examples of Middle East IoT deployments is the Saudi Arabia Ministry of Hajj and Umrah’s Smart Hajj Initiative. Digital transformation allows real-time insights to optimize travel and crowd experiences. During the second phase of Smart Hajj, the Ministry aims to roll-out predictive modeling and simulation for millions of Hajj and Umrah pilgrims. The Smart Hajj captures in real time pilgrims using the Internet of Things, geospatial and camera analytics, along with data from the pilgrim experience mobile feedback platform.”

The UAE in particular has been adopting the latest technologies and driverless cars along with other industrial initiatives are expected to keep the momentum going on the IoT front.

Sunil says, “IoT applications will always be on the rise. The next big thing is going to be the self-driving cars and automated driving, which will start generating and processing enormous amount of data in real time, which indeed requires a strong middleware architecture platform. Also the new announcement by Sheikh Mohammed launching 300 Bn Initiative for the industrial sector will see a huge jump in the IoT deployments in the region.”

Remote work trends and transformation

With remote work established as a major trend, there been a demand for faster migration of more enterprise workloads back and forth to the cloud in the region. Vendors like Dell are helping address these challenges with their solutions.

Ossama says, “With the onset of the pandemic, workload migrations to cloud have accelerated in demand, putting the spotlight on cloud services to support a remote workforce. According to Gartner, by 2022, 75% of organizations that implemented workfrom-home policies for their workforce will retain the remote working options for their employees. This will prompt organizations to continue moving key workloads to the cloud.”

He adds, “Dell Technologies is experienced in helping organizations optimize workload placements from core to edge to cloud and benefit from advanced data management, real-time intelligence and responsive application development. Our solutions allow organizations to enjoy the flexibility of moving data and strategically placing workloads across a hybrid IT infrastructure. With a wide range of servers that can be configured to meet organization’s need, organizations can run, store and protect workloads where they need to be. A consistent infrastructure and operations across public, private, and edge clouds, can help in delivering the right environment for all cloud native and traditional workloads.”

The change will continue and as expected by Gartner 75% of the data will be created at the Edge of the enterprises; this is a result of evolution of data ingestion technologies and moving the processing and first level analytics near to data creation points.

Ossam adds, “With our PowerStore X and our new Edge servers as well as evolution of Edge IOT technologies from Dell Technologies and its partners; we are ready to support custom-

Sunil Paul

Co-Founder and CEO, Finesse Technologies er journey of transformation and management of data at Edge, Core and Cloud.”

SAP has upped the ante recently in its appeal to customers looking for digital transformation and cloud services with its announcement of SAP RISE, that brings transformation as a service to customers on a subscription basis. It offers a holistic approach to help companies transform their business, going beyond a technical migration to the cloud to enable continual transformation.

In addition to offering redesign of Business processes and enabling technical migration to the cloud, as part of its deliverable of building an intelligent enterprise, the SAP Business Technology Platform delivers one semantic layer across an enterprise, providing the foundation for a complete business transformation.

Ahmed says, “One of the most innovative solutions to help meet organizations’ needs is RISE with SAP, which offers customers at all stages of digital transformation a completely new way to redesign processes with intelligent technologies for better business outcomes. Along with its robust partner ecosystem, SAP will deliver fast time-to-value, and flexibility to thrive amid change – all without high upfront investments” In sum, looking at the approach of two of the heavyweights in the industry towards digital transformation, it reflects that organizations are moving more aggressively to the cloud and they need all those leading edge integration solutions, whether integrating IoT or any other core applications, to make their transformation seamlessly successful.

MARCH 2021 / CXO DX

19

» INTERVIEW

Demystifying XDR Yossi Naar, chief visionary officer and co-founder at Cybereason shares insights into how XDR has redefined cybersecurity

There are so many security solutions that security teams are already grappling with and now we are talking about XDR – how is it going to help security teams?

We are in a new world where businesses are reevaluating their go-tomarket approach, prioritizing secure remote work, and are seeking IT and security tools that can protect both new and legacy investments.

At the same time, attackers are taking advantage of traditional firewall and AV defenses; they remain undetected by hiding not only on the endpoint, but behind stolen identities, misconfigurations, and gaps in visibility.

XDR aims to end cyber attacks, no matter where they start on the network, by simplifying the complete process of threat detection and response. XDR hunts malicious behaviors by combining rich endpoint data with identity and cloud workspace activity. Data from multiple tools and processes are consolidated into a unified detection platform, attacks are surfaced as a single correlated attack story (Malop), and incident response actions are contextual, guided, and available from the same console.

Can you help clear up some of the confusion around XDR and SIEM - what can it do that SIEM can’t?

XDR should do three things that are not typical to SIEM. This includes the out-of-the-box threat prevention, the threat hunting without the need to learn a complex query language, and the ability for XDR to automatically reduce the risk of secondary breaches.

Threat Prevention: A challenge commonly heard with SIEM is that it’s useful against known, commodity attacks, but struggles to detect multi-stage, stealthy attack behaviors. And, because it’s only alerting on behaviors, and not taking action, this requires human intervention and cycles to investigate and take action on the results. XDR should provide users with next-generation anti-virus, ransomware protection, and behavioral detections that stop malicious behavior before attackers can gain a foothold on targeted networks. This reduces the impact of every attack, saves analyst workload reacting to common threats, and reduces overall risk, instead of merely alerting on it.

Accessible Threat Hunting: One challenge with SIEM is achieving consistent productivity -- this includes shifting to more proactive security and threat hunting, and onboarding new analysts to existing technology. Traditional threat hunting requires multiple domains of expertise -- security (what behaviors are malicious), data management (collecting the right data sources), and data science (query language to find and parse results). XDR is intended to simplify threat hunting and data exploration with an extensible, point-and-click investigation interface. With a cloud-hosted, extensible architecture, analysts do not need to worry about data pipelining, data management, or learning a complex query language to get results. From just a hypothesis or investigation finding, a security analyst can find related and important context with just a few clicks.

20

CXO DX / MARCH 2021

» INTERVIEW Reduce Risk of Secondary Breach: A first principle of security is the longer an attack goes undetected, the harder it is to fully remediate and evict the adversary. During a multi-stage attack, an attacker will seek to gain multiple forms of persistence -- continued access to the victim environment.

Through native integrations with email, productivity suites (e.g.

Google Workspace & Microsoft 365), and cloud services, XDR should not only integrate to detect attacks, but automatically reduce the risk of an ongoing malicious operation. For example, if a malware is found on an endpoint, email and shared drives are automatically checked to ensure that the malware isn’t present elsewhere on the network. And, if there’s an anomalous behavior exhibited by a user, their endpoint is automatically checked for any suspicious behavior and added to any Malops generated for investigation.

XDR seems to be an evolution of EDR. Is that correct? What is the relation between the two?

The goal of XDR is to help security teams find and end cyber attacks, wherever they appear in the environment. Since attackers are not only compromising end-user endpoints, but also user identities, cloud assets, and cloud services, it’s essential that the “R/response” capabilities in XDR match the capabilities of the adversary.

For XDR providers, that means delivering the ability to act across email, productivity suites, security tools, and cloud services -- that includes revoking access, forcing multi-factor authentication, resetting a password, and deleting an email / cloud-hosted file with known-malicious content. In combination with the response actions available with EDR, this allows analysts to take comprehensive remediation, at scale, with a process that minimizes end-user disruption, IT support tickets, and upgrades the typical “reimage to resolve” response workflow.

Can you explain how XDR helps mitigate some of the challenges commonly seen with SOAR technology?

SOAR technology helps solve a critical security team: help me correctly respond to a malicious operation, automate repetitive tasks, and increase visibility and partnership across IT and Security. Some of the challenges with SOAR is that it typically relies on an existing SIEM or security analytics deployment, requires integration and workflow automation expertise, and is out of budget and reach of most security teams.

XDR includes many orchestration, automation, and response capabilities that are used across Prevention, Detection, and Response. Outof-the-box, an XDR solution should include contextual and guided response workflows that automatically reduce the risk of secondary breach. For example, if an anomalous behavior takes place on a user account or endpoint, XDR should verify that the behavior isn’t occurring elsewhere on the network. This should work without needing to deploy on-premises components or recurring integration work. This means a team can be operational in weeks, not months, and there is no need to build and maintain workflows connecting multiple modules together (e.g. SIEM + SOAR + Threat Intelligence + EDR).

Does XDR help solve the IT infrastructure visibility gap? How? Yes - XDR brings new visibility and context, especially around important new areas of the modern network that are often unmonitored.

This includes cloud workloads & infrastructure, user identities, pro-

Yossi Naar Chief Visionary Officer & Co-Founder Cybereason

ductivity suites, and email. There may be point solutions specifically monitoring these areas of the network; XDR fuses these elements into a single actionable vantage point.

XDR solutions should support global, distributed endpoints, ranging from Windows, Mac, Linux, iOS, Android, as well as cloud infrastructure, workloads, and user identities. This combination provides actionable visibility, threat detection, and response capabilities in a platform that is easy to deploy, manage, and use to reduce the risk of cyber attacks.

Can you walk us through an example of how an XDR solution can help organizations respond faster and more effectively to a breach?

Let’s take for an example a very common attack vector, Phishing. ● XDR sifts through endpoint, email, and identity events to present in real-time the important behaviors that matter to the analyst. This is compared to legacy approaches which highlight single events, even if the behavior is exhibited across multiple identities and assets. ● Automatic correlation and visualization should present to analysts important context and impact of the attack, including affected users and assets, root cause, known attacker tools & communications, a timeline of events, and most importantly -- what remediation actions should be taken to end the malicious operation. ● With built-in response capabilities, analysts should be guided, step-by-step on how to isolate or remediate the attack. This may include taking action on the endpoint, (e.g. kill process, isolate machine), but also user accounts, cloud identities, and existing IT & security tools deployed across the ecosystem.

MARCH 2021 / CXO DX

21

» INTERVIEW

THE SHIFTING SANDS OF CYBERSECURITY Dr. Mohammad Khaled, Cybersecurity and digital transformation Expert and Kumar Prasoon, CIO and COO at Cirrus1 share their views on the transforming cybersecurity landscape Elaborate how you see the cybersecurity landscape- would you agree that there is now no perimeter to the network and hence there is increased vulnerability?

Dr. Mohammad: By the year 2021, it is expected that the cost of cybercrime damage globally could be as high as $6 trillion. This figure is not a surprise when seen in the context of the fact that cybercrime has continue to grow each year, especially as compa-

22

CXO DX / MARCH 2021

nies are pursing digital transformation. As Businesses seek a digital-first posture, they must ensure there is a safe repository for all the data collected to secure and share as required. It goes without saying that security must be capable to respond to ever-growing and ever-changing threats. For sure, a system which is not updated with security, would be an easy victim for malware attacks and hackers will be able to effortlessly extract critical within no time and pass it forward for the purpose of financial profits or just to hurt the Business or the individual. And especially users are no increasingly based remotely, the risk factor is higher as never before.

Hence, I do agree that there is now no perimeter to the network and the attack surface is much wider with increased vulnerability.

A cyber threat attack surface refers to the digital and physical vulnerabilities in your hardware and software environment. In

» INTERVIEW software environments, a threat attack surface is the total number of vulnerabilities an unauthorized user can potentially use to access and steal data.

As cybersecurity professionals, it is our responsibility to minimize the threat attack surface as much as possible. There is sometimes confusion between a threat attack surface which is what is being attacked and an attack vector, which is the means or method used by an intruder to gain access. The types of attack surfaces can be digital or physical, and these could range from the network to endpoint devices. Digital or network threat attack surfaces can also include the vulnerabilities found in your connected hardware and software environment. In order to keep the network secure, administrators have to proactively try and reduce the total number and size of attack surfaces. The more code, applications, or devices running on a system, the greater the chance of vulnerabilities that can be exploited. Thus, reducing the amount of the total number of these things is one of the most critical steps to minimize the attack surface.

With remote workforce deployments, have cybersecurity challenges been on the rise?

Prasoon: We can’t deny that online work increases cyber security risks. The fact is that without the security ring of protection that office systems afford us – such as firewalls and blacklisted IP addresses – and increased reliance on technology, we are far more vulnerable to cyber-attacks. Since most of our tasks are conducted online, it enhances the risk. After all, if something’s on the Internet, then there’s always the possibility of a cyber-criminal compromising it. They might attempt to do this by cracking your password. This could be easier than ever if you’re reusing login credentials for the various online apps you need to stay in touch with your team. Strangely and unfortunately, many business owners still don’t seem to understand the requirements for a robust remote access policy. Access needs and practices are changing among all workers, not just remote employees, and professional guidance is becoming essential to prevent serious problems like identity theft, data breaches and data loss. IT and cybersecurity professionals can evaluate the security risks companies face and develop customized protocols to minimize these risks, but 44% of companies aren’t taking help of cybersecurity professionals.

Therefore, it is quite possible that many Business leaders may miss important insights into potential vulnerabilities and fail to implement proper protection for remote workers. Hence the concept of Identity Access Management, Privilege Access Management and Secure Digital Identity to the core transactional systems is paramount.

What are the common cybersecurity challenges that you take care of as a IT security manager/ CISO? From ransomware to insider threat challenges, discuss what issues keep you awake the most and your key priorities for the year ahead?

Dr. Mohammad: CISOs are constantly combating several challenges as the below listed: • THREAT MANAGEMENT: Threat detection, protection and

Dr. Mohammad Khaled

Cybersecurity and digital transformation Expert remediation services to fight cyber crimes • VULNERABILITY MANAGEMENT: Scanning, testing and remediating application, database and network vulnerabilities to protect your data • COMPLIANCE MANAGEMENT: Setup industry's security best practices and reduce risk for your organization • SECURITY INFRASTRUCTURE: Establishing, commencing and managing security infrastructure for your organization • FRAUD INVESTIGATION: Gathering evidence into successful security breaches and identify gaps in security • IT SECURITY TRAINING: Building capability to prevent, and respond to security threats on your organization Some of the top cybersecurity challenges to address are Remote Worker Endpoint Security, increased Phishing Attacks, Deepfakes, vulnerabilities of IoT Devices, Malvertising, Fileless Attacks and Living Off the Land, sophisticated and targeted Ransomware Attacks as well as social Media-Based Attacks.

Elaborate the requirements for enhancing security with cloud adoption?

Dr. Mohammad: As customers transition their applications and data to cloud computing, it is critical for them to maintain or exceed the level of security and privacy protection they had in their traditional IT environment. Hence there is a prescriptive series of steps for cloud service customers to evaluate and manage the security and privacy of their use of cloud services, with the goal of mitigating risk and delivering an appropriate level of support.

MARCH 2021 / CXO DX

23

» INTERVIEW These steps could be as below • Ensure effective governance, risk and compliance processes exist • Audit operational and business processes • Manage people, roles and identities • Ensure proper protection of data and information • Enforce privacy policies • Assess the security provisions for cloud applications • Ensure cloud networks and connections are secure • Evaluate security controls on physical infrastructure and facilities • Manage security terms in the cloud service agreement Understand the security requirements of the exit process Each step takes into account the realities of today’s cloud computing landscape and postulates how this space is likely to evolve in the future, including the important role that standards will play.

What are the key decision making aspects in your role as the IT security head/ CISO? Dr. Mohammad: For a CISO, decision-making in the context of organizational information security is highly dependent on various types of information. For information security managers, not only relevant information has to be clarified but also their interdependencies have to be taken into account. These factors can be broadly into these areas: physical security, vulnerability, infrastructure, awareness, access control, risk, resources, organizational factors, continuity, security management, compliance & policy for informed decision making raising the bar for overall Enterprise Security Architecture of the organization.

What do you think of approaches that are becoming more popular now like the zero trust model? Would that be something you will advise for organizations to implement?

Prasoon: Zero Trust is an information security framework that states organizations should not trust any entity inside or outside of their network perimeter at any time. It provides the visibility and IT controls needed to secure, manage, and monitor every device, user, app, and network belonging to or being used by the organization and its employees and contractors to access business data.

Implementing a Zero Trust security model in an organization is not simply a change in mindset. It will require a clear view of functions within the company’s departments, currently-deployed software, access levels, and devices, and what each of those requirements will look like in the future. Often, building a Zero Trust network from the ground up is easier than reorganizing an existing network into Zero Trust because the existing network will need to remain functional throughout the transition period. In scenarios, IT and security teams should come up with an agreed-upon strategy that includes the ideal final infrastructure and a step-by-step strategy on how to get there.

Here are four pillars of Zero Trust that we believe organizations should embrace: • Strong user identification and access policies

24

CXO DX / MARCH 2021

Kumar Prasoon

CIO and COO, Cirrus1

" The fact is that without the security ring of protection that office systems afford us – such as firewalls and blacklisted IP addresses – and increased reliance on technology, we are far more vulnerable to cyber-attacks.."

• Segmentation of data and resources • Strong data security in storage and transfer • Security orchestration With edge computing and IoT deployments, do you see the threat factor further increase?

Prasoon: IoT devices with Edge Computing are rapidly becoming ubiquitous while IoT services are becoming pervasive. Along with their success, the number of threats and attacks against IoT devices and services are on the increase as well. As IoT will be deeply interwoven in our lives and societies, it is necessary to step up and take cyber defense seriously. Hence, there is a real need to secure IoT, which has consequently resulted in a need to comprehensively understand the threats and attacks on IoT infrastructure.

3 1 M AY 2 JUNE 2021 DUBAI WORLD TRADE CENTRE

THE MOST INFLUENTIAL AND CONNECTED

CYBERSECURITY EVENT FOR THE ARAB WORLD

ENQUIRE ABOUT EXHIBITING, SPEAKING AND SPONSORSHIP +971 (04) 308 6267

O F F I C I A L LY S U P P O R T E D B Y

S I LV E R S P O N S O R S

gisec@dwtc.com

www.gisec.ae

OFFICIAL DISTRIBUTION PA RT N E R

S T R AT E G I C S P O N S O R S

C O U N T R Y PAV I L I O N S

» INSIGHT

SECURING A

DISTRIBUTED WORKFORCE Jonathan Nguyen-Duy, Vice President, Global Field CISO Team at Fortinet discusses the Best Practices for Securing a Distributed Workforce Long-term

I

n times like these, it's tempting for IT teams and company leadership to get caught up in the latest developments or next month's trends, especially when it comes to how and where work is done. But organizations that develop a long-term strategy for all scenarios—extended work-from-home, return to the office or hybrid models of any flavor—will come out stronger than ever after the pandemic.

Any provider worth your investment should be able to ensure adaptability no matter your circumstances or how much

26

CXO DX / MARCH 2021

or how often your plans may change. They should be able to support you whether a full return to office culture is imminent or majority-work-from-home is anticipated – or any combination in between. Perhaps most importantly, they should be able to do it all securely.

A Hybrid Workforce Model

For many businesses around the world, there’s been no hard-and-fast decision on whether or when the majority of employees will return to an in-person office setting. Companies are hearing a variety of concerns from workers about returning

too quickly to pre-pandemic working conditions.

Overall, employees seem to prefer remote work – a new report from Pew Research found that about half of those surveyed would like to stay remote, at least parttime, even after the pandemic. Analysts at Global Workplace Analytics forecast that 25-30% of the workforce will be working multiple days at home per week by the end of 2021.

Because the work forecast is so murky, it’s difficult for IT teams to figure out whether

» INSIGHT they should be preparing for a mass return to the office or maintain a permanent hybrid model. And network flexibility is the least of their concerns. Security needs in particular have had to shift rapidly to accommodate WFH scenarios, and traditional security solutions require a significant amount of heavy lifting to shift between different business models.

Now, IT leadership and their teams have been tasked with planning for the next 12 to 24 months based on a range of potential in-person and work-from-home scenarios, the balance of each depending on geography, capacity, public infrastructure and many other variables.

Adaptability is the Name of the Game

The reality that businesses should prepare for is that there will be no “one size fits all” approach moving forward – even businesses that return to a majority of in-person work may still have some people working remotely, either on a longterm or short-term basis. So, organizations need to have a security solution that can fit any of these approaches – one that can adapt to any type of hybrid work model.

For providers, there is no longer a choice between being the best option for a largely remote workforce and being the best option for a mainly in-office scenario. Rather, the ability to flexibly but securely address all scenarios is the name of the game. The smartest providers are already using this historic period as an opportunity to invest in innovation, including in advanced technologies like SD-WAN to not just support traditional branch offices, but to enable the home office as the new branch.

The key to making the right investments is thinking about security and networking as a converged solution, rather than as discrete elements. So, how can you accomplish this?

Best Practices for Adaptability and Convergence

Organizations need to look for a solution that brings security and networking together. This convergence across the connected environment—from the core to the branch to data centers to the cloud—enables organizations to effectively see and defend to-

Jonathan Nguyen-Duy

Vice President, Global Field CISO Team, Fortinet

day's highly dynamic environments. At the same time, it preserves an excellent user experience for employees and customers, keeping them engaged and resilient.

Ask the hard questions of your current or prospective provider. Find out if they are able to: • Support zero trust network access for secure remote access • Monitor on-network and off-network endpoint behavior for continuous protection • Support Secure SD-WAN to optimize WAN performance These are foundational as organizations become more distributed and virtualized.

It will be important to consider how to provide on and off-network security when access is needed for remote workers, traveling employees, partners, IoT and other edge computing devices, as well as branch offices and traditional enterprise locations.

If their answers do not demonstrate proven capabilities, move on.

Meeting the Needs of Remote Work

With different rules for each country and

state – sometimes for each county – and ongoing pandemic highs and lows, trying to sort out the best work arrangements and network configuration for an organization has proven difficult. Many employees are skittish about returning to the office, and about half of remote workers would like to keep this arrangement. And it’s not just more users requesting access outside the traditional perimeter. Indeed, the new normal is characterized by a much more distributed and disaggregated enterprise ecosystem. This not only expands the perimeter but permanently changes enterprise networking, requiring a stronger focus on broad, integrated and automated solutions.

Going forward, organizations of all sizes will be focused on delivering business outcomes and end user experiences. This means success is defined by optimal network and security performance – working as an integrated solution. This leads to a situation in which networking and security must converge in order to deliver the needed performance for a much more distributed enterprise – across the LAN, WAN and cloud edges. The best practices outlined in this piece can help frame your organization’s decisions as it adapts to any number of challenges.a MARCH 2021 / CXO DX

27

» INSIGHT

5

STEPS TO SAFELY REOPEN OFFICES

As employers across the region continue to reopen their doors, how can they rebuild a safe and compliant workspace in the coming months? Sameer Makhija, Business Development Director, Asset Management Solutions, IMEA, Infor shares his perspectives

O

perating a clean and safe work environment is no longer just an important part of asset maintenance. Now it’s a critical requirement for getting the world back to work.

In our new normal, organizations across the globe will be required to not only improve cleaning and hygiene practices, but to prove in an audit that they have followed these practices in a timely, prescribed manner.

Here’s five key areas employers must consider in order to safely open for business and ensure operational continuity.

28

CXO DX / MARCH 2021

Consideration #1: Clean operation by employees

It’s not enough to publish protocols for frontline workers in industries such as healthcare. All employees in every industry will be subject to new guidelines about keeping the physical environment safe. Everyone from field technicians and custodians to storeroom clerks and facilities administrators will need to adopt new ways of working.

Voluntary guidelines have been issued by national and global organizations that address protective equipment, physical distancing, equipment sharing, and more. But employers will need to create and enforce their own required standards to protect the health of workers and guard against risk to the organization.

A company’s asset management system can track training, certification, and field checks. It can help ensure that employees are scheduled based not only on the required skills for the task but also on their current status with respect to certification in safe and clean protocols. The asset management solution can even help eliminate business disruptions, especially when deployed in the cloud.

Consideration #2: Updating preventive maintenance schedules

Protocols to ensure a clean and safe work environment are built on preventive maintenance schedules. So it’s important that these

» INSIGHT schedules have been updated to reflect new and quickly changing requirements.

For example, the American Society of Heating, Refrigerating and Air-Conditioning Engineers (ASHRAE) has issued new guidelines for flushing heating, ventilation, and air conditioning (HVAC) systems pre- and post occupancy, including operating exhaust fans and opening air dampers or windows; disinfecting high-touch areas; and having a water management plan to decrease the risk of bacteria growth in buildings that have been closed or had limited operations.

Once guidelines have been adopted, an organization will need to determine the correct frequency of cleaning tasks and the best way to train employees to comply. The proper use and disposal of protective gear, the use of required disinfectants, and how to maintain distance in tight quarters are just some of the topics you might need to address.

Consideration #3: Identifying assets at risk

Figuring out how to get back to business in the face of new safety and hygiene protocols could feel overwhelming. Where do you begin?

Understanding which physical assets are most critical to an operation, and therefore pose the greatest risks to business continuity, is the first step. Even under normal circumstances, assets should be assigned a criticality ranking based on the impact they would have on a company’s mission if they were to fail. Related factors to consider, depending on industry, user safety, customer satisfaction, environmental impact, compliance with government and local regulations, and maintaining profit margins.

Consideration #4: Be ready for changing expectations

More oversight will be a given as the world goes back to work.

Strengthening internal risk management will ensure an organization is audit ready.

Pwc notes: ‘In these challenging times, internal audit executives have both an obligation and an opportunity to help their companies manage the most critical risks COVID-19 has either created or magnified.”

KPMG writes that the internal audit team should discuss priorities and actions with the management team daily; increase focus on high-risk areas; and “be the eyes on the ground” while leaders are consumed with keeping the business running, among other recommendations.

Having real-time reports and data on safety and cleaning adherence is imperative, and these reports should include: • Procedures in place • Implementation timelines and real-time reports of adherence • Records of staff trainings and certifications • Hazardous materials and activities, and how those are being mitigated and avoided Being ready for change means proactively identifying and addressing areas of risk and going beyond suggested guidelines to

Sameer Makhija

Business Development Director, Asset Management Solutions, IMEA, Infor

a set of procedures that will ensure the continuity of operations.

Consideration #5: Move from preventive to prescriptive maintenance

Everyone wants to get back to normal business. But should it be business as usual?

Asset management and maintenance activities will be at the center of new requirements for making the workplace safe. Many are probably already employing some form of predictive maintenance, which uses data collected from equipment sensors to understand operational condition and predict when failure could occur.

But many could do even better than that. And if ever there was a time to have the greatest visibility into how things are working and how they can work better, this is it.

Prescriptive maintenance, also known as RxM, can not only predict failure, but also recommend next steps. While predictive maintenance can highlight how long much time there is until an asset fails, prescriptive maintenance will help figure out how operating the equipment under different scenarios could extend the time before failure. Predictive maintenance gives the raw data to make decisions, while RxM provides different possible solutions, backed by data. With RxM, one can weigh different simulations without having to experiment with each one in real life.

MARCH 2021 / CXO DX

29

» INSIGHT

WHY MOST AI PROJECTS FAIL

Anas A. Abdul-Haiy, Director and Deputy CEO of Proven Consult says that while premature failure of AI projects is a common concern, developing strategy and approach can set companies on the right path

Verticals determining the success of any project vary even within the same field, or even within the very same project down the timeline. This is the case especially in AI, a relatively new field fueling business worldwide and shifting the attention of investors to more technologically powered, sustainable and cost-effective solutions. AI is a business superpower on the rise; the Kingdom of Saudi Arabia hosted the Global AI Summit in October 2020, where an elaborate, market-wide AI strategy was revealed. The strategy aims to train up to 20,000 data and AI experts and set up 300 AI-focused startups. This is predicted to generate up to $20 billion in investment by the year 2030.

If AI can be used to develop whole nations, it’s then a tool to shift the way the world works, and a lot of decision makers are noticing this as more than a trend, but also as a gateway into a healthier, more sustainable future.

30

CXO DX / MARCH 2021

» INSIGHT The enthusiasm to jump on the AI train is understandable and encouraged, but the success of AI depends on the complete universe of data being captured and analyzed through a large-scale database with continuous analysis of the convergence between predictive and real time data. Premature failure of AI projects is a common concern, and one that is legitimate; recent numbers show 85% of all AI projects fail, sometimes before they have even been initiated—Why? Well, oftentimes, these big projects are misaligned with business priorities. Especially today, a lot of businesses are invested in keeping their traditional processes going, so embarking on such an altering project is not likely to make the top priorities list.

AI is expensive. Spending on AI projects and solutions will hit the $58 billion mark within the next few years. Many companies tend to take a leap into a sea of information on the matter and end up with one takeaway: AI helps cut cost. While this is true, the results take time, effort and skills. From partnering with the right solution providers, to hiring the perfect candidates to administer AI projects. A lot of companies will initiate and then withdraw when the costs are fully evaluated in comparison to the results.

This is why strategizing AI projects is essential to success, but still does not guarantee it.

While strategy is a vertical in business generally, in AI-focused projects, it’s simply not enough. Financial strategy without expertise is like throwing money on a problem; it simply won’t work.

AI is new. This means there is a lack of the proper skills in the market. For reasons like this, governments are turning to training programs, pumping capital into developing a solid generation of skilled AI engineers, scientists, and businesspersons. This relatively new field makes investment tricky also because there isn’t enough history behind it. In a way, it’s an age of trial and error, and error often means massive losses and premature failure. This happens a lot; a lot of AI projects start big, with ambition and hope backing up high-complexity work.

This relates to the way AI is described as risky business. It’s considered an expensive tool that is hard to measure and maintain.

However, developing strategy and approach can set companies on the right path. It must always start with a problem the business is facing, and a question; ‘Can AI solve it?’ A strategy can then be designed and set, with proper and regular measuring of ROI. There is more to this, however. Part of why AI is often met with dissatisfaction, contributing to many businesses choosing safer options, is the ambiguity and myth surrounding it. For the longest time, it seemed like this technological leap was a thing for film and literature. When investors go into AI, they have a hard time managing and adjusting their expectations. Businesses investing massive efforts and capital in AI often focus on the technology instead of the business. AI adoption must be a step-by-step process, starting with why the business needs it, and how it can help. AI can, for example accurately predict valuable information based on data, but it cannot function as intricately as the human brain.

The way an AI solution will work for a business is through data, and the quality of data it is fed with. This poses another threat to AI projects, and is considered a major contributing factor in their failure. The term ‘Big Data’ came about as tech giants started tak-

Anas A. Abdul-Haiy Director & Deputy CEO, Proven Consult

" A lot of companies will initiate and then withdraw when the costs are fully evaluated in comparison to the results.

This is why strategizing AI projects is essential to success, but still does not guarantee it." ing over the global business sphere. The concept is quite enigmatic, because ‘how big is big,’ one might ask. Well, really big. AI requires a lot of data in order to deliver, and the more the better.

If a company is small, with not much data to go from, then expectations must be scaled to that level of data availability. The data must also be relevant to the problem the AI solution is designed to solve, and oftentimes such intricacies aren’t even considered.

AI is risky, but the rewards can bring cost-cutting and long-term success to business. It is most crucial to consider data quality and availability when AI adoption is on the table. Strategy, success and failure measurement criteria are also determining steps in the adoption process. Meanwhile, globally, the direction business is going towards is one that should solve the issue of low skill levels and expertise in the field.

MARCH 2021 / CXO DX

31

» INSIGHT

How to prevent the rising number of DDoS Attacks

Amr Alashaal, Regional Vice President - Middle East at A10 Networks shares insights about defending against the increasing DDoS Attacks in the light of COVID-19 and 5G

C

ybercriminals had a busy year in 2020, with rapidly increasing numbers of distributed denial of service (DDoS) weapons, widespread botnet activity, and some of the largest DDoS attacks ever recorded. As COVID-19 drove an urgent shift online for everything from education and healthcare, to consumer shopping, to office work, hackers had more targets available than ever—many of them under protected due to the difficulty of maintaining security best practices in an emergency scenario. At the same time, the ongoing rollout of 5G technologies has accelerated the proliferation of IoT and smart devices around the world, making unsuspecting new recruits available for botnet armies to launch crushing attacks on a massive scale.

In our ongoing tracking of DDoS attacks, DDoS attack methods, and malware activity, A10 Networks has observed a steady increase in the frequency, intensity, and sophistication of these threats, most recently in our State of DDoS Weapons Report for H2 2020, which covers the second half of the past year. During

32

CXO DX / MARCH 2021

this period, we saw an increase of over 12 percent in the number of potential DDoS weapons available on the internet, with a total of approximately 12.5 million weapons detected. The good news is that proven methods of protection continue to be effective even as threat levels rise. In this article, we’ll talk about recent trends in DDoS activity and how to defend your organization against this common and highly damaging type of attack.

Botnets drive DDoS attack levels to new heights While organizations of all sizes fell victim to DDoS last year, two of the world’s largest companies made headlines for suffering unprecedented attacks. In June 2020, Amazon revealed a DDoS attack on its public cloud earlier that year that peaked at 2.3 Tbps, almost twice the size of the previous largest recorded attack. Soon afterwards, Google revealed details of an even larger DDoS attack that peaked at 2.5 Tbps. A10 Networks has also been privately notified of even larger attacks, underscoring the perennial threat and growing impact of this type of cybercrime.

» INSIGHT Unlike other types of cyberattacks that depend on concealment, DDoS attacks aim to simply overwhelm an organization’s defenses with a massive flood of service requests delivered from a large number of sources. The distributed nature of the attack makes it especially difficult to repel, as the victim can’t simply block requests from a single illicit source.

In recent years, hackers have evolved their methods and broadened their base of attack by using malware to hijack vulnerable compute nodes such as computers, servers, routers, cameras, and other IoT devices and recruit them as bots. Assembled into botnet armies under the attacker’s control, these weapons make it possible for attacks to be sourced from different locations across the globe to suit the attacker’s needs. In the second half of 2020, the top locations where botnet agents were detected include India, Egypt, and China, which together accounted for approximately three-quarters of the total. Activity sourced from DDoS-enabled bots in India spiked in September 2020, with more than 130,000 unique IP addresses showing behavior associated with the Mirai malware strain. A10’s most recent State of DDoS Weapons Report explores our findings about the largest contributor to this botnet activity, a major cable broadband provider, which accounted for more than 200,000 unique sources of Mirai-like behavior.

Blocking botnet recruiters The identification of IP addresses associated with DDoS attacks gives organizations a way to defend their systems against questionable activity and potential threats. To protect services, users, and customers from impending DDoS attacks, companies should block traffic from possibly compromised IP addresses unless it is essential for the business, or to rate-limit it until the issue is resolved. Automated traffic baselining, artificial intelligence (AI), and machine learning (ML) techniques can help security teams recognize and deal with zero-day attacks more quickly by recognizing anomalous behavior compared with historical norms.

Another important step is to make sure that your organization’s own devices are not being recruited as bots. All IoT devices should be updated to the latest version to alleviate infection by malware.

To detect any pre-existing infections, monitor for unrecognized outbound connections from these devices, and check whether BitTorrent has ever been seen sourced or destined to these devices, which can be a sign of infection. Outbound connections should be blocked as well. This will prevent the device from making the call required for the installation of malware such as mozi.m or mozi.a as part of the bot recruitment process.

Amplification attacks and how to prevent them The scope of a DDoS attack can be vastly expanded through amplification, a technique that exploits the connectionless nature of the UDP protocol. The attacker spoofs the victim’s IP address and uses it to send numerous small requests to internet-exposed servers. Servers configured to answer unauthenticated requests, and running applications or protocols with amplification capabilities,

Amr Alashaal Regional Vice President - Middle East, A10 Networks

will then generate a response many times larger than the size of each request, generating an overwhelming volume of traffic that can devastate the victim’s systems. Capable of leveraging millions of exposed DNS, NTP, SSDP, SNMP, and CLDAP UDPbased services, amplification reflection attacks have resulted in record-breaking volumetric attacks and account for the majority of DDoS attacks.

The SSDP protocol, with more than 2.5 million unique systems, led the list of amplification attack weapons exposed to the internet in 2020. With an amplification factor of over 30x, SSDP is considered one of the most potent DDoS weapons. The most straightforward blanket protection against such attacks is to simply block port 1900 traffic sourced from the internet unless there is a specific use case for SSDP usage across the internet. Blocking SSDP traffic from specific geo-locations where a high-level botnet activity has been detected can also be effective for more surgical protection.

As recent trends make clear, the DDoS threat will only continue to grow as rising online activity across sectors, a rapidly expanding universe of IoT devices, and increasingly sophisticated methods offer new opportunities for cybercriminals. Organizations should take an active approach to defense by closing unnecessary ports, using AI and ML to monitor for signs of compromise or attack and blocking traffic from IP addresses known to have exhibited illicit behavior.

MARCH 2021 / CXO DX

33

» INSIGHT

DUTY OF CARE: WHY IT’S VITAL FOR TRAVEL UNCERTAINTY

Emma Shakespeare, MENA South Director at SAP Concur writes that the pandemic has been the catalyst for introducing robust duty of care and safety measures into businesses’ corporate travel programmes Business travel has come to a halt during the COVID-19 pandemic, as stay-at-home restrictions have required companies to hold more virtual meetings. While the outbreak is not yet over, experts have started to project a rebound for corporate travel.

As travel begins to resume, the prospect of taking a business trip has become a daunting task for many travellers whose main worry remains to stay safe.

While the duty of care has always been high on corporate agendas for many travel managers, the crisis has put it squarely at the top, forcing them to rethink the way they support travellers away from the office environment.

can meet their duty of care obligations for their employees and customers.

Use new tools for the return to travel

From disparate bookings to flight delays, a business trip had the potential of being complicated even before our 2020 health and safety challenges. Employees have never been keen to deal with any added stress and want to feel safe while doing their jobs.

Since safety has become a moving target, businesses now need to adapt and to move with it — which means they also need to change.

Our extraordinary times hit business travel harder than anything anyone has ever experienced before. But out of adversity comes opportunity. The pandemic has been the catalyst for introducing robust duty of care and safety measures into businesses’ corporate travel programmes, which will ultimately benefit their travelling employees' wellbeing in the long term.

A recent survey commissioned by SAP Concur found that 96% of business travellers identified at least one measure they consider to be critical for their company to implement when travel resumes, and 18% say they’ll look for a new role, inside or outside the company, that does not require travel if measures aren’t implemented. Despite that, travellers ranked “excitement” second when asked about feelings on a return to travel, showing there is still appetite for travelling – if it’s done safely.

So, as companies begin to plot the course ahead, businesses need to re-look at their current travel practices and evaluate how they

As a result, businesses need to look at new tools and practices they can implement to help navigate the ‘new normal’ of trav-

34

CXO DX / MARCH 2021

» INSIGHT el. First, businesses should consider referencing the latest public health and safety advisories, travel provider cancellation policies and new travel guidelines from their local governments.

Additionally, there are new features in the TripIt Pro app available to travellers which allow them to access Neighbourhood Safety Scores’ — which surfaces safety scores from 1 to 100 for neighbourhoods around the world, representing low to high risk. Whether travelling for business or leisure, such technology can help raise safety awareness that’s granular to the neighbourhood a person is visiting. This technology also evaluates risk rates specific to women, the LGBTQ community and theft rates among other options, providing a robust and timely understanding of local safety.

It also provides the latest COVID-19 information for all destinations that travellers visit. This includes current infection rates, quarantine rules upon arrival, testing requirements, and other information passengers need to know before visiting the area, helping them to stay as informed as possible.

Build safety into the pre-trip plan

Organisations cannot afford to be negligent with the safety and security of their travellers and employees in today’s global landscape. It’s imperative to implement a travel risk management programme or to re-evaluate the existing one to determine that travel managers will be able to monitor, locate, and communicate to all employees on the move and fulfil their duty of care obligation if a crisis arises.

While technology tools can certainly help us plan a trip more safely, it’s still crucial to provide a clear company policy on the safety measures you will provide to your staff. For instance, with travellers worried about their protection, they need a clear company policy about masks, hand sanitizer and other protection gear, and know whether those costs can be expensed. It is also important to work closely with your employees to provide pre-trip safety reports and other tools to help ease travellers’ concerns about where they’re heading and how they’ll get there.

This can also include providing your team with the tools and information they need to be prepared on the road. This embraces everything from what to do if they get sick, to keeping travel as touchless as possible (contactless payments, automated expense solutions, etc.), to mobile tools that update them on flight changes and the safety of the neighbourhoods they are visiting. By consulting with experts and performing a thorough risk assessment, you can base decisions on fact rather than emotions. The two primary considerations involve the individual travelling and the environment in which they’ll be working.

For instance, in the case of public health events, companies should avoid sending employees who may be at a higher risk of serious illness (e.g. those with pre-existing medical conditions or compromised immune systems). Companies should also consider the possible transport disruptions that may leave your employee temporarily stranded. All duty of care and travel insurance policies now need to be robust in covering the health and safety of all employees.

Emma Shakespeare

MENA South Director, SAP

Additionally, a manager’s duty of care doesn’t end when the trip is over. Neither does the need to stay on top of travel and expenses. Consider policies like a temporary stay-at-home mandate after every trip and a solution to automate expense reports, so employees don’t need to collect and retain receipts.

Changing travel for the future

The coronavirus crisis has accelerated the trend towards smart working by developing virtual-meeting best practices, training, tools and support. By avoiding unnecessary travel and meetings, a smart working approach enables people to make conscious decisions about how they meet and the best way to travel to and from those meetings. If travel is necessary, managers need to now promote decisions that are not only based on cost and value, but the safety and well-being of all those involved.

By adjusting to these new norms, and getting more involved in software deployments, travel managers can ensure their investments continue to pay dividends for the company, their users and the industry they serve.

Above all, for the post-COVID world, employers will need to lead with empathy. Never has it been more important for travel managers to engage with their travellers; listen to them, find out what their worries are and what they need from their travel programme to ensure a high standard of duty of care. make today’s work easier, and support businesses to run at their best. Learn more at concur.com or the SAP Concur blog.

MARCH 2021 / CXO DX

35

» TECHSHOW

HP LATEX 700 AND 800 SERIES LARGE FORMAT PRINT SOLUTIONS HP Inc. has introduced a range of new Latex large format print solutions to help print service providers diversify their offerings and meet more challenging customer needs. After a year of business disruption across the large format industry, the HP Latex 700 and 800 series brings a suite of features that enable PSPs to be more agile, tackle ambitious projects and take on the highest value work. The new portfolio also delivers fast workflows that help businesses hit deadlines, while sharpening their sustainability edge.

The new HP Latex range consists of four devices – the HP Latex 700 and 800, and the HP Latex 700W and 800W which offer white ink capability for the first time in this category. It is the whitest white ink available on the market that does not yellow over time5, enabling print businesses to produce neater outlines and add more contrast to darker supports.

Print jobs executed on the new 700/800 Series will deliver with vivid colors and finer image and text details, even at faster print speeds. Operationally, HP PrintOS also enables PSPs to monitor and control their print fleet using a cloud-based interface they can use virtually anywhere, anytime.

previous HP models.

• Incorporates the latest generation of HP Latex inks, and the whitest white ink available on the market with no yellowing over time • HP Latex 700/800 series allows print service providers (PSPs) to increase productivity by up to 50% versus previous HP models, thanks to faster print capabilities • The use of HP Latex inks and cardboard HP Eco Carton cartridges3 reduces carbon emissions by 60% and plastic usage by 80%4

Key Features: • Updated printheads possessing more nozzles and producing speeds of up to 36 m2/hr (388 ft2/hr) allow the HP Latex 800 and 800W to offer 50% higher productivity levels compared to

TENABLE.EP Tenable.ep is the industry’s first, all-in-one, risk-based vulnerability management platform designed to scale as dynamic compute requirements change. Tenable.ep combines the company’s industry-leading products — Tenable.io Vulnerability Management, Tenable.io Web Application Scanning, Tenable.io Container Security and Tenable Lumin – into one platform, enabling customers to see all of their assets and vulnerabilities in a single dashboard alongside key threat, exploit and prioritization metrics. Moreover, Tenable.ep’s single, flexible asset-based licensing model frees organizations to dynamically allocate licenses across all asset types according to their unique attack surface and modify as their environment changes.

The ability to quickly spin up and connect modern assets to the corporate environment is critical to digital transfor-

36

CXO DX / MARCH 2021

mation and work-from-home initiatives. But cybersecurity pricing models designed for on-premises computing can force enterprises to choose between assessing one asset type over another, frequently charging premiums for assessing cloud assets or web applications. Tenable.ep solves this challenge with a single license that gives customers unrivaled flexibility to take a holistic, rather than piecemeal, approach to vulnerability management. Whether it’s a web application, a cloud instance, a container image, remote worker or a traditional server, each asset counts exactly the same. The platform also includes unlimited deployment of local Nessus and web application scanners at no additional cost.

Key Features • Tenable.ep delivers everything you need for a comprehensive risk-based vulnerability management solution — built-in, integrated and ready to use.

» TECHSHOW

TOSHIBA 18TB MG09 SERIES HARD DISK DRIVES The 18TB MG09 Series HDD are Toshiba’s first HDD models with energy-assisted magnetic recording. The MG09 Series features Toshiba’s third-generation, 9-disk Helium-sealed design and Toshiba’s innovative Flux Control – Microwave Assisted Magnetic Recording (FC-MAMR) technology, to advance Conventional Magnetic Recording (CMR) density to 2TB per disk, achieving a total capacity of 18TB. Sample shipments of 18TB MG09 Series HDD to customers are expected to start sequentially at the end of March 2021.

The MG09 Series further illustrates Toshiba’s commitment to advancing HDD design to meet the evolving needs for storage devices in cloud-scale servers and Object and File storage infrastructure. With its improved power efficiency and 18TB capacity, the MG09 Series helps cloud-scale infrastructure advance storage density to reduce capex and improve TCO (total cost of ownership). As data growth continues at an explosive pace, advanced 18TB MG09 with FC-MAMR technology will help cloud-scale service providers and storage solution designers achieve higher storage densities for cloud, hybrid-cloud and on-premises rack-scale storage.

Key Features:

center use cases.

• With 12.5% more capacity than prior 16TB models, 18TB MG09 CMR drives are compatible with the widest range of applications and operating systems.

• The MG09 features 7,200rpm performance, a 550TB per year workload rating, and a choice of SATA and SAS interfaces—all in a power-efficient Helium-sealed industry-standard, 3.5-inch form factor.

• The MG09 are adapted to mixed random and sequential read and write workloads in both cloud-scale and traditional data

• The 3rd generation 9-disk Helium-sealed design provides a field-tested foundation for achieving a massive 18TB capacity.

• Eliminate blind spots across your entire attack surface, including traditional IT assets, cloud services, operational technologies (OT), modern web apps and your remote workforce.

• By continuously analyzing more than 20 trillion aspects of threat, vulnerability and asset information with machine-learning algorithms, Tenable.ep enables your organization to focus first on the issues that matter most and reduce remediation effort.

Compare cyber exposure between business units or locations internally, and against industry peers externally, to determine where and when to make key human and financial investments.

MARCH 2021 / CXO DX

37

» TRENDS & STATS

CHECK POINT SOFTWARE’S SECURITY REPORT REVEALS EXTENT OF GLOBAL CYBER PANDEMIC Check Point Research (CPR) has published its 2021 Security Report. The report reveals the key attack vectors and techniques observed by CPR researchers as criminal, political and nation-state threat actors exploited the disruption caused by COVID-19 .

Highlights include:

• Cloud adoption races ahead of security: 2020 saw organizations’ digital transformation programs advance by over five years in response to the pandemic, but public cloud security is still a major concern for 75% of enterprises. Also, over 80% of enterprises found their existing security tools don’t work at all or have only limited functions in the cloud.

• Remote working is targeted: hackers ramped up ‘thread hijacking’ attacks on remote workers to steal data or infiltrate networks using the Emotet and Qbot trojans, which impacted 24% of organizations globally. Attacks against remote access systems such as RDP and VPN also increased sharply.

• Double-extortion ransomware attacks rise: in Q3 2020, nearly half of all ransomware incidents involved the threat of releasing data stolen from the target organization. On average, a new organization becomes a victim of ransomware every 10 seconds.

• Attacks on healthcare sector become an epidemic: in Q4 2020, CPR reported that cyber-attacks (especially ransomware attacks)

on hospitals had increased by 45% worldwide, because criminals believe they are more likely to meet ransom demands due to the pressures from COVID-19 cases.

• Mobiles are moving targets: 46% of organizations had at least one employee download a malicious mobile application, which threatens their networks and data in 2020.

LOW-CODE DEVELOPMENT TECHNOLOGIES TO GROW 23% Surge in Remote Development Boosted Low-Code Adoption Despite Ongoing Cost Optimization Efforts The worldwide low-code development technologies market is projected to total $13.8 billion in 2021, an increase of 22.6% from 2020, according to the latest forecast by Gartner, Inc. The surge in remote development during the COVID-19 pandemic will continue to boost lowcode adoption, despite ongoing cost optimization efforts.

Low-code as a general social and technological movement is expected to continue growing significantly. For example, lowcode application platforms (LCAP) are expected to remain the largest component of the low-code development technology market through 2022, increasing nearly 30% from 2020 to reach $5.8 billion in 2021 Digital business acceleration is putting pressure on IT leaders to dramatically increase application delivery speed and Time to Value. The increased demand

38

CXO DX / MARCH 2021

for custom software solutions in support of digital transformation has sparked the emergence of citizen developers outside of IT, which, in turn has influenced the rise in low-code.

Gartner research says, on average, 41% of employees outside of IT – or business technologists – customize or build data or technology solutions. Gartner predicts that half of all new low-code clients will come

from business buyers that are outside the IT organization by year-end 2025, too.

All of the major SaaS vendors currently provide capabilities that incorporate lowcode development technologies. As SaaS grows in popularity, and these vendors’ platforms are increasingly adopted, the low-code market will see commensurate growth in LCAPs and process automation tooling.

Low-Code Development Technologies Revenue (Millions of U.S. Dollars) Low-Code Application Platforms (LCAP) Intelligent Business Process Management Suites Multiexperience Development Platforms (MDXP) Robotic Process Automation (RPA) Citizen Automation and Development Platform (CADP) Other Low-Code Development (LCD) Technologies* Overall

2019 3,473.50 2,509.70 1,583.50 1,184.50 341.8 59.6 9,152.60

2020 4,448.20 2,694.90 1,931.00 1,686.00 438.7 73.4 11,272.20

2021 5,751.60 2,891.60 2,326.90 2,187.40 579.5 87.3 13,824.20

*Other LCD technologies include rapid mobile app development (RMAD) tools and rapid application development (RAD) tools. Low-code is the evolution of RAD to cloud and SaaS models.

Source: Gartner (February 2021)