Cyberskilling & awareness should start at school level: Check Point's Venugopal

The fast evolving threat landscape is making organisations around the world re-think their cybersecurity strategy. The growing adoption of digital technologies by organisations at home makes this applicable in the Indian context as well. In a telephonic interaction with Mint, Venugopal N, Director - Security Engineering, Check Point Software Technologies, a cybersecurity company, presses on the importance of upgrading to newer technologies, the role of data protection laws and why employee awareness is critical in the fight against cyberthreats.

Q. Where do enterprises in India stand when it comes to dealing with cyber threats?

Many organizations today are still using technologies that are 10 years old. Around 97% of enterprises are not protected by generation 5 attacks and are still using gen 2 technologies. When there is a huge gap like this it can only be managed by focusing more on prevention rather than detection. The important message here is that if there is a zero day attack, you stop it instead of allowing it inside and compromising the infrastructure. Once breach occurs the damage is already done whether its scale is small or big.

Studies show that many of the cybersecurity solutions operate in isolation leading to delays in threat detection. How true is that and what is the way to deal with it?

There was a time when there were few vendors or technologies for cybersecurity. Today, there are 2,800 vendors offering solutions for cyber security. Of course, it is good because the threat landscape is increasing and getting faster and you need to have new technologies to deal with them. It is true that many organisations adopt multiple solutions and every security vendor has its own policy. This makes managing them a nightmare. We believe that consolidation should happen and whether your data is on premise, network gateway, or data centre, same protection and controls should be there and can be managed from one place. Customers are yet to adopt it, but they are moving towards it.

Don’t you think that allowing use of personal devices for work undermines the cybersecurity efforts of an enterprise? What would be the ideal way to deal with this without restricting their use completely?

We cannot stop an employee form using a personal smartphone or laptop the way digitalization is going on. But yes, it has to be secure as it is also true that 60% of threats are coming from mobile devices. The market is moving towards MDM (mobile device management). Unfortunately, what we are seeing is a selective adoption by customers. Many think that having a better infrastructure, security posture, using MDM to give access only to emails to employees is enough. What is not identified is even with an MDM you are not protecting against the breaches and that is how the infection starts. What many don’t understand is that MDM product should have some basic security features.

How important is awareness among employees and are companies doing enough in this regard?

I think cyberskilling and awareness should start at a school level. Unfortunately that is not happening and 80-90% of the population using smartphones do not understand the consequences of not following the basic cybersecurity practices. Today threats are evolving at larger scale and faster pace. No vendor can claim that their products are 100% secure. We can cope with these threats only by educating ourselves and utilising the product and solution that are ahead and well configured too.

Why is using ML (machine learning) and AI (artificial intelligence) important in cybersecurity?

ML and AI will play an important role as the threat landscape is evolving very fast as cybercriminals are upgrading their skills and tactics. The technology will be utilised by both cybercriminals and security providers. It is like a gun that both good and bad guys are going to use.

How important will be the role of data protection laws in terms of cybersecurity?

I think Europe identified one thing very clearly is that private information of an individual should not be taken advantage for someone's business. These laws have been adopted across the world. Until and unless there is a strict law these violations will occur, which is why India needs strict data protection laws. It should be implemented so it can be executed and action can be taken instead of complicating things. It will make organisations accountable as well.

In addition to providing security solutions, what other role are cybersecurity companies playing?

A few months ago, CheckPoint Research team identified a bug in an LG vacuum cleaner and brought it to LG’s notice. Google identified us as one of the vendors that indentified over 60% of vulnerabilities in Android devices. While we are securing the world by selling solution, sharing the knowledge by identifying breaches and vulnerabilities in platforms accessed by public is also important. We have identified such threats, informed the companies about them, giving them time to fix it before making it public. We have done this with Facebook, WhatsApp and others.