Cloud Security Outlook 2023 – Subhalakshmi Ganapathy, ManageEngine

This is texturing TV. Hey everyone, welcome back to techstrunk TV. Our next guest is from manage engine.

Her name is subhalakshmi ganapathi. I hope I pronounce it right but a super as we will call her Super. What is is that the right pronunciation or maybe you want to say it correctly?

Yes. Yes. You got that right Allen.

How are you doing for the day? I'm doing great. Thank you.

And thanks for being on tech strug TV with us. Thank you. Thank you.

It's my first time with next strong TV and I'm really excited about that. Well, we we're excited to have you here. So subah you're an IT security evangelist with manage engine and you know, what, if you don't mind there are there a lot of folks here in our audience, especially women?

Yes. They was International women's day right who are saying man. I how did someone what kind of skill set.

We're kind of career path to someone follow that, you know have a position such as that if you wouldn't mind for the benefit of women out there and not just women everyone out there. Give us a little bit of your background. Yeah once again for the audience, I'm super Empathy and I'm an IT security evangelist at manage engine.

I started my career at managing engine about the decade ago. It's been like 10 long years that marriage in jail. My role is to understand the cybersecurity market, you know, it's very Dynamic and evolving.

So we keep track of the changes that the market undergoes and also to help our product management team to reshape the Solutions in accordance to the market needs and I also like often meet prospects and our customers and help them to attract and optimize their security operations. excellent and you know super a lot of people have heard of manage engine. It has been around a long time.

You've been there 10 years, but they may not really understand what manage engine does. If you wouldn't mind giving us maybe a little background a manage engine. Sure.

manage engine is the IP management division of Zoho Corporation and we have been in the market for around 20 years catering to the ideal operations it security and services management needs of Enterprises. So 19 and 10 1400 companies use manage and products and we have our customers as major Banks of financial institutions government organizations manufacturing Industries and Healthcare. We have like a wide range of customers across all Industries and across the globe and because we are a private company and we have the freedom to invest in technology in Boston R&D and all so in Boston taking our customers to cloud and staying relevant all through their Journey, you know, that's that's been our track record for the past 20 years and it's continuing now.

Actually, that's great to know. All right, now that we've got that out of the way super lettuce. Shift gears manage engine recently released the findings of a report.

They're 20, I believe it's the 2023 Cloud security. Yes, what is that? Correct?

Yes, it's Cloud. Security Trends or Outlook 2023. Fantastic share with us.

If you will what you think some of the well, let's do maybe a little background on the report, you know how it was done and then maybe some of the key findings. All right. So it all started, you know, like the pandemic he does a couple of years back and there was a drastic change in the way.

We adopt Technologies, especially there was a search to Cloud adoption. So we wanted to understand how the market perceived Cloud security because it was a sudden shift a sudden shift all of us when home and we wanted to like, you know, make our work easier working from home and the cloud was one of the resort where we could access the resources in in an easy manner. So people or the Enterprise shifted to cloud and we wanted to understand how the adopted the security strategy for cloud is they're all in place and all that.

So that's how we keep started this research and we did this research across like find red plus ID Professionals in the US and again, it's across all the industries like banking Healthcare Financial. And Manufacturing an IT industry. So we and predominantly the survey wanted to understand the Enterprises adoption to Cloud Security Solutions.

What are their pain points with respect to Cloud security? Is that compliance? Is that a threat detection and Remediation is that like the shortage of Staff or a challenge in their security Operation Center?

What is causing the most impact in the cloud security and we also discuss their budgeting and going forward how they would like prioritize their security or especially Cloud security how they will allocate the budget for all of these. excellent Okay, and you know it. In this year more probably than other years.

I think there's a greater. Greater chance of change right because quite frankly the last few years just haven't been normal with all of the work from home as you cited and and everything, you know that goes with that. So I would imagine that we see more volatility in you know, if we looked out over years, but if you don't mind let's let's share some of the big results from this from the report if you get All right.

So we segmented our survey into three parts one was predominantly dealing with the threat remediation and we wanted to understand how Cloud security threats have been evolving over the period especially after the pandemic, you know, like the misconfigurations and of the unknot raise taxes were topping the list in terms of the cloud security threat actors. So we wanted to understand more and to our like surprises more than you know, 38 percentage of a respondents actually said that account compromises and I'm not raised taxes from the external network is the most impactful threats and Cloud security. So the misconfiguration came towards the end and the identity basic security threats tops the list.

So that was one of the major really factor for our you know, the Soviet findings And then we all know that the compliance is really complex and meeting them continuously year on year doing a regular reports auditing. It's very taxing. It's very, you know, like very challenging we knew that and our survey actually validated this point because the most half of the respondents who took the survey felt that complaints has been extremely challenging and they felt that because they didn't have a Consolidated solution where they can actually look into all the security data points that's happening in the network.

Especially most the pandemic. It's not one single Network that just within the perimeter. It's going to be either Cloud.

If it's Cloud it's going to be multiclon and ronment if it's going to be cloud and the network it's going to be the hybrid environment. So getting visibility into all the data points all the security data points across the different. Lectures was a major reason for the complaints of challenge or meeting the complex.

That was really challenging and the third point would be the shortage of sauce. We all knew that the cyber security Market is always under the widen have widen. Skill Gap, right?

So One, I mean like most of the Enterprises that took the surveys stated that they have only three staff to manage their threat to manage their complaints to do their security auditing to do their the regular security hardening and keeping up with the basic security hygiene. It's like really too much. It's it causes them a lot of overworking overloading and frustration and they find it really complex dealing with multiple tools and this shortage of soc professionals or security operations center professionals is going to have a serious impact going forward because we have economic uncertainty.

We have cost cut down we have to you know, balance the technology and tool with the limited stuff. So that's going to be the huge constraint going forward at least for a couple of years from now on no doubt. No doubt about that.

Should any other? Kind of findings that you'd think of interest to the audience. All right.

Yes of a remember. I mentioned about compliance and a couple of years background like 2017-16. The gdpr was introduced in the EU and that was the first time after long years and new complaints came up with spoke about data privacy.

And the way the Enterprises handle and process the data and the rights of the end users to have access to the data and I must say that the gdpr pay way to so many compliances then came the protection of personal information act in South Africa and California consumer privacy relation in California. And for more states in the US are planning to adopt new compliance in 2023 super you right compliance I think is a big thing as you mentioned four states in the US have some new. Privacy bills or laws coming into effect, but I think that's too big things in compliance for 2023.

We need to watch for number one the EU Dora. I don't know if you've heard of this yet the Dora regulations coming in and there's also a bill in the US Congress with bipartisan support both parties support. for a us-wide national privacy law, which you know will be.

Let's say a next-gen gdpr which you know, if that goes if that passes and it it's past committee already. It's in Congress. Will have a major effect.

So I I agree with you. I think compliance in 2023 2024 onward is gonna continue being a major. A focus for for security in the cloud and security all over right because whenever you have new laws this sort of a settling in Period where people kind of understand what what it really is what you have to do.

What's right, what's wrong what's compliant? What's not and that, you know, that's always a sort of unsettled time if you will, right? That's true.

That's true. And this gets you know, like challenging when it comes to Cloud because there is a shared responsibility of security between the vendors and all the Enterprises clients. And if they have multi-clouds there will be different vendors and it's going to be really challenging managing all the business data with responsible for what and who has to meet the complaints requirements when it comes to you know securing the resources the data there.

So that's going to take a longer time in cloud and understanding the compliances understanding what they have to do in order to be compliance will take a little bit longer time when it comes to love. Agreed I agree. So but let me ask you something else, you know, we do a lot of interviews like this about reports Surveys Etc.

Was there anything that you found that was surprising to you that you kind of shook your head and said wow, I did not see that coming. All right. Yes.

Oh, especially with respect to Cloud security, right? So For every Enterprise's the first the tops the list is Miss configurations people try to take their network from one promises and deployed in the cloud assets which led to Lord of misconfigurations. I wouldn't say all of those are intentional most of them are unintentional misconfigurations that is due to the lack of awareness or knowledge on how this has to be configured on cloud, but then the attackers or adversaries are looking for such opportunities to actually exploit and misconfiguration attributed to I must say like three out of five because data breaches that was caused in Cloud last year.

But what was surprising with this particular so we finding was that this configurations came and second or third and compromises actually tops the list. So people are worried about how The people's identity is getting stolen or it's being you know, like a contest being overtaken by the adversaries using a lot of fishing campaigns and the ransomware campus but missed configurations. There is only limited actions that the adversaries can do.

But if they once take hold of the user accounts, the possibilities are infinite, they could escalate they could get hold of the resources. They could create a back door. So the impact is going to be a much higher scale than the misconfiguration lifted average.

So the I was very surprised when the market actually is evolving and looking into an identity driven security rather than seeing security is just you know, like all the thing prevention and you know, yeah, no we're making progress. No, no just And I must say that. is where the zena because we understood the importance of identity driven security.

So that was surprising right fantastic super we're almost out of time for people who want to get more information, maybe download the report and read it for themselves. Where do you recommend they go? com where we hosted the reports and they also can find, you know, the capabilities of the solutions listed there Ellen fantastic super.

Thank you so much being so gracious and being our guest here today. Please come back and keep us informed of what's going on and manage engine and your views on the market. It's been a pleasure having you here.

so much Alan for having me and I too. Recently get this name right now. Super Lakshmi gonna puffy it security evangelist manage engine on Tech strong TV.

We're gonna take a break. We'll be right back.