In a digital world, security and connectivity are two sides of the same coin. As remote work becomes a constant, and organisations move their information management systems to the cloud, the need to safely share sensitive information is more relevant than ever before.
The rise of high-profile cyberattacks in the past 18 months – such as SolarWinds, Colonial Pipeline, JBS or Kayesa – have served to illustrate further the need for organisations to be able to secure their information as it is transferred between stakeholders. Over the first half of 2021, Check Points has identified a 93% increase in the frequency of ransomware attacks, compared to the same period last year. As a result, it is no longer enough to secure the place where the information is stored. Now, the whole network needs to be completely protected.
“The notion of connectivity has changed,” says Avinash Prasad, Head of Managed Security Services at Tata Communications. “Pleasure and work are going to be linked as the global internet expands and gets better with 5G and IoT and new technologies. And security needs to be able to cater to that.”
As a company that carries around 30% of the world’s internet routes, network safety is paramount to Tata Communications. The Tata subsidiary provides connectivity to over 190 countries and connects business to 80% of the world’s cloud giants. Prasad’s team is responsible for developing innovative cybersecurity networks that ensure the safety of clients’ connections.
Despite the recent rise in media attention regarding cybersecurity, Prasad stresses that the need for network safety is no greater now than it was a few years ago. Nonetheless, he recognises the effect that highly publicised cases such as the Solarwinds ransomware attack have served to bring these issues to the forefront of the industry debates.
“It’s been a hot topic for much longer than a few months now,” Prasad says. “What tends to happen is that, as the context of the situation changes, it highlights some other new aspect of cybersecurity, that’s something that we have clearly seen. And that happened in the context of the pandemic, and it made enterprises suddenly become elastic to certain forces that earlier, they were not really open to.”
The COVID-19 pandemic and the opening up of the enterprise forced business leaders to rethink their security strategies and adapt them to the cloud and the new ways of working. Remote work blurred the boundaries of a company’s enterprise, which now did not only refer to what was present in the company’s offices but also all the technology used by people in their own homes, all around the world. Companies became more open but also more vulnerable.
Has the number of attacks increased in the last year? To an extent, it has, Prasad says.
“But the attacks were also there earlier for sure, and will continue to be there,” he adds. “Because if there’s something to be gained or an adversary with a certain motive, that will happen, and there are more tools available out there.”
For some time, security was kept close to where sensitive data is. However, now all most of the data is on the cloud, IT systems require more comprehensive security frameworks and tighter verification processes that account for the fact that information is being accessed from many devices and locations.
“From the Tata Communication standpoint, we need to be concerned about the users, we need to be concerned about the devices and we need to be concerned about the connections that are getting established, end-to-end,” Prasad says. “And then we need to think of where the systems are going to live, where the applications are going to live, where the data is going to live.”
Since the onset of the pandemic, Tata Communications has been speaking to customers to understand their main sources of concern in relation to network security. The most common response was, according to Prasad, the fear of the security risks that came with giving employees access to sensitive environments remotely.
“The more advanced the work which is being done by a certain user, the more the potential of damage that could happen because of what they’re doing,” Prasad says.
“When we spoke with these customers, the fact that this is an intelligent, smart, white-collar worker, who now needs to be given access to sensitive environments, and they need to be able to work remotely was a general concern. And how do we partition the fact that they’re using the same network, the same connection, the same device for doing their own personal stuff?”
To fight this, Prasad underlines the importance of taking security down to the level of the devices in order to address the gap created by the blurring of lines between the personal and professional internet spaces. If the devices are left unsecured, they can compromise the security of the whole network. Only then you can ensure full control over the network.
Prasad’s team has enabled a solution that runs a series of checks when a device connects to the company network, allowing employees to terminate a connection at any point when a suspicion of a malicious actor is detected. Moreover, the company has also integrated new perimeter controls so that gateways and doors were much smaller. The goal was to maintain the same type of control and traffic connections that will allow for live inspection, within the new system.
“While the notion is that it’s opening up things for you, and you are moving things out of your own secure perimeter, actually, you can have more controls that support you in terms of your security,” Prasad says. “There are certain parts of our solutions that have been rapidly transforming, not so much by way of technology, but the way they have to be implemented to cater to these kinds of requirements. And that is something that we see happening more and more going forward.”
However, Tata Communications did not only help customers undergo this process of transformation: it underwent one itself. And the best example of this are the company’s Cyber Security Response Centres (CSRC), which provide 24/7 cybersecurity services to clients all over the world. The centres incorporate interactive visual walls, dashboard displays, 3D object recognition and a virtual reality experience to provide a glimpse of the security capabilities that can help organisations build and monitor cyber security platforms, as suited to their business needs.
However, COVID-19 forced the CSRCs to transform themselves, to be able to meet the huge demand for its services, while also ensuring the health of the workers.
“Looking at how to build more capacity in that physical facility, it became much more about how to enable them to be effective and efficient,” Prasad says. “That means ensuring that smooth handoffs are happening between shifts in the virtual world. But I’m happy to say that we were able to keep the lights on playing it at all times, and the CSRCs are still serving all those customers in a redefined model.”
However, at the same time that the pandemic was shifting the way enterprises operate, there is another technology that is transforming telecoms: 5G.
“5G is a story which is not directly connected to the pandemic,” Prasad says. “5G is a much bigger industry shift that is happening gradually in different countries for different services with different providers. But with this current environment that we are living in, the consumption of 5G will be even faster.
“5G can open up environments and improve performance but, at the same time, it can also give that kind of access highway to the malicious elements, which is something that needs to be thought of.”
5G is the future, but the cloud is our present. As many companies transition into cloud-based systems, Tata Communications is focusing on enabling security systems that allow companies to use as many services flexibly from the cloud as possible, while maintaining the agility that is the essence of the cloud.
“We are creating a model, which caters to a world which will be leveraging cloud heavily and which will expect all those qualities of flexibility, agility, more stability in the cloud; and security should be able to reflect that,” Prasad says. “So, that’s one major focus for us: create a security framework, consumption model around that, and then keep expanding and sifting as the customers expand that environment.”
But technologies are not the one thing that evolves. Rules and frameworks do too.
The recent wave of ransomware attacks all over the world have targeted all industries and taken many forms, forcing organisations to rethink the way that they think of secure practices and malicious users. The notion of what makes a “good” user is constantly changing, and security systems need to be able to change with it.
“We are looking at it in terms of: How do we remodel the notion of security from more standard black and white rules to thinking around analytics and being able to differentiate between ‘good’ and ‘bad’ in a very dynamic fashion?” Prasad says. “It’s about securing the cloud world as we rapidly move toward that and beyond.”
