Why cybersecurity tools may not be enough to protect an organization’s data

Organizations worldwide may have quickly adapted to remote working arrangements, but few have undertaken the precautions that modern digital workplaces require to lower the risk of loss of sensitive data. Employees tend to use public file-sharing resources such as Google Drive and Dropbox to exchange data. However, these free cloud-sharing systems are vulnerable to rogue adware redirects, where a user’s web traffic is unknowingly intercepted and rerouted by hackers as they are not perfectly protected by default.

This practice results in companies being unable to have assured control and visibility over where their sensitive files reside, in turn jeopardizing strategic decisions and partnerships.

In 2017, technology company Verizon negotiated a revised deal that was US$350 million lower than its original offer for acquiring Yahoo after the latter had disclosed two major data breaches during the acquisition talks. Underscoring further just how prevalent the problem is, cyber incidents such as data breaches ranked third in an assessment of the top global business risks for 2021.

The often underestimated value of data

“People don’t realize that the information they share with applications or cloud services is in fact very sensitive,” says Christopher Muffat, founder and CEO of Dathena, an AI-powered sensitive-data discovery and protection platform. In fact, it is through piecing together these “clues” that hackers are able to better identify their targets when attempting a data breach.

Christopher Muffat, founder and CEO of Dathena. / Photo credit: Dathena

Cybersecurity on this side of the world is particularly lacking, with studies showing that Southeast Asia has a ways to go in strengthening its information security infrastructure. One of the main reasons cited is that users and companies in the region often underestimate the value and security risk factor of sensitive data.

Hackers are interested in stealing data because they know it can be traded either for other types of information or for monetary gain. A frequent tactic employed by them is blackmailing organizations whose data has been breached. Singaporean furniture retailer Vhive became one recent example, after bad actors had gained access to the information of over 300,000 of its customers.

Recalibrating what needs protecting

The occurrence of data breaches may seem commonplace enough to be perceived as something that “just happens,” but its consequences are not to be taken lightly. Owing to this weakness in cybersecurity, the top 1,000 companies in Southeast Asia could lose US$750 billion in market capitalization and derail the region’s digital innovation agenda – a central pillar for its success in the global digital economy.

The World Bank reports that the full potential of the region’s digital economy is not being realized due to pervasive regulatory barriers and constraints at the country level, with huge gaps in levels of cyber readiness across nations.

Photo credit: Sigmund via Unsplash

As Muffat observes, not only does recovering from a data breach cost a lot, to the extent that it can bankrupt newer, smaller startups, it also takes time for consumers to regain their trust in a business.

“It’s a loss of revenue through loss of trust,” he adds. “Trust is the number one thing for companies [and] is part of their branding.”

While most businesses would already have data security systems or cybersecurity teams in place to protect themselves and their consumers, new technologies are constantly rendering older ones obsolete. Looking back at his experience leading HSBC’s Digital Forensics and Incident Response team in Switzerland in 2007, Muffat expresses that although the digital landscape has grown drastically 14 years later, with 40 million new Internet users last year in Southeast Asia alone, data protection tools have not.

So how exactly can organizations keep up?

He believes the exact problem of cybersecurity today is that it tries to cover or protect too much of this ever-expanding volume of data without effectively employing what is called “confidence of the risk.” This means taking a critical look at the data hosted and evaluating its confidentiality factors, such as whether a piece of information may be accessed or released only under certain conditions.

Like the very tools used to gain access to it, information is constantly evolving. News of an impending merger, for example, can go from highly confidential to not at all within a day, after the business officially releases the information. This makes it necessary for companies to continuously reassess the parameters of their chosen data security resources.

As Muffat reiterates, with the exponential growth rate of data, it is near impossible to track and follow what kind of data a company really has – and this is where AI steps in. Rather than rely on dated methods of static rules and keyword pattern-finding, he explains that platforms such as Dathena automatically and accurately identify sensitive, critical, and personal information by analyzing and securing data through AI-powered identification and classification.

For instance, the platform’s data and user risk assessment solution automatically and accurately maps users based on their access to sensitive data, allowing businesses to get full visibility over their information as well as identify the users that are most at risk. In addition, data protection policies can be generated through the platform’s augmented data feature, a technology that Dathena claims is the first in the market.

The Dathena dashboard offers users a transparent overview of their sensitive data. / Photo credit: Dathena

Now, instead of simply looking at the parameters of all of its data and trying to secure everything, a business can use its augmented data protection solution to generate data protection policies to protect those that are most at risk.

Boosting the effectiveness of existing protection ware

The intention of an AI-powered platform like Dathena is not to replace but rather strengthen and educate existing security processes. Muffat likens this to middleware, which is the software that lies between an operating system and the applications running on it, connecting the two and allowing databases to be easily passed through.

“We sit between the data and the existing data protection,” he says. “I like to call it a universal layer of data protection.”

After deployment – which takes just 15 minutes for a small organization and up to a day for larger ones – the solution analyzes the data and recommends data protection rules to implement in a user’s existing tools.

Eight years since Muffat first began developing Dathena’s solution, he has finally achieved what he had set out to do: create a sophisticated industry-grade protection system that is accessible to the layman.

“The fact that it is easy to deploy and adopt is the main focus right now because we have reached a point where our AI is quite mature. If I give you the tool, I want you – without any training – to be able to use it.”

For companies that have yet to invest in additional cybersecurity – and may already have regular protection tools such as Google Workspace and Microsoft 365 embedded within their everyday digital office programs – Muffat says that they can still use Dathena’s solution. Its external file-sharing management solution helps automatically identify sensitive data shared in third-party collaborative tools, whose access can be easily revoked should a company choose to.

On a wider scale, Muffat believes the company is making shifts in the industry: It presently has seven pending patents, including for AI explainability and deep-learning methods for data protection.

“We are truly doing innovation in AI,” says the Dathena founder and CEO. “We solve problems that go way beyond cybersecurity and data protection through our ability to industrialize and scale AI solutions. That’s a challenge for many organizations, so we’re pretty proud of achieving that.”

Dathena’s AI-powered sensitive-data discovery and protection platform enables the industry-best protection of your critical personal and business data. Sign up for a complimentary trial here.

This content was produced by Tech in Asia Studios, which connects brands with Asia’s tech community. Learn more about partnering with Tech in Asia Studios.