Security Confidential S15 E4 Purandar Das

Rory Meikle (00:05.596)
Hello everybody. Welcome back to another episode of Dark Rhiino Security’s Security Confidential. I’m your host today, Rory Meikle, filling in for Manoj Tandon. Our guest today is Purandar Das. Purandar Das is a visionary leader in tech, having served as CTO for two of the largest marketing service companies. He’s now the CEO of a leading data protection company, pioneering innovative approaches to secure personal data.

Transitioning from data monetization to data protection, Purandar was driven by concerns about the inadequacy of existing security products. His unique journey underscores a deep commitment to redefining data security standards in today’s digital age. Purandar, welcome.

Purandar Das (00:50.653)
Thank you, Rory. Thank you for having me.

Rory Meikle (00:52.634)
Yeah, absolutely. Looking forward to this on data security and data breaches. You know, that’s all the rage in the cybersecurity world today. So it’s very fitting that you’re on Security Confidential with this topic. With recent high-profile data breaches making the headlines, what do you see as the biggest vulnerability in the current data protection strategy for organizations?

Purandar Das (01:20.581)
I have actually the response to that, or the answer to that, is very simple. It’s data protection. If you look at the cybersecurity landscape, the threat posture management landscape, there’s a lot of products and a lot of strategies around protecting everything but the data. And the legacy notion is saying, let’s encrypt data and we’re good. Obviously, it has never worked.

And it’s being exposed on a daily basis today. Data protection has to be revisited and an emphasis on actually building products that protect data, as opposed to products that protect access to periphery, et cetera, et cetera. Until the focus shifts to protecting data, this situation is going to continue.

Rory Meikle (02:11.068)
Gotcha. Okay. So what is it about the data itself that makes it such a valuable target for criminals and cyber hackers?

Purandar Das (02:21.117)
And again, I mean, not to be a smart ass, it’s simple, right? Data is the new oil. That’s what they kept talking about. Data drives economies today. People said data drove marketing, data drove strategy or analytics; data drives economies. Everything that companies do is built around the data that they can collect and the data that they can use. Shifting to a consumer-based economy has just made that situation even greater.

The largest companies in the world rely on data. Even if you look back 10 years ago, the amount of data that exists that’s been collected from individuals across the globe is just monumental. And that essentially is the crux of the problem. You need data. Data drives everything. But then there’s so much of it, and the process is so complex, that it becomes really difficult or challenging to protect.

Rory Meikle (03:25.276)
Gotcha. So when did this switch start? You said about 10 years ago. When did companies really start to see a value in harvesting and collecting that customer data?

Purandar Das (03:37.991)
So, I mean, that process has always existed, right? My own background, I come from marketing, from marketing services companies. They existed because they helped companies utilize data. And companies had systems that supported their operational needs, like making a sale, collecting a payment, et cetera, et cetera, or building a membership. They never had the infrastructure or the capabilities to analyze and monetize that information.

That’s where the marketing services companies came along and said, “Hey, you have all this data. We can help you monetize that data by either selling more to your customers or finding new customers,” et cetera. It was done at a scale where there were a few organizations that did it. But today’s companies do that themselves and in real time, as opposed to being an offline analytic batch-oriented process.

Rory Meikle (04:36.0)
So the introduction of advancements in technology is really what created that monetization of data.

Purandar Das (04:43.311)
Absolutely. I think that’s the core of it. Advancements in technology drove the ability to build consumer-based platforms, right? In a variety of things, like the Ubers and everything else. But that also gave rise to access in real time to information that’s invaluable in building and furthering relationships. So the platforms that were built by the newer companies, if you will, also took that into account and could operate on and execute on this in real time. So that’s where I think the switch happened.

Rory Meikle (05:23.28)
That makes sense. So with a new rise in AI that we’re seeing today, happening right now, what kind of role is that going to have for data security and what kind of risk does that bring for the future of consumer data protection?

Purandar Das (05:39.157)
I think it’s two things, right? One is data hasn’t changed. It’s still data. Even the AI or the LLMs are still consuming data. So the ability to protect that data doesn’t go away. The basic capabilities of security and privacy.

But it also exposes a lot of risks because the amount of data that can be processed in a really fast time leads to a lot of opportunities and the ability to collate information across data sources that wasn’t possible before. That exposes multiple threats. And when you think about both the good guys and the bad guys having access to this technology and data, you see both sides of that issue.

The AI is the rage today because it’s introducing change in a positive way across so many different industries. But the same data and the same capabilities are also available to the bad guys that are equally adapting to new ways of exploiting the data.

Rory Meikle (06:40.028)
So thus far then, who has AI kind of given the edge to? The good guys or the bad guys?

Purandar Das (06:47.165)
I would say the good guys because there are more companies that have built platforms that can extract information and drive outcomes. The bad guys are adapting because they’re so caught up in running their existing legacy schemes. They have to switch and adapt to the new capabilities that are available. But they won’t be far behind, believe me.

Rory Meikle (07:05.745)
Gotcha. Makes sense.

I’m sure they’ll catch up quick, right? The government agencies, both here and abroad, have put in a lot of data protection regulations—GDPR, CCPA. Have these done much to protect data, or are there shortfalls and gaps that need to be filled in order for these kinds of regulations and policies to really have a better effect on the consumer?

Purandar Das (07:37.007)
I think what the regulatory agencies and the regulations have done is just address the tip of the iceberg, honestly. What used to be the Wild West at least now is beginning to have some kind of a framework on how to collect and manage data. And like the GDPR, for example, in the EU, they’ve started to impose financial penalties. Ultimately, businesses respond to only one thing: whatever hits their bottom line.

The financial penalties have become more meaningful, and that’s when the companies begin to sit up and take notice of this. The other thing also is empowering consumers to go after companies that misuse their information.

Rory Meikle (08:21.148)
Do you think what is kind of driving these policies? Is it more of companies not being as secure and kind of doing the right thing with the data, maybe making extra profit, and organizations, regulators, they don’t like that? Or is it more that they’re trying to keep a cap on that profitability that a company can make from the data?

Purandar Das (08:50.129)
I think it’s less the latter and more—let’s look at it this way. Companies build systems, platforms, or business models for one reason, right? They want to make money. That’s the whole idea. And when you sit down to plan a business or a platform or a capability, the last thing you think about is security and privacy, right? Because that’s an impediment, an obstruction, or something that slows the process.

So privacy and security become literally an afterthought. We’re seeing that everywhere today in the amount of data that’s being lost and systems being attacked, because that wasn’t really—I mean, people pay lip service to it, but it’s not really very high on the development roadmap because they’re all caught up on features and functionality of what drives revenue.

The regulatory agencies, on the other hand, are looking at two different things. One is the widespread abuse of privacy and security for consumers or customers, whatever you want to call them, right? That has been ignored, and they’re kind of stepping up and saying, it’s reached a level where it can’t be ignored anymore.

The second thing is the monetization aspect of it, as companies start to mix data and start to infringe areas that traditionally should not be a part of that at all. I don’t know if you saw the latest headlines. It was yesterday or the day before, where a Microsoft-owned company is being sued by a consumer, by a marketing consumer, saying that they’re cheating marketing firms or advertising firms by selling them data that’s completely inaccurate.

They’ve cited instances of an individual being found across multiple age groups, multiple demographics, multiple segments, and they’re selling the same data multiple times to advertisers. So that level of abuse or lack of care is what is driving the other portion of it.

Rory Meikle (10:55.824)
That makes sense. Yeah. I mean, you can see it both ways, right? They want to protect the consumer, obviously, at the end of the day. And I think you’re right on with, looking at it on the other side, the business aspect. When you’re a for-profit business, security and regulation is the furthest thing from your mind, because ultimately it’s only going to hinder your bottom line.

Purandar Das (11:18.925)
Exactly. Security and privacy from a company, an enterprise, or an organization’s perspective has always been about: do the minimum. Whether it’s because the insurance providers ask for something, the regulators ask for something, your privacy laws say something, your attorneys say something, it’s always about doing the minimum. And the minimum obviously is leaving the door wide open for the bad actors to get in there and steal whatever they wanted.

Rory Meikle (11:51.196)
So these policies are just setting that minimum standard.

Purandar Das (11:54.309)
Yeah. GDPR, even for example, all they say is make sure the data stays protected. You can interpret that in a thousand different ways. The healthcare companies obviously interpret that in the most conservative way that’s possible and say, let’s make sure that we do the maximum because this data is so sensitive. If you flip over to something that’s not on the healthcare or financial services side, they’ll say, do the minimum because who cares?

So yeah, it leaves a lot open to interpretation, and that’s part of the big problem.

Rory Meikle (12:30.204)
So what are some of those steps then that organizations can take to better protect their data against threat actors, ransomware, thieves out there?

Purandar Das (12:39.709)
I mean, I am a little biased here, but I’ll say this. One of the big challenges in cybersecurity has been, like I said, the lack of data protection. And I think that arises from the fact that protecting data has challenges because, as we’ve discussed, data needs to be available for it to be useful.

When you think about protecting data, anything that you do is typically looked at as something that obstructs the business process or adds friction or limits what you can do with it. And products haven’t helped. The security products—there have not been many products out there that say you can protect the data while still making it usable. That’s been the challenge.

So the security has always been on the periphery, so to speak: the network, the firewall, the access point, et cetera. Data has always been left alone. And as we’re discovering, and as companies and everybody else is discovering, there are just too many ways to get into a secure system, whether that’s because of the number of integration points, the application integrations, the number of users, et cetera, et cetera, number of devices, et cetera.

But once you get in, if the data is not protected, hey, the attacker has access to it. So the focus has to shift in saying, let’s assume that somebody gets into the system. Then how do you protect your data? That’s where the focus has to shift. And whatever’s been done at the peripheral level has to be now done at the data level to protect the truth. I mean, literally what everybody’s trying to protect at the end of the day is the data or the information. And that’s where the shift has to go.

Rory Meikle (14:20.412)
And there’s been that gap in protection because traditionally thinking, if you protect it, it’s not usable. Am I correct?

Purandar Das (14:33.565)
Yeah. So then the other answer to that as well is, let’s lock the front door, right? So nobody can get in. So we don’t care where you leave the valuables inside the house. But as we’re discovering, it’s not easy or even feasible to lock the front door because there’s so many other doors.

So now, how do you protect things? It’s like the simplest analogy we use in our conversations and slides is, hey, you have a castle, you have a moat, you have all these things. What if they scale the castle and get inside? How do you protect your valuables? Put them in a vault. That’s the equivalent of saying protect your data. And make sure that even if somebody gets in, the data is still protected.

I’ll give you a simple example using encryption. Data has always been encrypted. This is decades old. The problem with encrypting data has been that it protects data while it’s at rest, meaning somebody can walk into a data center or make a copy of your disk, et cetera. What does that actually protect? Nobody’s walking into a data center to steal your data. They’re coming in through the access channels that exist from applications, users, et cetera.

How do you protect data that’s, quote unquote, encrypted? You’re not really doing anything. Sotero, for example, has a product that enables the use of encrypted data without decrypting it. Meaning if somebody were to access the data, it still stays encrypted.

The other thing is, if you get hit by ransomware and somebody exfiltrates the data, let’s make sure the data is encrypted so that the attacker, even if they get their hands on it, is just looking at encrypted data and can’t come back and hold you for ransom.

Rory Meikle (16:15.964)
So what are the steps that go into making data encrypted when it’s in motion, but also still usable for the right person?

Purandar Das (16:24.477)
Yes, so there are new products that enable the querying or use of encrypted attributes. It’s more granular encryption, if you will—not encrypting data when it’s written to disk, but encrypting data while it’s being put into a database, for example, or encrypting data while it’s being written to a file in a file store.

Then the framework says we’ll keep the data encrypted as users and processes come in to access and use the data, so that the data is only decrypted in a small context where the user, the process, and the request have been validated—not just through the typical privilege approach, but also through an anomaly detection model that says, I can tell you with 99% confidence that this user and this process and this request is valid or invalid based on the behavior that we’re seeing as a whole across this request.

Rory Meikle (17:23.782)
So it’s looking at it from a more holistic standpoint rather than looking at the individual piece of data that’s encrypted.

Purandar Das (17:31.161)
Exactly. It’s looking at not just a piece of data, which it does in the context of saying, is this data sensitive or not? Is this data confidential? It classifies the data as being sensitive and confidential. So that gives it that first layer of protection.

The other equally important thing is to decipher the validity of the request, if you will, across a whole range of parameters: the time of the day, the zip code, the zone, the access mechanism, user credentials, et cetera.

Rory Meikle (18:02.536)
So you’re taking almost user identity and application management security framework and applying it to the data access request level.

Purandar Das (18:11.259)
And applying it down to the data access request level, yes.

Rory Meikle (18:31.61)
Okay, that makes a lot of sense. Yeah, I mean that sounds like a great idea to me. Has the transition from being in office, everyone’s always in a work center, to remote everything’s in the cloud, people can work anywhere, grab their information anywhere—has that put a lot of increased pressure on data protection?

Purandar Das (18:42.949)
Absolutely. It accelerated the migration to the cloud. At the beginning of this thing, systems needed to be accessible, available across not just the office and corporate network, but from everywhere. That meant a lot of data was being moved. It was being moved into platforms and technologies that this company had not adopted or seen before.

So that kind of puts a stress on what skills and resources you have available to protect information. So that’s part of the challenge. Newer technology doesn’t come equipped, does it? In many cases, it can’t be retrofitted with the security model you had for on-premise data protection. So yeah, it puts a lot of stress and emphasis on data security protection.

Rory Meikle (19:30.95)
So what are some of those best practices then for a smaller company, SMB company? Maybe they have a lot of remote users or they’re entirely a remote company and all their data is in the cloud.

Purandar Das (19:45.265)
Yeah, again, focus on what you’re trying to protect first. Putting VPN—everybody says put a VPN and you’re good—but the VPN is not protecting your data that’s sitting in the cloud. It’s protecting it from somebody that’s coming through a valid channel, right?

So again, let’s focus on the data. Let’s look at the newer technologies that you don’t have the skills to find, the right product or products for it, and deploy the same level of security. Again, protect your data and then put this layer that can detect anomalies or threats in real time as they’re trying to get to the data.

That’s the solution, whether you’re SMB. The scale may be different, the technologies may be different, but the framework is exactly the same: real-time threat detection and prevention. And at the end of the day, you need to have a failsafe or a backstop data protection framework.

Rory Meikle (20:35.6)
Are there other products out there like your company’s product who kind of take a holistic approach to data protection?

Purandar Das (20:43.505)
There are. It’s a whole new category that’s evolving called DSPM, or data security posture management, data security platform. The difference being posture management, again, I believe in my thing, focuses on the wrong thing, which is policies and users and credentials.

A true data security platform protects more than just the posture. It actually protects the data. So yeah, it is an evolving category, if you will, or an area.

Rory Meikle (21:14.266)
And I would imagine that these targeted industries are healthcare, confidential, sensitive material, stuff like that.

Purandar Das (21:24.923)
Healthcare, financial services. I mean, yeah, you’re right. Those are the couple of industries that focus first because they have more sensitive data. The legal and the financial risk for them is higher. But all you have to do is read the headlines. They’re not going after healthcare and financial services exclusively. They’re going after everybody.

Rory Meikle (21:46.264)
Anybody’s data is valuable these days.

Purandar Das (21:48.121)
Yeah. And what people don’t realize is what used to be stealing individual data sets, right, and then trying to mine that or monetize that, has now become different industries. They’re collecting unique data sets from across the spectrum and then collating them to build a much richer profile that leads to more opportunities.

Your medical data is now commingled with your financial information. It’s also commingled with your credit card information. In many cases, they probably have a better picture and a profile of you and me as individuals than most companies have in this thing.

Rory Meikle (22:30.788)
Yeah, it’s crazy to think about too. The amount of information that you probably have online everywhere. Yeah, it’s your entire persona, right? So from a company aspect, what is the biggest overlook that they take when they’re thinking about data protection? Where are those biggest gaps that they need to bring their thinking forward on?

Purandar Das (22:59.975)
I think it’s a couple of things. You can also understand their perspective in what has happened. They’ve spent money on what they think is data protection, right? Because the products and the consultants and the companies that sold them said, “Hey, just buy our encryption product and you’re good.” The fact that you’re not good is now coming to the forefront, right?

And now the companies and things are going like, “Well, we spent millions of dollars on buying encryption software. What do you mean we’re not good?” Well, we’re not good. And they’ve invested resources, skills, and money on building a security framework that leaves them open. So acknowledging that, transitioning that to saying what we’ve done is not enough, and having the courage to go back and say, “We need to spend more money,” because there’s really no other answer to that to achieve better data protection, is part of the challenge they face.

Because obviously everybody pushes back and says, “How much more money do you want to spend on this?”

That’s one thing. The second thing is you train your entire workforce—in this context, the security teams and the technology teams—on becoming good at a couple of different products or skills in supporting products. Now those products are not sufficient, whether you’re moving to the cloud, adopting new technology, trying to build a hybrid environment. Then you go like, “What do I do with the team that I have? Where am I going to find the resources and how can I get them?”

It’s not only just spending money on new products, but also trying to retrain the thing, finding new people. That’s a big part of the problem.

At the end of the day, they go, “Well, my insurance tells me what I’ve done is sufficient to qualify for a policy.” Let me see how long they can ride that.

Rory Meikle (24:53.166)
Yeah. Is that something that your company comes up against a lot when you’re trying to bring that forward thinking to organizations where you’re looking to sell?

Purandar Das (25:02.407)
We do. We do. We run into that all the time. To be candid, there are many, many innovative and visionary leaders in the companies that we talk to that say, “We know what we’ve done is not sufficient. That’s why you’re sitting across the table from me and talking to me.”

The other ones go like, “Well, I heard company X is doing that. I want to know what they’re doing.” But then they fall back on like, “We’ve done this.” So yeah, we run into both.

Rory Meikle (25:32.24)
Yeah, that’s always a struggle we find too, is bringing people’s thinking from where they’re at to where they need to be as it relates to security. It’s such a hard thing to get someone to see the return on investment, unless they’ve been breached before, there’s some sort of external pressure. It’s like trying to move a boulder.

Purandar Das (25:55.171)
Exactly.