The Detriment of Dealing with Data - Part Two: Talking with a Web Wizard

Chances are you would have never heard of the man I’ve recently had to pleasure of sitting down with. Yet at the same time- he’s more than likely developed a security system that has helped protect your data from being stolen. He’s known as cyberspace’s Sherlock Holmes- one of the digital realm’s most effective weapons in the war against an enemy that continuously develops new tactics with nanosecond that passes.

Meet Indranil Mukherjee- the man that the world’s biggest companies look to for advice on how to best protect their data from hackers with nefarious intentions.

He’s fresh in Australia after being honoured with the senior information security practitioner award at the Asia-Pacific Information Security Leadership Awards (ISLA), and in a 24-year span has experience working in 70 countries, alongside governments, banks, IT companies and pretty much anything you can think of.

He’s the cloud security officer for gargantuan companies Amazon web-services, IBM software or any of Microsoft’s cloud environments, and has more knowledge in ISO certification than he’d probably care to admit… He’s a qualified certified information systems auditor and manager, ISO 27001 information security and ISO 9001 lead auditor, ISO 20000 service management expert, ISO 22301 BCM as well as being certified in PMI, ITIL and cloud-computing CCSK.

When Indranil speaks, companies like Microsoft listen in, very closely.

Amongst other things, he was second in charge of the MIT-based Cambridge Technology Enterprises team, which amongst other things made profound leaps in the world of cloud computing and storage, eventually working alongside massive entities like Shell, Velux and Bank of America.

It’s not every day you get the chance to sit down with one of cyberspace’s most powerful benevolent figures, so in part two of our focus on data-protection and how to best prepare for the worst the web can throw at you.

KS: Can you tell me what you’ve been working on lately?

“I move around a lot, traveling around the world consulting for companies where I operate as the lead auditor for AWS, IBM and any of Microsoft’s cloud environments; along with ISO 27001 for information and security, as well as working with SS584, which is the world’s first multi-tiered cloud security standard, developed by the Singapore standards council.

“The difference between the SS584 standard and an ISO standard is that you can vary the degree of security within the business, depending on what you want to protect. Level-one protection for example could be used to protect some relatively-confidential company information, whereas level three would be used to protect the business’ most precious cloud-based or digital assets. This standard has been adopted by numerous government agencies world-wide, used in areas like ministries and treasuries and even defence sectors”

KS: What kind of environment are you working in?

IM: It’s a rapidly changing environment… You’re constantly trying to hit a moving target. Data and information flow trends are multiplying five-fold. If you look at world-wide data storage, it’s been quintupling year-on-year, while IT infrastructure and associated storage devices need to keep up with the staggering increase. One of the ways in ways in which enterprises and government have tried to cope with this influx of storage across the world is by maximising current capacity by using cloud services. Either in terms of using cloud infrastructure from providers like AWS (Amazon Web Services), Microsoft, IMB or smaller cloud players. Obviously this comes with a certain amount of risks from a data or information perspective. Whether these risks are from a privacy perspective or ransomware, it’s really like hitting a moving target, or in most cases many, many moving targets to hit at the same time.”

KS: What do you mean by these multiple targets?

IM: “In information-security you could be dealing with a ransomware threat at one point of time where your organisation’s own internal defence systems are being hijacked and encrypted for you to pay a ransom to pay the hackers, or vice-versa outsiders trying to get in through a traditional parameter. Every kind of data or information, whether it’s a large piece of infrastructure, an appliance or device like a smartphone, driverless car or even a refrigerator which is smartphone-enabled can be the target of hackers in today’s world. It doesn’t matter if you’re a high-profile business or individual, no matter who you are, you can be the wrong man or woman in the middle to be targeted.”

KS: “Looking past the benefits of ISO certification addressing data protection- what can the average person do to lower their risk of having their data or information compromised?”

IM: “Effectively now, security is everyone’s problem. You don’t want to be the weakest link. While certification is undoubtedly one way to improve your chances, being aware of how to secure your own devices, appliances, infrastructure systems and applications are is essential to everyone in today’s world. There are a number of initiatives organised globally, one of them called the ‘Safe and Secure Online’ initiative, which is a website that provides easy to understand suggestions on how to make your own devices and infrastructure more secure.”

KS: “In 2016, is there such thing as 100% security online?”

IM: “You can be 100% secure online today at this point of time. The problem is that a few nanoseconds later that 100% can drop to 0%, it’s the uncertainty principle at work. As auditors we can check 100% of the systems at this particular point in time but it’s a continuous game. Some of these attacks may be passive- people may just be scanning your network to see which devices or appliances can be attacked without doing anything malicious on your network. However- the next second when they decide to the launch the attack, or have logic bombs in your system, (a set of instructions hidden inside a program to launch an attack) you may be under threat or even attack without ever having known about it.

KS: Can you list a few of the most severe data breaches you’ve seen on a government level?

IM: “In terms of impact, the recent hack of the Bangladesh Central Bank comes across as particularly big from a government sector perspective because the SWIFT payment system which traditionally has been the hallmark of inter-bank and financial transactions across countries has been hacked, which is a major cause for concern for governments and currencies alike.

KS: What about the business sector?

IM: At an enterprise level, when the Target corporation was attacked, that brought information security to the board level. An interesting phenomenon we’ve seen in recent years, is the intersection of enterprise and government attacks. For example the Sony Pictures attacks, where Kim Jong-un in North Korea wasn’t exactly pleased with his portrayal (in the 2014 film- The Interview) and then hacked into Sony Picture’s database. They were down for three months. We’ve seen all flavours of attacks- from enterprises and governments, to governments and enterprises intersecting, and in the case of the current US elections- one party asking a Russian government to try to hack the other party, acts to prove that even domestic politics is becoming a hacker’s game.

KS: What is an individual and organisation’s best chance to stay safe online?

IM: “Two simple words- be aware. While security is a serious business- I don’t want to sound like a fear-monger. Once you’re aware of what you need to do to protect yourself, while you may not be able to stop 100% of attacks, you can to a degree delay or diminish the impact of that attack, simply by being more conscious of the process of security online. It’s possible for you, your business, your government or your family, whatever it is that matters to you, to be secure enough to continue working without substantial loss by taking simple precautions on your work and personal devices.”

KS: Anything specific in an Australian context?

IM: “As we saw with the ABS only a few weeks ago, you can see from a data privacy perspective, it’s not only relevant, it’s current. A multi-tiered cloud security level of certification addresses risk profiles across a sphere of data information leads, whether it’s an enterprise or a government.”

“If you’re an Australian trying to put your Census records online, god help you”

Laughter ensues, but I get the sense he’s not really joking about that last one.