Latest / The HIDDEN Podcast by Babble / Episode 5: Taking Control of Your Data
Transcript
- Lynn Murape: Joining me in the virtual studio today is Nisha Sondhi. Thanks for joining us, Nisha. Welcome to the HIDDEN™ Podcast, where we simplify cyber security and all things tech for those of you who, like need it to be explained without all the So if you've ever wondered why you still feel vulnerable even though you've bought all the fancy tools, come to the right place. ⁓ your host, Lynn Murape and job is to take one of our resident experts and help them translate their cyber expertise into plain This means having practical conversations That's a wrap on today's episode of the HIDDEN™ podcast. If this episode gave you an aha moment that helped you untangle something that's been bugging you, subscribe and share it with a friend who's in the same boat. And if you're wondering where you stand across the six HIDDEN™ layers, our cyber security snapshot in the description below. a lot less painful than a breach. Until next time, don't let your risks stay HIDDEN™. Nisha Sondhi: Thank you so much for inviting me. Lynn Murape: Awesome. So before we dive in, do you mind telling our friends listening or watching out there a little bit about yourself in terms of what you do and where you live? Nisha Sondhi: Sure, so I live in a little town called Sandhurst. Half an hour from Windsor. I'm a cyber security specialist at Babble. So supporting the account managers, account directors with their when it comes to cyber security. ⁓ Lynn Murape: usually built around Babble's HIDDEN™ cyber security framework, which we break down in the show. Or sometimes we'll take a hot topic in the tech industry, like a major breach or a new legislation, and we'll explain how we help you stay ahead. Basically, this podcast exists so that you can sleep well at night, preferably not during the podcast. Love that, and I also appreciate the fact that you are a girl in cyber security. I like to call you all 'cyber security So ⁓ that's great, paving the there. ⁓ All right, so do you mind telling me a little about what you like most about what you do? know you're relatively new to the business, but what are you liking the most about it thus far? Nisha Sondhi: I said that. I would say it's the people in the organisation. Everybody is helpful, very friendly. Everybody happy to support where possible. And I there's some really positive changes that have been implemented recently. I'm seeing a of positivity from the organisation as well as our clients. So overall, yeah, it's been a great experience so far. Lynn Murape: Love that, and it is honestly a pleasure to have you on board, Nisha. we're about one of your company's most valuable assets, your data. ⁓ So Nisha, start a hard truth. ⁓ In your experience, most of the that you work with actually know where their sensitive data lives today? Nisha Sondhi: It's a really good question and I think the honest truth is they do and partially they don't. I think it's tracked the way it should ⁓ could tracked and I most of the organisations within that community there is room for improvements. Lynn Murape: do think they aren't protecting their crown jewels? ⁓ Nisha Sondhi: I think it's more to do with the oversharing, really having strict policies in place. So anybody in the organisation may access to certain data that they can easily share. Whether they share that internally or they're that outside the organisation, if you speak to most of customers out there, ⁓ I don't they have any tools that can even demonstrate that that data is being shared externally. Which is I don't think they really know whether that is being secured properly. Lynn Murape: Yeah, that is definitely unfortunate, but I guess that's why we're having these conversations in the first place. So you mentioned oversharing. And that nicely segues into the next question that I have for you. Data sprawl and oversharing are of course major contributors to data exposure. So Nisha, what does data sprawl typically look like in a 50 to 200 person business? Nisha Sondhi: So it could typically look like where stored either on SharePoint, on a local drive, and you to lose where the master file is. And what that cause? Well, having that control, it's understanding who has access to it, and more importantly, what are they doing with it? And you get to see this a lot, It's called like a radius blast, where suddenly, all that data has just been sent to random individuals, nobody's actually governed actual data itself, the policy is probably old so anybody can access it and there's just no control. No has any visibility or control about how it's being handled or managed. Lynn Murape: You know where that data is going, who has access to it and also what they're doing with it as well. yeah. Nisha Sondhi: Absolutely. And, you know, there are so many tools now where we can- how we can share data and data can now be shared on Teams. And you can have external on your Teams account where you can now share that data. So are areas now where we, you know, really should be having those conversations with our customers, educating them in terms of why having better policies wrapping around your data is really vital to your organisation. Lynn Murape: Okay. Nisha Sondhi: Especially when you have the likes of hybrid, multiple applications, you know. It all does bring you to how can we put that ring fence around it. Lynn Murape: Yeah, so just going back to this issue of oversharing even within the business, right? Because I think, ⁓ know, the initial take on that is to say, obviously, whatever happens in the business stays in the business, but even having those measured controls the business in terms of who has access to what is obviously crucial, as mentioned. So why is this oversharing within the business such a silent risk? Nisha Sondhi: So it depends. Oversharing can cause lots of complications. It can impact anything from Oversharing could be particular types of data. So certain data should not be shared at certain levels. it's understanding what data you're sharing and who to. Which is why it's concerning when you see organisations oversharing information. Data might credit card information. It might be about a particular project that's been delivered. It might be government information. these areas come to having those defined policies in place just to ensure that this data is in the right hands, it has right access, it's got the right visibility. Equally, oversharing data you possibly manipulate that data. So now you start to lose its true form of that data and that's just as dangerous now you're sharing data which technically might not be correct, and it's been manipulated. Lynn Murape: Yeah, and then depending on how granular the changes are, how much data you have, and how much of that data has actually been manipulated, it would also be ⁓ to know what single version of truth is as well. Yeah. ⁓ Nisha Sondhi: Yeah, it's understanding the master copy versus what data you're now seeing today. So there's lots of, you know, areas of concerns when it comes around over sharing data. Lynn Murape: Yeah, love that you brought up this element of having that master copy as well because that nicely segues into the next episode which is about disaster where Steve and I talk at length about, the difference between having backup and recovery and why it's not the same thing but why both are very important as well. So be sure to tune in that episode. But bringing it here and switching gears to now the compliance and insurance side of things. are regulators, insurers and customers becoming more focused on data governance? Nisha Sondhi: So there's many reasons behind that. you know, what they're trying to do is they're trying to force businesses now to clean up their digital footprint. They're trying to get them to take that onus. Having insurance is one thing, but then there's also premiums attached to those insurance policies. What want to do now is to get organisations to be able to demonstrate, we have the right policies in place, or we've done a recent audit or a review. It's now doing their due diligence on their customers. I think prehistoricly it was, yes, here's an insurance document. But as we grow more and more into the world of cyber security, more and more applications, and now we've got AI into the now insurance companies understand actually that risk is not siloed. It can spread out quite fast, quite quickly. the impact can be quite significant to an organisation or to an individual. ⁓ Lynn Murape: Thank And would this also have anything to do with the, you know, Danzell version 3.3? Please do correct me if I'm wrong on that, but basically the big changes that happened just this April to Cyber Essentials? ⁓ Nisha Sondhi: So when it comes to governance and compliance, are elements of where organisations have to show due diligence. So they want now on everything. Anything that's connected to the internet, you've got to demonstrate you've got MFA. When it comes world of compliance and most organisations that take on the Cyber Essentials, Cyber Essentials Plus, they want to get on to the ISO 27001. Now that readiness is all around, you know, policies, controls, data. This all leads up nicely. So you're absolutely right. It's best housekeeping. That's what they need to be trying to achieve now is that continuation. Lynn Murape: Mmm. Okay. let's talk unknown sensitive data, data that is very and dear to the company, but people either don't that it exists or they don't know where it's sitting. So why classification so often missing, in terms of the data? Nisha Sondhi: I don't think it's an intentional... missing in the organisation, I think it's more to do with they just don't how to do it. They're not aware of it. And it's not really about board level. So speaking with particular customers, when I asked these particular questions, it's not on the agenda. It's not something that's been a concern. And I think that stems from the fact that they haven't seen an incident or they don't know of an incident that's actually happened. So it's the out of mind, out of sight mentality. If I can't see, it must not have happened. the majority of customers say, will look into that when something has happened or flagged. And I think that's why we see that quite a lot. But what we want to do is prevent that. We want to make sure that, hey, if something has happened, don't worry. We already have policies in place. It's documented. Let's go and review. Lynn Murape: Right. Yeah. Nisha Sondhi: or if they do have policies in place, it should be us telling them, well, when did you last review that policy? Have you tested that policy? And again, the majority of the answer is no, we have never tested it. We've built it out, but we've never tested it in years. Lynn Murape: Just to something that you had said that jumped out at me in terms of, you know, it's not necessarily on their list of priorities or they don't necessarily have somebody designated to classifying this data, especially among businesses that don't have that, fully-fledged IT team as well. So ⁓ with being said, who would you say own data classification in the typical SMB environment? Nisha Sondhi: a good question. There are multiple people that can own it. So you might have somebody that looks after compliance and governance. will have an input because when it comes to compliance and audit checks, they need to be involved. You might have a CISO in the organisation. They will also have an input in making those policies, determine who has access, where we can share and how we can share. ⁓ is why I go back to the board level meetings. It needs to be discussed at a high level so everybody understands how the process has been defined and why. And how it's being reviewed regularly. So you're going to have quite a few individuals involved. Now it just depends on the organisation terms of what kind of roles are they appointed, who after what? What I find is one individual may wear several Some organisations, there is person running everything and in other organisations we have one to three people running that. Lynn Murape: Yeah. can honestly be a lot to just sit on one person's shoulders. ⁓ it reminded me of a conversation that I had earlier with Anton, I believe, in the previous episode where we were talking about identity management. Because I think when you talk about cyber security in general, again, in the absence of having this internal IT it's difficult to establish clear and ownership of various elements. And if really think about it, again, going back now to H in HIDDEN, which is human risk. We all have some level of responsibility, when it comes to keeping the company data and our own personal data as well, right? In keeping ⁓ the company So. ⁓ Nisha Sondhi: Absolutely. It's a trust element that we have to have with the people that we work with, but you're absolutely right to bring up human risk. one of the main factors in terms of why things go wrong and why we overshare and who we share to. And great when an organisation trusts their people, but partly that trust has come from just being a little bit not keeping to date with their housekeeping. Lynn Murape: ⁓ yeah. Mm-hmm. Nisha Sondhi: And it goes back to, well, if it hasn't happened, why should we look at that? And it's like, well, how would you define if it has happened? What would pop up to show an individual in your organisation has sent a large mass of data? Do you have any tools that can show you that? And that's where they start to think and go, actually, we don't have anything in place. So we would know that straight away. By the time they do find out the is already done, the data has been shared, it's been leaked, it's probably been manipulated, and now it's in the wrong hands. ⁓ Lynn Murape: Yeah. Yeah. And that nicely moves on to the next question that I have for you, which is what happens when there is no control over external especially in of the dangers of AI? You don't know where the data is going. Nisha Sondhi: So the longer don't realise that they have overshared, so data's being compromised, the more challenging it is. This would be dwell time. And that just means there's more being taken with that data. So the individual that access to that data, whether it is a malicious intent, they've got more time now to use that to advantage them and disadvantage the individual or the organisation. So it's so important that do have processes in place to identify whether data has been sent to the wrong or overshared. And late discovery, exposure can really the organisation, not just the fact that they've given data or lost data, but it's their reputation, they will lose that trust from their suppliers, their consumers. ⁓ And the just keeps continuing. And then you then have to go back and backtrack to do that forensics to understand, well, where did we go wrong? Why did we not know about this? And why did we give that individual Lynn Murape: ⁓ yeah. Nisha Sondhi: access to XYZ? you have to go back and probably some organisations might need to get a third party to help them with that. Some might be able to deliver that themselves, but again, it's the unknown. Do organisations to that risk? I wouldn't want to if I owned my own company. ⁓ Lynn Murape: Yeah, me neither, ⁓ not. So, Nisha, your opinion, of course, why is the everyone has access to everything problem so prevalent in SMB environments? it mostly that whole element of or is it not having the in or not having, clear ownership? Nisha Sondhi: I think it's a combination of all and I believe that not everybody needs access to all the data. ⁓ work for Babble as an example. ⁓ so do you, we don't have access to data that's highly ⁓ and we don't need it. We honestly don't need that access to that So I think it comes down to the organisations to, you know, define what people's roles are, responsibilities, then making sure that those policies are in place that meet with their roles and their standards. Lynn Murape: ⁓ yeah. Nisha Sondhi: makes life easier when it comes to auditing, when it comes to being regulated, when it comes to getting insurance, and it's taking out the stress anything was to go wrong. Oversharing, I think, just adds far more Lynn Murape: Yeah, it reminds me of the previous conversation, again, going back to identity management, where we were talking about access controls. You know, how for the most a lot of businesses simply just give everybody, you know, the highest level of access just that they can hit the ground running and they can just focus work. But then, the dangers of that is that, malicious actor is able to hack into the receptionist, for example, account and therefore she has the exact same access and in this case the to the data that potentially you know the CFO of the company has as well. So ultimate goal of course when it comes to data controls is to protect data without slowing business down by making risk visible, controls automatic, and behaviour going back to that human risk element. So Nisha, what does good typically like in data governance? appreciate that it might look different depending on the different companies the sectors, but yeah, what would you your non-negotiables for good data governance are? Nisha Sondhi: It's understanding of balance. You've got to get that balance right. So again, it's understanding who needs access to what and when. And then you can start adding those rules and policies in place, or you can add extra layers. information that might need to be shared, you can have it so it's timed. It only has a particular lifespan to recipient. So there's many things you can put in into place to give you that assurance and best practice. I think those are the things that are fundamental to organisations is moving away from the oversharing because you think everybody's trustworthy and it's easy to manage is just having that balance and that collaboration and that in equally that gives you back control. But also, got to do their hygiene checks. So checking, reviewing, making sure that policy is still up to date. Or even does that person still work here and have the same role. You know, we work for organisations where we want to promote ourselves, we want to do the best in any organisation we work for. So people do move roles, they change. And equally, the back end of that is, well, if my role has changed, I'm now working in a different division, have my previous access been revoked? If not, why not? I now need access to these, but now suddenly I've got access to everything. And that's what we see a lot when it comes to speaking to our customers, unfortunately. So it's that balance and that collaboration with your team. Lynn Murape: Okay, great advice. speaking of advice, the last question that I have for you is a little bit of a curve ball, but I'll ask it anyway. ⁓ Nisha, say you're an SMB owner and the has happened. Your most sensitive data has just been shared externally. ⁓ What the first thing that you would do in this situation to get things under control? Nisha Sondhi: Every scenario is different. Every scenario is not going to be the same and every organisation will have different ways of how they're set up. But really, I think the best thing to try and do is to try and see whether you can revoke that link where that data has been shared, whether there's way of doing that. Now, we go back to dwell time. So some organisations don't know straight away. So the damage is already done. Some organisations might be quite intuitive in having alerts to say, ⁓ a large content file has been sent to X Y Z. There are ways that we can revoke things terms of having a policy in place. It would try and delete, disable that link immediately if you can. So it's a bit like killing the access to that data. You would then to then go into identity. So try and what kind of data has been sent. Some organisations label their data. if they do, they can identify straight away, is that data highly sensitive? ⁓ And by knowing what you're dealing with, you can then start to understand the severity of the kind of data leak you have place. Again, it all determines to how every individual and every organisation has built their identity Unfortunately, there is no standard kind of breakdown. It's great question because I think if you were actually to ask a customer that question, ⁓ I don't think they'll even have a process behind They won't have anything. I don't think will have tools to help them try and retract, delete that link. I don't think they even do data labeling. When comes to things like this and an has understood that data has been exploited, there should be review after that. So they have to do an audit log. They need to understand what has happened within that digital footprint. So assess, did anyone actually click on that link? So has anyone actually accessed that that data or is that link still, you know, where is it still alive? so many things that an organisation can and should be doing. But equally, it's by them to build out that process. ⁓ And it goes in nicely with the conversation you had with Steve around disaster recovery. It's how do you try to recover from this? Do you have a plan in place? And if you do have a plan in place, that's absolutely fine. But when did you last test it? So there's quite a few things we can do. If it's absolutely, you know, horrendous and it's a massive impact to the organisation, I think my last resort would be kill the switch, switch everything off and, Lynn Murape: Mm. Yeah. Nisha Sondhi: let's go and get this in and let's have a conversation about what we can do to try and recover that business. Lynn Murape: Yeah. I mean, that was definitely great advice and I think you answered that beautifully because if I was an SMB owner in that situation, you have definitely given some solid advice there in terms of what the ⁓ first step should be because obviously ⁓ you're dealing something ⁓ dire as a data breach, ⁓ making emotional it is ⁓ really stressful to say the as well. So this is, helping calm minds prevail, as they say. So I think that was great. Nisha Sondhi: It is, and It is scary to think about, you know, that question. But however, it's also preventative, because if an organisation ever has this particular situation, lessons should be learnt. And then can then start putting prevention in place. And it's going back to what we've discussed really, putting ring fence around your most critical data, ⁓ naming your data, it sensitive? If it's sensitive, have further restrictions in place. So when somebody is accidentally trying to tag that into a documentation to send out somebody, it will notify somebody to say, this individual wants to send this out. Actually, that individual can't, they don't have access to it. So suddenly now, it's lovely process in place. And they might need to request for access to that data. So as much as it's kind of a scary question, it's actually a question to really help with prevention. know. Lynn Murape: Okay. Yeah. I couldn't agree more because ⁓ bring this up often enough whenever we talk about cyber security that I mean the of the matter is it's pretty difficult to strike a balance between the doom and gloom of it all but also still be solution oriented which of course we are as well. So ⁓ we're very prevalent instances and I'm sure you have dealt with more than a few ⁓ businesses that have through this exact situation, so that was definitely helpful. Is there anything else though that you would add? I know we can talk and talk and talk about this and we will definitely have more episodes to come, but for do think we've covered our bases? Is there else that you would add? Nisha Sondhi: you No, I think it's been a great conversation and to be honest, you know, you're absolutely right. We could go really deep into this. Lynn Murape: ⁓ yeah. Nisha Sondhi: But again, it's the deeper dive conversations come into when you're, we're having those conversations with the customer. So we understand a bit more about their environment. You made some really good points about cyber insurance, compliance, brand reputation. these things are key when it comes to an organisation. So I think you've touched on the relevant points. And think whole purpose of our conversation is to show our clients, our people that is critical. to our business, in multiple ways. So, no, I think it's been a great discussion. So thank you so much. Lynn Murape: yeah. Awesome. All right, Nisha, with that being said, thank you so, so much for joining us. It's been an absolute pleasure to have you. Nisha Sondhi: Thank you so much. It's been absolutely, you know, it's been great. It's interesting. And I think you're doing a great job. So thank you so much. Lynn Murape: appreciated. Day made as usual. Until we meet again, take care. Nisha Sondhi: Take care, goodbye.