INTERNATIONAL. Imagine this scenario: An employee arrives at work in the morning and unlocks the office door by placing his hand on an electronic scanner by placing his hand on an electronic scanner. Once inside, he sits down at his computer and using electronic impressions from his fingerprint, logs onto the company network. Later, in need of confidential files, he proceeds to the company's archive room, where his iris is read by a camera, his identity is verified, and admittance is granted.
This may sound like the scene from a new science fiction movie, but it is in fact a reality. To understand the scale of the ever-increasing data risk to companies, consider the fact that by sometime around 2015 personal data stored remotely from the user will skyrocket, from 100 gigabytes in the near future to 10,000 petabytes (a petabyte is a measure of memory or storage capacity and is 2 to the 50th power bytes or, in decimal, approximately a thousand terabytes).
The data storage market is expected to grow 20% every year due to continuing server computer improvements needed for business and Internet applications. New trends such as wireless power distribution and the ‘always on’ society will raise this growth. As the Internet grows to a more interactive, social networking tool the scale of the storage needed for this new interconnected world – and the tools necessary to protect it – seem likely to multiply even further.
We can plot a graph of computing power against time that, prior to 1900, looks remarkably similar to the graph of maximum speed of transportation against time. Basically it's a flat line from prehistory up to the invention, in the seventeenth or eighteenth century, of the first mechanical calculating machines. It gradually rises as mechanical calculators become more sophisticated, then in the late 1930s and 1940s it starts to rise steeply. From 1960 onwards, with the transition to solid state digital electronics, it's been necessary to switch to a logarithmic scale to even keep sight of this graph. Processing power has increased to such a degree that data risks becoming a pollutant.
In the words of international security expert Bruce Schneier, speaking out against ‘Moore’s Law’ recently in front of an audience at the University of Southern California, "as the cost of data storage gets cheaper, as the cost of data collection gets cheaper, more intrusion, more surveillance is possible."
Surveillance technology has been developing to the extent that it was becoming the major threat to our society, he added.
Schneier, founder and Chief Technology Officer of Counterpane Internet Security, argued that the biggest threat to privacy was the sheer ease with which information can be gathered. This availability was down to a number of factors, he said.
"To look at it, Moore's Law is actually a friend of intrusive tools," Schneier said.
"The cameras are everywhere and you can still see them. Come back in ten years and you won't see them any more," Schneier said.
A big issue was wholesale surveillance, Schneier argues. "Surveillance is 'follow that car', wholesale surveillance is 'follow every car'."
"Wholesale surveillance used to be impossible, now it is possible. We've seen this in the UK where the police, in order to find somebody, started taking DNA samples of everybody," he said.
Schneier pointed to the issue of technology as a social disrupter.
"This whole weapons of mass destruction argument is all about leverage," he said. “People are terrified that a few radicals can do much more damage than they could 20 years ago, and in 20 years' time they will be able to do so much more."
In an era characterised by hackers and identity fraud, guarding against the multitude of security threats has become an increasingly challenging task for companies. When you consider that, according a recent Computer Crime and Security Survey published by the Computer Security Institute and the FBI, the average notebook PC sells for US$1,000 to US$1,500, and the value of the information on that notebook is worth approximately US$250,000, it's no wonder why protecting company data is a top concern for IT managers.
Predicting security's future, like a good sci-fi novel, is a fun exercise in fantasy, but not very realistic. It’s hard, of course, to put anti-alien defences into a security plan for 2009. "Expect the unexpected," says Greg Bear ominously. He is a Hugo- and Nebula-winning science fiction writer who has advised several US government agencies.
That attitude seems prevalent in what analysts like Gartner are talking about in terms of real-time, ‘adaptive’ security architecture, which is built around defending new threats that haven't emerged yet, such as the potentially dangerous world of mobile computing and devices.
It all sounds quite futuristic: mass online consumerisation, mobile threats, expect the unexpected. But without more specificity, are these predictions and advice really helping security professionals to develop a working plan for the future? How does a company these days really write security policy or complete a compliance project? We put these and other questions to Paul Davie, Founder and COO of Secerno, a company with a very clear focus on this area and established in Dubai with a firm base for expansion into the Middle East and surrounding markets.
Secerno, which was founded in the United Kingdom from leading edge research out of Oxford University, offers the world's most advanced, comprehensive and intelligent database activity monitoring and blocking solution for the enterprise.
The Secerno.SQL Assurance appliance delivers a unique solution for monitoring, analysing and logging database usage and enforcing security policies. As the appliance inspects database management system (DBMS) traffic at the layer 7 application level it can gather a great deal of information. It identifies and analyses all SQL statements and determines precisely what database activities are occurring in real time. It builds up a detailed picture of usage, allowing it to spot unacceptable behaviour. Any unusual traffic can be automatically blocked and suspect user behaviour logged and highlighted for further investigation.
The award-winning Secerno.SQL products, which have Secerno's proprietary and patent-pending SynoptiQ technology at its core. Secerno.SQL provides the highest levels of protection against internal and external threats through the placement of a microperimeter around the database. Secerno.SQL, using the powerful SynoptiQ analysis function, allows for fast and accurate policy setting to cover each inquiry or threat and analysis for each statement made to a database against the SQL language.
These features let companies define a proven 100% accurate policy, with a fine-grained analysis that ensures zero false-positive rates, and protects against all SQL injection attacks. As part of its global activities, Secerno has been stepping up its activities in the SEMEA (Southern Europe, Middle East and Africa) region.
BI-ME: Earlier this year you said in press statements that your new Dubai office opens up a great opportunity for your company in a rapidly expanding market for database activity monitoring and security. What stage is Secerno at now?
PD: We set up in Dubai at the start of the year looking at the opportunity across several sectors. Database security is vital function for industries that are prevalent here such as finance, energy and technology, so it is essential for a company like ours to have a presence. We don’t believe in simply ‘throwing the product over the wall’. We are now looking for partners, VARs and consultants and they have to be fully supported. In particular we are looking for security solution providers and specialists in particular verticals.
BI-ME: How do you view the whole regional opportunity?
PD: Our work at the moment is in meeting to discuss the whole database security issue. We have already appointed one partner in Saudi Arabia and are busy talking with another. We will initially focus our efforts on the GCC nations and recruit a group of skilled security partners. But we are working all across the region and will be announcing partners in Dubai, Kuwait and Turkey.
BI-ME: We hear a lot about Moore’s Law, about how so much of our personal data is scattered online and how the data security threat is growing. What are you hearing from your clients about the scale of the problem? Why is it so important?
PD: The issue around databases is that they are seeing very large losses, both accidental and due to malicious activity. What is significant is that in more than 80% of cases, some kind of insider activity is involved. So the bigger problem for IT security officers is what their own staff are doing with the data, and the consequences of brand damage and compensation claims.
So yes, we are in a knowledge-intrusive society. The data is the most important asset of an enterprise but it is off-balance sheet.
BI-ME: Your Secerno.SQL Assurance appliance monitors activities on the server in a unique way. In simple terms, how does it operate?
PD: It looks at queries going to the database and what it recognises as normal for that particular activity. So it is not like a normal intrusion patch. We have adopted a machine-learning approach to restrict behaviour, which is why it lends itself to virtualisation [since the majority of cloud computing infrastructure currently consists of services delivered through next-generation data centres that are built on storage virtualisation technologies].
From the Secerno point of view, our technique is still being adapted within the company in a very fast-moving environment. Now with virtualisation, people want this technology. The advantage is that the core technology can be simply turned on. Deployment flexibility is the big issue to take this to blade servers and specialised appliances [such as ID card readers or other devices] if that is what the customer wants.
Meanwhile the model of appliances using SQL language is being joined by other models of data security such as SOA [service-oriented architecture]. We can use other revisions of our technology to protect these other models, for example a web services architecture.
BI-ME: How is Secerno structured for the Middle East and the SEMEA region as you define it? And do you define the Middle East market requirements as different in any way?
PD: Dubai is central to our business and it is joined by our other main offices in Oxford, UK, and New Jersey. We are covering Greece and the Balkans from Dubai and down to South Africa. We had such massive customer interest
The region is calling for adoption of new technologies and this is favourable for us. There is a good network of high quality partners and we find that our technology is being adopted quickly. There is a will to understand the importance of accuracy and ease of deployment of data. I can say that we have had a fantastic six months and the Middle East will be essential for us.
See also www.secerno.com