Data-centric Security: an in depth look at data security defense

Last year, organizations saw the highest average cost of a data breach in 17 years, with costs rising from $3.86 million USD in 2020 to $4.24 million USD in 2021. As a result, overburdened security teams are consistently trying to stay on top of the latest threats, vulnerabilities and hacker tactics.

Complicating matters even more is the rapid adoption of the public cloud, which has surged from $270 million USD in 2020 to an estimated $397 million USD in 2022. This fast-paced digital transformation gave way to the rapid development of digital products and services. Unfortunately, the cloud has also blurred the security perimeter and opened up more opportunities for attackers to exploit data.

While chasing down cyber adversaries and attempting to reduce the opportunities for hackers to attack seems like the right step to take, many security teams are missing the point: the data itself.

Be Your Data’s Guardian in the Cloud

Data has gone from a commodity to a currency. As a result, it is just as valuable for attackers as it is for business. Having a solid understanding of the latest cyberthreats is important, but just as critical of an issue is that security teams are almost blind when it comes to data residing in public cloud infrastructure due to the sprawl of cloud services and pace of change for devops.

And how can you protect what you can’t see?

There are three critical steps that security teams must put into motion if they want to maintain efficient and adequate visibility of sensitive data within public cloud environments and ultimately bolster security posture.

1. Find a Cloud-Native Security Tool

In cybersecurity, there is no one size fits all solution. However, the cloud is an ever-changing environment which means the solutions must change too. Solutions can now be built into an organization’s public cloud infrastructure to combat data breaches by autonomously discovering data stores and continuously analyzing and remediating risks or leaks. Too often do data security professionals and leaders find themselves unable to see the full picture of their data. Ensuring your security solution can integrate with cloud infrastructure allows for a seamless transition and visibility, identifying data that resides in the shadows.

With the ever-expanding public cloud, and how bloated with data they are becoming, CISOs everywhere are scared about their unknown and unprotected data stores. Criminals are capitalizing on this and repeatedly breaking through these systems due to the rapidly changing landscape – our defenses must adapt.

2. Monitoring and Protecting Your Treasured Data

As previously mentioned, a company’s sensitive data can and will be copied and backed up. It is an organization’s responsibility to ensure that this data can be properly monitored and protected. This responsibility can only be achieved by understanding the data, where it is, and where it is going. Security relies heavily on known variables hence a solution without full visibility compromises the entire organization’s security posture.

Whether accidentally or intentionally, human error can cause devastating losses both financially and socially for a company. Up to 85 percent of data breaches now have a human element. All organizations must understand data exposure, who is within their system and why they should be accessing public cloud data at all times, otherwise organizations risk losing their treasure trove.

3. Always Have A Plan

The “Achilles heel” in cybersecurity is too often, a leadership team with their heads in the sand. Far too many organizations believe themselves to be immune to the current ransomware crisis looming over industries across the board. It is essential to have an incident response plan and team in place. Excruciating detail should be provided for the roles that each core pillar of an organization should play during an ongoing crisis. Proactive monitoring of the crown jewels allows security teams to be notified of abnormalities and access risks that was not possible a few years ago. This Zero-Trust approach to data allows for less human error and more power into security operation centers.

A Data Centered World

Accepting that technology is fluid and ever-changing will dramatically assist security teams and leaders when it comes to protecting an organization. The cloud is here to stay, and it is being relied upon even more as the pandemic ensues and teams continue to work off-site. Thus, finding the appropriate solution for an organization’s security needs must become a foundational level priority moving forward. Personal and corporate data should be protected as the treasure trove it truly is. Efficient and effective Public Cloud solutions should be able to monitor and protect data silos, revealing what data is hiding in the shadows. It is important to remember that it is incredibly costly for business and reputation if cyber adversaries sell their treasure trove of data to the highest bidder.

Stay Ahead of the Data Protection Curve: The Top 5 Cloud Security Trends for 2022

New threats, new apps, new players, but data plays the biggest role in shaping the future.

2021 Cyber Attacks Set New Records

You may get tired of hearing all the doom and gloom of hooded cybercriminals and potential threats. But the reality is, your data, your company, and your personal identity is at continued risk. 

Just looking back, 2021 had its fair share of cybersecurity incidents, and some incredibly resounding ones at that. There was the Colonial Pipeline breach, where suddenly, the U.S. fuel supply was at risk of coming to a grinding halt. A ransom of $2.3 million in Bitcoin was paid to avoid that catastrophe. 

In the land of social media, tens of millions of Facebook, Instagram and LinkedIn profiles were exposed due to an unsecured database. The monolith that is Facebook went down, along with Instagram. 

Even online retailers were targeted. Bonobos, a popular men’s clothing retailer, was hacked and a cybercriminal snatched addresses, phone numbers, and partial credit card data belonging to over 7 million shoppers. 

Not to mention the added impact of COVID-19, and the number of healthcare organizations that were opportunistically attacked at a time when they were stretched way too thin.

So where is all this going in 2022? 

You can likely expect a continued rise in attempted attacks and new methods of targeting. But the one element to the advancement of security measures that will make a huge difference next year is data. And more specifically, cloud data. 

According to Techjury, it’s estimated that 1.145 trillion MB of data is created per day.  On average, every human created at least 1.7 MB of data per second in 2020. Per second, think about that. And 2021 saw over 4.66 billion active internet users. That’s 60% of the world’s population. Data is the key treasure in every situation and having a plan to safeguard yours is paramount. 

The Top 5 Cloud Security Trends (Plus a Bonus One)

1- Increased Investment will Improve Cloud Security

Each and every year we see more and more investments in cloud security. And that’s a good thing! 

According to tech analyst Gartner, ​​worldwide spending on information security and risk management technology and services was forecasted to grow 12.4% in 2021 to reach $150.4 billion in 2021. That’s nearly double the spending growth from 2020, at 6.4%. This aligns with Gartner’s 2021 CIO Agenda survey, where 61% of those surveyed stated increasing investment in cybersecurity was their top priority. 

And the spending spree won’t slow down for a while. Cybersecurity Ventures is predicting that, because of the need to protect increasingly digitized businesses, IoT devices, and consumer data, global spending on cybersecurity products and services will rise to $1.75 trillion cumulatively for the five-year period from 2021 to 2025. 

More specifically, cloud security is growing faster than the rest of the security market. According to Gartner, cloud security spending is projected to increase 41.2% between 2020 and 2021. Cloud security was the “smallest, but fastest growing” market segment, expected to reach $841 million this year. 

What does all of this mean? Better cloud security. 

While the spend is astronomical, the need is there. Data protection is the highest priority for many organizations, especially since much of the data is housed in the cloud. Consumers and businesses expect protection and they will weigh in with their dollars. It’s essential for companies, governments, and other entities to continue to invest in data protection in order to reach a better outcome; enable the democratization of data, but safely. 

In short, life will be better, business will thrive, and cybercriminals will begin to be thwarted as more investments are made. 

2 – Cloud Data Protection Will Keep Pace With Data Democratization

Digital Transformation. While that phrase is being batted around a bit frivolously, the reality is there: Every organization, no matter how big or small, is changing the way they operate through digital technology. And the majority of these changes involve taking processes and data to the cloud and making data accessible to everyone in the organization. This is data democratization. 

How does one define data democratization? In our view, it’s the ongoing process of enabling everybody in an organization, irrespective of their technical know-how, to have universal access to data, to work with data comfortably, and as a result, make data-informed decisions in their roles, creating new opportunities and improving customer experiences. 

Simply said, in our continual movement toward digital transformation, data is the new currency. It becomes the critical factor in making informed business decisions, making the right investments, and delivering personalized experiences that consumers are not only anticipating, but expecting. 

Think about how many organizations exist solely for the data they have. Companies like Facebook (now Meta), YouTube and Twitter offer free services but bring in huge revenues from advertising based on the customer data they hold. Many companies rely on, and pay significantly for, access to the customer data. So as more data moves to the cloud, and more access is gained, the need for data protection increases. 

Also in our view, we recognize how important data is, and how even more important it is to protect it. Protecting and monitoring your data is crucial to survival. 

You have to know the answers to five very important questions: 

  1. Where is my data? 
  2. Who has access? 
  3. What’s the security posture? 
  4. Who owns the data?
  5. Where is my data going? 

Right now, data democratization is outpacing data security, as developers have more freedom and agility with shift left, data protection teams have been left behind. But one sensitive breach can bring a company to its knees. So as more investments are made in the digital transformation, more investments are going to be made in data security and risk management. 

2022 will see cloud data protection begin to keep pace with data democratization. 

3- Cloud-Native Security Tools Will Become Mainstream

As more data is moved to the cloud, more workloads, processes and solutions are being natively built and run there.

A cloud-native tool or application is a program that is designed for a cloud computing architecture. These applications are run and hosted in the cloud, and are designed to capitalize on the inherent characteristics of a cloud computing software delivery model.

Security solutions built for the cloud, in the cloud aren’t totally mainstream yet, but are growing much faster than their legacy counterparts. In 2022 we’ll start to see many more of them arise and mature. 

Some larger and established organizations recognize this and are beginning to add capabilities to keep up. Many have made huge investments in acquisitions to try and re-define themselves as cloud-native and serve customers better. 

There are many advantages to security apps that are built and run in the cloud, and we will see that become mainstream in the course of the next year. 

4 – Security Teams Will Move from Gatekeepers to Enablers

In many organizations, the security team is deemed the gatekeeper. The ones that stop business teams from launching their newest project, or forcing developers to pass through rigid steps before finishing their application. It’s incumbent upon the security team to ensure every process follows strict security protocols, so historically, they are viewed as a barrier or hindrance within the organization; the ones stifling progress for rules that everyone else doesn’t understand. 

You might have had this experience. Frustrating, right? Even when you know there is a legitimate reason, it’s still keeping you from finishing your project the way you had intended. The security team has always been thought of as the “you can’t do that” department, but we want the security team to be the “I want you to do that but in a safe fashion“. 

Well, 2022 is going to see that change, as security teams move from being the ever-scorned gatekeepers, to the much-adored enablers. 

Why is this? Because as mentioned in item number three above, more applications are being built in the cloud, as opposed to on-premises. Cloud application developers don’t have as many restrictions, and don’t have to wait on a vast array of stakeholders to move to the next phase. At the same time, security teams are beginning to deploy cloud-native solutions that continuously monitor and enforce policy enabling a “trust but verify” stance. This way developers are not hindered and security teams can also move at the speed of cloud. 

Businesses need to move fast. They have to adapt, adjust, and grow to keep up with market demands, go after opportunities when they arise, and meet their customer’s ever-changing expectations. They can’t afford to have security shut them down. So to continue the digital transformation yet stay secure, the once-restricted gatekeepers will harness the power of cloud development and become enablers. Everyone wins. 

5 – Cloud Security Tools Will Continue to Emerge, not Consolidate…Yet

Take a guess at how many cybersecurity vendors and solutions are out there. 250? 1,000? 2,000? 

According to The Cyber Research Databank, there are more than 3,500 cybersecurity vendors in the market. And that’s likely a conservative number. 

If you’re a security leader, you’re probably getting bombarded with offers, ads, and pitches for the necessity of every vendor’s solution. There’s no way to pay attention to it all. And you may wish there was just one tool that was best-of-breed and was the one-stop-shop for all of the features and capabilities you needed. How nice it would be to have one tool as opposed to 10. 

Yes, consolidation is happening. Yes, it would be great to have more consolidation. But we think proliferation and more best of breed will continue to dominate in 2022.. 

Why is that? 

Let’s take Covid-19 as an example. Think of the virus as a new breach. When that breach hits, people scramble to build the defense to battle it, keep it at bay and hopefully defeat it. You develop a vaccine and are feeling good, but then, the Delta variant pops up, and you scramble again. Hoping to quell that slight variant, the next one, Omicron, arises. And on it goes. How many variants will appear before we feel we’ve completely addressed each and every threat? There is no real way to tell, so you keep building your defenses to stay safe. 

The security tool world is similar: Each year we see new tactics arise, new threats that weren’t predicted, and we scramble to build the tools to combat them. It’s a bit of a cat and mouse game, chasing new threats as they arise. And until these breaches slow down, there will continue to be new tools in the market. 

6 – Bonus! Analyst Firms Will Come up With at Least Three New Acronyms That are Must-Haves for Your Cloud Security Toolbox

SPITS (Security Protocol Infrastructure Technology), SAPPY (Secure Access Protection Platform Yeti), CATS (Cloud Application Testing Security). These are all must-haves! At least that’s what the analysts will tell you. They need to weigh in on this, right? 

Yes, we made those up. But they could be real someday. 2022 will keep the analysts cranking and keep you trying to keep up with all the new tools you need! We can pretty safely predict that. 

Cloud Security Trends 2022 Conclusion: Data Matters More

Data truly is the key element for business survival. And it’s also the element you need to protect the most. It is the new business currency and something everyone benefits from when harnessed securely. 

2022 will see better cloud security as investments continue to rise. And as data democratization continues to expand, cloud data protection needs to keep pace. The increase in protection, and the proliferation of cloud data, gives rise to more cloud-native tools, which, in turn, allows security teams to become enablers, not gatekeepers. 

In this cloud-first world, where digital transformation is happening fast and complexity is high, where development is happening in new realms, traditional methods are falling away. The ability to discover, classify, and categorize all the data within your public cloud environment is a necessity to stay safe and nimble.

Hello World, Meet Laminar

Data protection at the speed of cloud

There are rare moments while working on a problem when a much more significant, fundamental problem arises. When this happens, you drop everything and dedicate yourself to the issue that matters most. This is the story of how we founded Laminar.

Right before the pandemic hit in 2020, I was leading the project to develop Magic Leap’s first cloud API. Our API’s input data was everything the user could hear and see while wearing our AR device. Probably the most sensitive personal data one can imagine. We knew that this project would never see the light of day without best-in-class data security and privacy, so I started looking for off-the-shelf solutions. We had a standard cloud infrastructure setup, along with modern application architecture, yet when trying to ensure our users’ data security and privacy, I could not find any solution for preventing data leakage and exfiltration from the cloud.

Faced with an unsolved technical problem, I went about solving it the same way I had since age 14: I asked my friend Oran (now my co-founder and CTO at Laminar) what he recommended. At the time, Oran was the first employee and Chief Architect at Medigate. They had the same problem in a completely different industry, handling health information, and there was no good solution for it.

“data protection has fallen behind in the data democratization movement”

We then spoke with over one hundred CISOs about this problem and their attempts to solve it, and the universal feedback from these conversations was simple, clear, and very consistent: data protection has fallen behind in the data democratization movement, and security teams must find a way to gain control without slowing down the business. The cloud infrastructure transformation amplified that when it made development way easier and data protection way harder. Security teams have lost control of where their sensitive data is, who has access to it, and where the data is going. Without visibility, traditional data security policies could not be transferred to the public cloud infrastructure, and they had no way of detecting data leakage from this new environment.

We knew it didn’t have to be this way. We envisioned a different kind of world, where data protection could move at the speed of cloud and become an enabler for the organization. We felt that data security should ambiently fit into the day-to-day fabric of cloud development and seamlessly speak the same language developers do. We felt that data protection teams too deserve a solution that is cloud-native by nature: agentless, asynchronous, frictionless.

We envisioned a different kind of world, where data protection could move at the speed of cloud

It was time for a change. We dropped everything, left our jobs, and founded Laminar with a clear mission in mind: enabling organizations to unleash the full potential of data securely and transparently. Where data can have laminar flow and not be interrupted or held back by security measures, but yet still be protected. We have developed the industry’s first cloud-native data protection platform for organizations that process sensitive data in a public cloud environment. Laminar delivers complete data observability across the entire cloud stack, allowing customers to continuously Discover and Classify data for complete visibility, Secure and Control data to improve risk posture as well as Detect Leaks and Remediate without interrupting data flow. Both agentless and asynchronous monitoring of data stores, compute and data egress channels allowing sanctioned data movement and alerting when something’s wrong. Data protection teams can reduce the attack surface, detect real-time data leaks and be back in control of their data.

“we founded Laminar with a clear mission in mind: enabling organization to unleash the full potential of data securely and transparently”

I am lucky enough to have Oran – one of the world’s leading security experts and a four-time Google Capture The Flag (CTF) winner – as my lifelong friend. Together, we quickly built a fantastic team of incredibly talented individuals. We have all been innovating together for a year in a truly magical environment. We all came to the office every day over the last year, just because it was so much fun working together.

At Laminar, we are also proud to be backed by Insight Partners. Our ability to use their vast network and meet with hundreds of Global 2000 executives to get a better understanding of the problem and the market before we designed the perfect solution continues to be invaluable.

As we embark on this journey together, I look forward to sharing more about Laminar’s vision, product, market momentum, culture, and values. For now, I invite you to check out our Company Manifesto and some of the assets on our website. If we can help you protect your data in the new public cloud environment, please reach out. We’d love to talk with you.

Hello World, meet Laminar.

We are enabling data protection at the speed of cloud.

Amit Shaked