Scale AI while avoiding costly IT and Infrastructure investments with IBM embeddable AI
By Kalyan Madala, CTO, IBM ASEANZK
Sponsored By
Why partners must widen the security net to safeguard customers
This exclusive Channel Asia Roundtable cut through complexity to provide a framework to combat far-reaching and wide-ranging security threats
- 23 August, 2018 07:30
L-R: Aaron Lim (Malifax); Neville Burdan (Dimension Data); James Henderson (Channel Asia); Diwakar Dayal (formerly of Cisco); Tsu Pheng Lim (Logicalis); Nop Srinara (Datto); Leng Fong Lau (Netpluz); Hartony Tok (Sophos); Kelly Ho Ai Choo (ITMAP); Jack Ming Yeo (NEC); Bas Winkel (LeaseWeb); Prakash MK Bhaskaradass (Cisco); Adrian Chia (Cisco); Mark Johnston (Channel Asia) and Vincent Ma (Stone Forest IT)
Cyber attacks are increasing in scale and ambition, with hackers managing to squeeze through the smallest of security vulnerabilities causing maximum damage, creating heightened levels of customer concern across Southeast Asia.
To combat this issue, it's no longer sufficient to simply plug the gaps and fill the holes. The industry needs to move away from this simple cat and mouse game before they are exploited.
A more holistic approach is required in today’s security climate that is both well-rounded and resilient - this presents an opportunity for the channel.
Consequently, partners must implement comprehensive cyber strategies to bolster customer defences, backed up by specialist levels of expertise.
“A year ago, customers were discussing whether the threat from ransomware was really real,” said Tsu Pheng Lim, CTO of Logicalis. “That discussion has now subsided but new threats have emerged.”
High profile data breaches such as Singapore’s Singhealth illustrate the urgent need to rethink how security is managed and operationalised, irrespective of business size or stature.
Although not considered a long-term solution, the government is investigating in the possibility of employing a virtual browser as a means to reduce the number of possible attack points.
“The nature of the threats are changing at a quickening pace,” Tsu added. “A single defence system does not work sufficiently anymore.
“The customer does need a defence and they do need detection but they also need the ability to restore their services and network when a breach happens. A total defence of the customer is needed.”
Whilst the large enterprise or governments like Singapore with deep pockets may not require a managed service solution from the channel on every occasion - such is the size of internal IT departments - smaller organisations of the SME variety continue to benefit greatly from external services,
“Managed services are becoming a lot more prevalent now because of the resource crunch,” said Nop Srinara, sales director of Asia at Datto. “Smaller companies have fewer resources and they have less money to hire people so they would rather outsource.”
Smaller organisations find such services a business saver as they are unable to provide sufficient security measures on their own due to a lack of resources.
Of note to the channel, one trend is the move away from a pure system integration business model to one that includes a managed service component.
“They [end-user] would rather get a provider to offer an end-to-end service at a predictable cost,” added Nop.
Having the best security is not always about who has the latest technology or innovation. A major security hole for many organisations is still its people; a disgruntled employee, an IT admin who has left the company, for example.
“I think what is overlooked a lot in regards to security is how an organisation’s staff is organised,” said Bas Winkel, managing director of LeaseWeb.
“A lot of the security breaches that we see in the cloud have a human element, coming from disgruntled employees, backdoors, a system admin that is no longer with the company.
“We always have to keep this human element in mind when it comes to security. It's not about one layered defence or the best tools, it's the people organisations have to be careful about.”
A spate of targeted attacks have hit several regional countries recently, attacking infrastructure and searching for holes in security defences.
While a country like Singapore has generally been successful at preventing such breaches, other jurisdictions like Vietnam have not.
With the majority of organisations in Southeast Asia falling within the SME bracket, managed service providers (MSPs) need to step up expansion efforts to help secure critical networks and customer data.
“It's much more about targeted attacks now,” said Hartony Tok, country manager of Singapore at Sophos. “It's normally said that hackers do not strike twice, however, in regards to ransomware, a lot of our customers say they get attacked more than once.
“You need to know who your attacker is before you decide the best approach.”
There is a larger trend around data breaches being universal but this did not come easily for regional organisations.
“The traditional mode approach is no longer valid for today’s security environment,” said Diwakar Dayal, former security channel leader at Cisco. “What is required is more of an outcome-based approach.
“In certain countries and mature markets, customers are clear that they cannot do this on their own because of different reasons such as the availability of certain skills, people, and the cost of doing this versus a managed services approach.
“An SME may want to purchase a certain outcome and that outcome becomes the MSP’s responsibility. As markets mature the ecosystem becomes a lot more powerful because it has to be consumable, it has to be easily integrated, and it has to be open.
“It cannot be a single vendor or a single partner. It has to be multiple vendors and multiple partners together to make this a complete solution.”
Market challenges
Threats such as ransomware have increased alongside the rise of mobile solutions in the marketplace - this needs to be addressed with a comprehensive security plan accompanied by training.
Read more on the next page...
Page Break
The rise of the multi-cloud environment is also a clear trend but while there are obvious benefits such as greatly simplifying IT infrastructure improving business continuity, flexibility and cost-savings, there are additional security challenges and headaches such the increased prevalence of DDoS attacks.
But while the maturity of the market plays a role in regional strategy it still needs to be understood that the same threats that target Singapore also target Vietnam, India, Australia and the wider markets across Asia Pacific.
“The threats are global, whether you are in Indonesia or Australia,” added Tsu. “The maturity of the market does not matter; the threats are the same.”
However, “the kind of threats and the complexity of those threats change on an almost daily basis,” added Tsu, which Neville Burdan - general manager of security at Dimension Data Asia Pacific - refers to as “the shifting sands of cyber security”.
“We are not on a solid foundation,” said Burdan. “The sand is moving under the feet of organisation. We have got to be very nimble with regards to what we do.”
There are a number of challenges that exist in the market, one being customer confusion due to an overabundance of similar products and a lack of adequate safeguards when it comes to the tolerance of human error within an organisation’s security infrastructure.
“The customer could be looking at five or six different products just to be secure,” said Tsu. “Who is going to manage it for the customer?
“There are a lot of challenges in understanding the threat and understanding the solution and then being able to manage it.”
SME
For smaller sized businesses, there might only be a single person in charge of technology, which also presents an opportunity for the MSP to step in and provide an alternative which aligns to budget constraints.
“What many system integrators are trying to look for right now is something that is a bit more streamlined into a clear business outcome,” said Nop. “That is why the term ‘managed service’ is becoming a lot more accepted in this part of the world.”
From an SME perspective, Winkel said it’s not just a resource constraint but also a knowledge constraint for customers.
“Typically, SMEs do not have the resources to buy or to hire the people with the knowledge needed,” he observed.
Consequently, organisations must continually assess maturity and where they fit in the market - simply implementing a solution is no longer enough.
“There is this shifting of sand as companies migrate to these newer technologies,” added Burdan. “Companies are evolving but they are stuck in a static methodology; one that is not moving.”
Credit: Channel Asia Once the technology has been deployed, customers - through the help of channel partners - must be ready to respond immediately should a cyber attack strike.
“It is difficult to educate the customer to be on the same wavelength as us,” said Vincent Ma, pre-sales manager at Stone Forest IT. “That is why we provide managed services. It does not matter what product we actually use.
“We package the service and provide it to the customer and make sure that they are protected in terms of the bare minimum.
“The tough part is we need to get the entire security landscape idea into the head of the customer because for most, it's a one-man show. We provide a service rather than sell a product.”
Ma said there are “select customers” which will request a particular solution, irrespective of advice and guidance by the partner.
“For those customers, we do sell them the product they want if we carry it,” he added.
“For the majority of customers, however, who do not have a specific product in mind, we have the power to let them know that this is the product that they need to have within their environment to meet the minimum security requirements.”
Delving deeper, and according to Aaron Lim - business development manager at Malifax Technologies - most SMEs are ignorant of what is available in the cyber space.
"When we speak to SME directors the first response when we show the price is usually why do we have to spend so much money,” Lim said. “They would say they have nothing that an attacker would want to have.
“This is why I think we are facing a huge problem and that is why education by the government comes into play. When they say they have nothing for people to want to hack into they actually do not know what they have online.”
Read more on the next page...
Page Break
Echoing Lim’s observations, Leng Fong Lau - managing director of Netpluz Asia - acknowledged that within the context of security, the SMB market is more cost-conscious.
“If you talk to small businesses especially, they do not care which brand is used as long as its affordable and achieves the desired outcome,” he said. “I think the cost-conscious customer is a real opportunity here.”
Enterprise
Meanwhile, from the perspective of the enterprise, Jack Ming Yeo - vice president of Asia Pacific at NEC - said that “coming from the enterprise, I may not have those same challenges as the SME market has.
“I would say that most of our enterprise customers have a big enough budget to protect what is needed,” Yeo added. “They know specifically what there is to look into but the other perspective is that they have too much choice.
“There are too many products. Even after they have selected the product that is to be included into their infrastructure they have a problem managing it because a lot of the products may not be compatible.”
Speaking as an experienced industry leader, Yeo said some of the products available are only managing one part of security while other products are managing the other part.
“Eventually, you still have a security issue because the only security products you have do not protect everything so the attacker can still attack what does not have sufficient protection,” Yeo explained.
Yeo pointed out that whilst the data centre itself is well protected, it is not usually the source of the problem when it comes to security.
Instead, it’s those devices found at the edge of the network with endpoint security a major topic of interest in today’s market.
“The problem sometimes comes from the camera or the printer,” said Yeo. “These are things that are connected to a network.
“These are things that people tend not to see because these are perimeter products that they tend not to protect. I can see an increasing trend in that customers are looking for more endpoint protection.”
Market opportunities
Asia is over-flowing with opportunities for the channel, and as the first point of contact for many end-users, partners play a significant role in educating business on security maters and best practice.
“I have heard a lot of horror stories around security,” said Kelly Ho Ai Choo, general manager of ITMAP. “There are a lot of attacks in Vietnam, for example.
“There is a lack of education with regards to security. We are doing a lot of publicity and newsletters to help educate the workforce.
“I put such news and updates in different forums and collate this together to educate them on what is happening in other markets and what Singapore and Australia are doing.”
For Logicalis, customer complexity represents an opportunity to advise on the best total security solution based on budget and requirements.
“There are two routes that we take,” said Tsu. “One is a more strategic route and one is a more technical route.
“On the more strategic route, we would go with a solution that is more platform-based and end-to-end, which is tied into a fabric that provides intelligence to all the different components of security.
“One of the biggest issues around customer management is integration so we need to look at the complexities and problems around integration also.
“A vendor that can provide that end-to-end offering gets a vote from us as a platform that we use for a strategic push into the market through specific verticals.”
This exclusive Channel Asia roundtable was in association with Cisco, Datto and Sophos.