Mandy Andress Explores Data Protection, Compliance, and Modern Threats: Cybersecurity awareness month 2023

Mandy Andress, Cybersecurity Expert, Discusses Data Protection, Emerging Threats, and the Role of a CISO

In a rapidly evolving digital landscape, the significance of cybersecurity cannot be overstated. As we observe Cybersecurity Awareness Month, Mandy Andress, a seasoned expert in the field, emphasizes the importance of maintaining a vigilant stance year-round. With over two decades of experience, Andress sheds light on various facets of cybersecurity, from harnessing the power of data to compliance with evolving regulations. As a leading figure at Elastic, she provides insights into modernizing security operations and navigating cloud migrations amidst global threats. In this interview, she offers valuable perspectives on the role of a Chief Information Security Officer (CISO), emerging technologies, and the critical link between compliance and security. Join us in this illuminating conversation with Mandy Andress, a stalwart in the realm of cybersecurity.

As we kniw this month is Cybersecurity Awareness Month, would you please talk about the importance of this month?

Mandy Andress: I like to think of every month as Cybersecurity Awareness Month. In the world we live in today, we need to be vigilant at all times, paying close attention, and keeping top of mind the ever-changing threats. So, for me, it's every day, every month, every year, it's a cybersecurity awareness.

How can Indian organizations and enterprises tap into the underutilized potential of data?

Mandy Andress: The power of data is incredible. It's in the aggregation, where we have a tremendous amount of data spread across organizations and the globe. Gaining visibility into that data and analyzing it for trends, anomalies, and different types of activities can provide valuable insights. We can understand behaviors, trends, and what's happening in various environments. What's increasingly interesting to me is the addition of LLM Gen AI, which allows us to gain even deeper insights into data. With computing power, we can see trends and insights that we wouldn't have anticipated or thought to look for. This is fascinating to me, and from a cybersecurity perspective, it will help identify new threat vectors and attack fronts.

How have recent regulations like the DPDP (Personal Data Protection Act) in 2023 influenced the way organizations handle personal data?

Mandy Andress: Over the years, I've seen the increasing importance of privacy in conjunction with security. Protecting personal data has been my top priority. Privacy and the control of data for individuals are growing areas of focus. Europe has had these regulations in place for a while, and they are now expanding globally. We need to understand anonymization and ensure personal data protection while adapting to new technologies and data processing methods. Privacy and data protection will remain key topics in the future.

What are the key challenges organizations face in complying with data protection regulations, and how have they adapted their cybersecurity strategies to meet these requirements?

Mandy Andress: Meeting requirements begins with understanding the data's location and flow. Third-party risk management is crucial as partnerships and integrations become more prevalent. Companies need to ensure that their partners approach data security the same way they do or even better. Understanding data flows and keeping inventories current is essential due to the complexity and constant change in modern environments.

How do these regulations affect the development and implementation of cybersecurity technologies and practices within organizations?

Mandy Andress: It involves two aspects. First, implementing tools and processes within the security program to ensure data protection. Second, ensuring that business processes and new technologies are implemented securely and with privacy and security as top priorities. Security by design and privacy by design should be integral from the beginning.

What measures are Indian businesses and individuals advised to take to enhance their cybersecurity posture?

Mandy Andress: The focus should be on the basics: turning off default configurations, changing default passwords, keeping software updated, and using strong multi-factor authentication. By focusing on these fundamentals, individuals and organizations can protect themselves against a majority of today's threats. The Center for Internet Security's Top 10 guidelines provide a good framework for improving security posture.

Can you share any examples of contributions from companies or organizations in the field of cybersecurity?

Mandy Andress: What I've seen over the years is companies increasingly working together and sharing threat information, even if they are competitors. This collaboration is vital to better protect customers, employees, and organizations as a whole.

How does the role of a CISO align with compliance and regulatory requirements in various industries?

Mandy Andress: In heavily regulated industries like financial services, the CISO works closely with the Chief Compliance Officer to ensure that the organization meets all regulatory requirements while maintaining strong security. The challenge is to strike a balance between compliance and security without sacrificing one for the other.

How is Elastic working with enterprises to modernize security operations and posture during cloud migration in the face of global threats?

Mandy Andress: Elastic provides the ability to bring data together, analyze it quickly, and gain insights into complex environments, whether on-premises, hybrid, or multi-cloud. Its strength lies in data analytics, which helps organizations understand what's happening in their data, be it security data, observability data, or any other organizational data.

What are the key responsibilities of a CISO in the digital landscape?

Mandy Andress: The key role of a CISO is to make connections and bridge communication gaps across the organization. The CISO touches almost every part of an organization and needs to ensure that potential exploit points are closed, thus safeguarding the organization from threats.

What are some of the emerging technologies that CISOs need to be well-versed in to effectively secure their organization's assets?

Mandy Andress: Cloud technology and AI/ML are at the forefront. Understanding how to secure cloud environments and how AI/ML can be used for both security and threats is crucial for CISOs.