Bill Mew speaks with real experience about irony, the unexpected and Commvault’s big security announcements
We’ve all had one of those weeks when it is as if the gods of irony are tracking your every move. I write extensively about privacy, cybersecurity and cyber incident response and warn readers and clients alike of the dangers of complacency.
I am quite busy at present. Soon after completing an article on the risks that AI poses in the cyber arena, I was working with colleagues from the International Association of Risk and Crisis Communication (IARCC.org) on an immersive simulation for the government of an island in the Azores. We were illustrating to them that hackers are not the only threat that can take you off line. If you’re on an island in the middle of the Atlantic then a hurricane and vulnerable infrastructure can have much the same effect. And then finally I needed to write another article to cover Commvault’s big security announcements last week.
The Commvault announcement was of particular interest as they have been working to address one of the greatest challenges in cybersecurity. Having an integrated suite of tools that lets you move faster and be proactive, detecting and stopping threats before they can impact your data or your business. In their big announcement, Commvault had set out to redefine data protection for a modern world with a new layer of advanced security that anticipates risks, and delivers trusted recoverability.
As Commvault’s CEO, Sanjay Mirchandani, explained: “Commvault has spent the last four years redefining and expanding the capabilities of our platform to bridge the gap between IT and security. As a result, our customers can now be on the offense, taking it to the attackers by consolidating threat defense, backup, and recovery in a way that’s never been done before.”
From my perspective all of this was just another week on the job really … or so I thought.
My irony radar should have been on full alert when the article warning of the risk that AI poses in cybersecurity was flagged up and listed as a ‘cyber threat’ by the AI employed by a security vendor. The article was obviously no threat at all, but it contained some very clear warnings. The problem was that the AI that scanned the article found that it was riddled with ‘hot’ words like ransomware, risk, cybersecurity etc. Unable to tell the difference between a real threat and some insightful advice that mentioned these threats, it gave the article a red flag. Ironically in doing so it proved the very point made in the article that the rise of AI means that you can’t tell who or what to trust.
I am IARCC’s global cyber ambassador, I have the role of seeking to promote professional development worldwide on risk management and incident response as we seek to counter the growing cyber threat. We were developing was for a hurricane hitting the Azores – one of a set of immersive simulations that IARCC is creating to illustrate the wide range of potential global threats and the very real need for fire drills to ensure that we are well prepared for them all.
Far from being at risk from a hurricane, however, the UK where I live is currently experiencing a heat wave (the warmest June on record). I actually live in a 17th century townhouse that wasn’t really built for this kind of heat. To escape the heat my wife has decamped at night to the studio in our basement which is always nice and cool. However there were some annoying lights blinking that kept her awake so she turned them off – things like the SAN which I use to back up all my files. As we prepared to run the hurricane simulation for the client for the very first time, my trusty Macbook Pro suddenly died – just like that. I calmly switched to another laptop and everything went smoothly.
I was then free to finish my article on Commvault’s big security announcements. This was safely saved on my trusty Macbook Pro and backed up to my NAS. Or rather … my Macbook had just been rushed to the Apple store for critical repairs that will take a week or more and my NAS was sitting ominously silent without any flashing lights at all.
This gave me time to reflect on a series of really rather ironic events and something was nagging away at me. Was it the article about lack of trust and the increasing cyber risk from AI, that had been flagged up by an untrustworthy AI tool as a threat? Was it the hurricane simulation that had almost been completely derailed by a local heat wave? Or was it the article that I had written for a firm known for its leadership in back-up and recovery, that I had failed to back up?
Instead, all that I could hear were the words of David Ngo, CTO at Metallic, when he talked about defense in depth and preparing for the unexpected – you can see a full interview between him and Dez Blanchfield here.
The article that I had initially written for Commvault will be returned to me when I reclaim my Macbook in a week or so. To be fair it wasn’t as insightful as this version and will probably never see the light of day. It has been replaced by a heartfelt and illustrative tale, born of real experience, that shows that you really do need to be prepared for the unexpected, and that even the so-called experts amongst us need to remain vigilant and on their guard.
The problem is that the cyber threats are escalating all the time. While it was once enough to focus on immutability, adopting Zero Trust principles and air-gapping, these are now table stakes. Commvault is taking data security one step further, bringing more than recovery but focusing on resilience. Indeed it has made some remarkable advances. In a cybersecurity arena that is all too often undermined by a proliferation of poorly integrated point products, it has announced a set of closely integrated tools that live up to the mantra of ‘defense in depth.’
As Ngo explains: “Commvault is enabling clients to proactively secure data, accurately anticipate risks and effectively recover fast from security incidents.”
From a single code base and single UI, Commvault can provide universal management of its entire suite of Cobalt offerings via an integrated dashboard that provides full telemetry and observability. Its pedigree in being able to protect and back-up data across the proliferation of environments that are common in most complex organizations, is legendary – this includes on premise, public cloud, private cloud, SaaS, Kuberntes and even legacy systems.
Commvault has had active threat monitoring and AI/ ML powered anomaly detection since 2018, but unlike the dumb AI tools mentioned above, it is able to use machine learning to quarantine sensitive data and minimize the risk of either exposure or exfiltration as part of an end-to-end security strategy that is aligned with the NIST response framework.
Harnessing the intelligence of Threatwise, it can also strategically deploy decoys and sensors to divert and alert as threats arise. I would also recommend that you check out the integrations that they announced with Microsoft and CyberArk.
By expanding its security ecosystem, Commvault is helping organizations enhance their security posture through automated incident response, better collaboration, and deeper insights into the threat landscape. In particular, Commvault and Microsoft Sentinel bi-directional integration provides an enhanced security posture and improved collaboration between backup environments and security systems. This new layer of interoperability for IT and SecOps teams delivers automated orchestration jointly across both systems for combined cyber event insights, actionable countermeasures, and optimized incident response.
Added to this,Commvault’s integration with the CyberArk Identity Security Platform will help organizations follow strong Zero Trust architecture practices, deploy rigorous lifecycle credential policies and comply with the most stringent regulations. The new secrets management integration can significantly reduce the risk of credential theft with the ability to segment credential storage away from the backup environments.
As for this article. If by admitting to my recent failings I can illustrate how easy it is for any of us to have a lapse in vigilance, then I may have sounded a necessary note of caution. The thing is that this article also contains many of the same ‘hot words’ as before. Come on dumb AI – ‘do your worst!’