#171 Data Security in the Age of AI with Bart Vandekerckhove, Co-founder at Raito

Hi, I'm Maggie, VP of Curriculum at datacamp. And I know firsthand how overwhelming it can be to keep up with the rapid changes in data and AI. But staying ahead doesn't have to be hard. That's why our curriculum team has curated the best learning content to help you and your team stay ahead, covering everything from data and AI literacy for busy executives to cutting edge generative AI for developers, and everything in between. Whether you're upskilling yourself or your team, we make learning practical, engaging and flexible. It just works. Power your data and AI transformation journey on datacamp.com in today's age, data for a lot of companies is really a strategic asset, right? They use data to be competitive. Better products, better insights, better services and so forth. Now, in those organizations, if you're too restrictive, that can hamper innovation. So it's really about finding the balance, finding the balance between data access and data security.

Welcome to Data Framed. This is Richie. Data security is something that every organization needs to get right. If your data sets get stolen, then there's a big risk for disaster when you lose trust with customers and get in trouble with auditors. Today we're focusing on one particularly fascinating area of data security, namely data access management. As a data scientist, naturally I want access to every data set just so I can have a snoop around and see if there's anything useful to me. If I could get my wish, that would make me a huge security risk. So in many organizations, there's a big tension between data scientists and data security professionals. Two things have exacerbated the problem in recent years. Firstly, the size and number of data sets has dramatically increased. And secondly, the rise of AI has made cyber threats more scalable. Today's guest is Bart Banda Kakova, the CEO and co founder of data security platform Raito. Bart's background is interesting in that he started out in data analytics at BNP Paribus in Deloitte before moving to work in data privacy and security at Colibra and then founding Raito. That means he really understands both sides of the argument about who needs access to data. Let's hear what he has to say. Hi Bart, thank you for joining me on the show.

Hey Richie, thank you so much for having me. Super happy to be here because as a. Of course, as a Belgian, always been a fan of datacamp, admired the success of other Belgian entrepreneurs. So hopefully we can achieve the same success with Rito. And happy to be here. Yeah.

Great to have you here. So I'd like to get into security more generally, but perhaps we can start with data access management, since that's your specialty. Can you tell me what is data access management?

To talk about or explain data access management, we have to start by saying what it's not. So it's not access management. There's some overlap, but it's not access management. If you look traditionally how we used to manage access, it was really at the perimeter of the database or of the application. So you had access or you did not. Once you had access, you saw everything in the database or the application. Now with the whole cloud migration, everybody's moving their data science workloads or their data analytics workloads to the cloud. You're basically moving all your data from different applications, different data sources, and putting it in one location. And by doing that, you kind of lose a Chinese walls that you naturally have between these systems. And of course, with all that data in one location, that creates new privacy and security risks. I just took the numbers. So yesterday or the day before yesterday, there was a new data breach report for 2023. So it's like a report for all the security people. Each year we wait for it. And if you look at the metrics, you clearly see the results of the security risks of moving all that data to the cloud. It said that more than 60% of data breaches come from web applications. So your public data clouds, your snowflake, your redshift, your AWS, which are accessible over the Internet, more than 60% of those are the source of the data breach. And then equally we see, like social engineering being on the rise as a source, an attack vector that's being used. And that's, you know, because of the human factor. And if you look at the numbers there, you see that stolen credentials are the preferred way to attack, to breach a system or an application. So with more than 40%, and that shows that, you know, with all that data centrally in your AWS S3 or your snowflake, of course, you need to have the same Chinese walls that you naturally used to have between the different source systems. And of course, that means managing access at the most granular level, right? So for a warehouse, that means managing access at table level, in certain cases, even at column or row level. And then if you look at a file system, a blob storage like or AWS S3, that means managing access at the file folder and so forth. So that's really granular access management, hence the word data access management. So access management at the parameter does not work anymore for cloud databases. Now you really have to manage access at the data set level and hence data access management.

That is a really interesting shift that you can't just sort of throw up a firewall and sort of say, okay, we're done. It's actually, you've got to get really into the weeds and decide which what the access is going to be for, like every single data set at quite a refined level. You mentioned some of the downsides or some of the problems that can occur when you don't have good access management, like you can have security breaches. Is there a flip side where there are some benefits you see from doing access management well?

Yeah, well indeed. The predominant reasons to do data access management and do it well is of course always security and privacy, right? So people, and also your business partners need to trust that you'll use their data in a private and secure way. Now, of course, there are some benefits involved also, if you look, for instance, at data quality, right? So if you're a data engineer and you're working on a project, maybe you don't want to have the rights to drop a table, or maybe in certain cases you don't want data analysts to have write permissions so that by accident they can make mistakes. There's this aspect of providing guardrails. You know, you can work with data with peace of mind, that you won't make changes that are irreparable. That's something. We have one customer that is actually using data access management not to overwhelm the data analysts, right? So they're basically saying, look, this is the data that you need to do your job, right? The data, for instance, that has been refined in the consumption layer, all the other data, data with bad data quality or data that you don't need, we don't expose you. You can't even see it. You can't even see the metadata that's there just to prevent them from being overwhelmed.

That's a really interesting use case. And certainly from my experience, like working as a data scientist, a lot of places, like you join the company and like, okay, go and analyze the data. I'm like, okay, I've got access to the database. It's like, which one of these thousand tables am I supposed to look at? Is it documented somewhere? And then actually there's only like three or four tables or whatever that you care about.

No.

So having that restriction where you can only see what you need seems incredibly helpful. On that note, who needs to be involved in data access management? Are there any particular teams or roles where this is an important part of your job?

I Mean that's evolving. The whole concept of cloud data access management is a new framework that's being developed. What we see today is unfortunately it's predominantly data engineers doing the job. And that's because it has grown historically like that. Now that's not ideal because data engineers, they don't know often the business context of the data, this semantic meaning or policies that should apply. So that's not an ideal situation if you see which people are involved with our customers. So one is the data architect. So they typically select the tools that are being used. They do the data modeling, define the frameworks for the high level frameworks to use, data access management. Then we see of course, the data engineer being involved. They have to integrate data access management in their toolsets or in their data products. Sometimes that means by tagging the data products as a commit or even defining the roles that can access. And then if you see like more mature organizations there, you will see that the data owner ideally is also involved and they will approve and review access, they will approve the access requests. And then finally, in a bit more mature organizations, you also see that data governance is involved maybe together with the information security team or with the data privacy team, and that is to define policies and monitor compliance with those policies. So it's quite a handful of people to do that really well, so it.

Seems, because there's a lot of different people, like who in general is like the person who's in charge of this, who's sort of accountable for or the sort of data access management policy or.

Program who is finally accountable, that will typically be the person who is responsible for data governance. If they are there, right. That's typically the person where, how they say the bug stops or the bug passes. It's actually a great question, Richie. So eventually it's often it's senior management in case of a data breach or in case of privacy issues, that will be senior management person that's responsible to roll out data access management. That can be different people, like a CIO maybe, or the cto, the head of engineering, head of data. Again, this is starting to take shape. These frameworks, the roles and responsibilities.

Okay, so the job transfers are going to vary from organization to organization. But it's in general, whoever's in charge of data governance, that's what we see.

And typically so the person having the end responsibility, that can change. But the person that's always involved, like our champions are always a data architect. Or in smaller organizations it's a senior data engineer that has like these data architecture responsibilities.

And how does data access management sort of fit into a broader data privacy or data security program?

It's really just one of the tools in a, in a broader toolbox to achieve privacy and security. Right. So if you look at, well, it basically prevents unauthorized access and that's important from a privacy perspective in certain cases when it's personal data and in any case from security perspective also business critical information you want to prevent unauthorized access to. So if you look at purely from a security perspective, you often combine it with tools like multi factor authentication, you know, like the SMSs you have to respond to or last paths. Best practices are also there that you do data retention where you remove all the data, you apply SSO single sign on, you do password rotation and so forth. And therefore privacy, of course that is paired with things like consent management, doing the regular data privacy impact assessments and so forth. So it's typically just one of the tools that an organization uses to achieve privacy and security.

Okay, so things like authentication is about how do you, who gets access to the system and how do you prove it? You really you. And then this is sort of the next step is like once you're logged in, what are you actually allowed to do?

And I'm happy you said that. Richie. If you look at what's currently happening is it used to be iam, right? Identity and access management was one thing, but now it's a move to the cloud. We see that there's a lot of startups really specializing in both. So one, some startups are really investing or improving the identity space. So is Richie or is that person that claims to be Richie really Richie? Right. And then once claims, what can they see? So that's where we are. So in the authorization space, once you've defined or confirmed that Richie is Richie, what can you actually see? And it's really so much work because of the whole cloud migration. When things were still on prem, this was one thing iam and now it's specializing. And I think eventually that will consolidate again. But now because of the whole cloud migration, there's a lot of startups active in that space and specializing the offering there.

That's absolutely fascinating the way the industry's changed just due to this idea of like moving your data into the cloud. I'd like to ask, a lot of this seems to be focused on avoiding disasters. And have you seen any examples of, for example, productivity benefits or other benefits from doing data access management?

Well, it's really about finding the balance. So finding the balance between data access and data security. This is really a hard balance to find. We see some companies that want to move fast and they just give excessive privileges just to move fast and innovate. Of course there you expose yourself to the security risk of data breaches. A couple of examples there are the Capital One data breach that happened a couple of years back, the total cost of which was more than 80 million just because of over permissive IEM roles. Equally, there was the Optus data breach in Australia. So Optus had about 10 million customers. They lost 10% of their customers after the data breach. So a million of their customers left and took their business somewhere else. So that's the danger of just being over permissive in order to move fast and innovate. Now on the other end, if you're too restrictive and you've really secured access very well, there's the risk of, you know, too much red tape and long access request workflows. And in today's age, data for a lot of companies is really a strategic asset. They use data to be competitive. Better products, better insights, better services and so forth. Now in those organizations, if you're too restrictive, that can hamper innovation, which will really negatively impact your competitive position. So doing that well really means balancing the two, letting your data workers innovate, move fast while also keeping access secure. And that is a very hard balance to find. And that's something where currently you see the big tech doing it well, like Airbnb, Uber, they're doing that well because they, they're building their in house solutions for that.

You mentioned it's quite a cultural thing here. So if you have a very risk averse culture, then you probably want to going to want to lock things down a lot more. Perhaps if you deal with especially sensitive data you can be a bit more risk averse. Whereas if you're perhaps like a startup or a very small business, then you're going to want to be a bit more permissive because perhaps maybe you trust your colleagues a bit more. It's easier to trust colleagues in that situation when there's only a few people compared to when you've got lots of people.

Exactly. And that's also what we're seeing. So I mean, if you look at the past 10 years, what really happened was that data analytics really democratized thanks to scalable compute, scalable storage. So a lot of teams were able to do data analytics where they previously were not. So you see a lot of mid sized companies start to invest in data as a competitive asset. There was also a lot of new startups, cloud Native data driven startups that are using data to compete with the existing governments. So through that data democratization, a lot of data teams emerged. And you know, initially they were kind of small. There was a head of data, maybe a couple of data engineers, and their main responsibility was to prove the viability of data. Is there value in data and data analytics? You read it in the magazines, right? But is it also the case for us? So they invest heavily in those in that infrastructure. The first data products, the first data use cases, and the data teams that were successful now have more data consumers, more data products in the platform, more tools and so forth. But eventually they kind of ignored everything. Data access management, data security, because they had to move fast, put a value first, and the number of data workers and data consumers was limited. If it's just three, you can trust that. Indeed, Richie, they won't do any privacy and security breaches. And these companies, indeed, now they've reached that initial success, they are looking at ways to improve their data security and data access management.

Okay, so it's kind of part of maturing as a company that you want to start thinking about improving your data security. And does it affect different parts of businesses differently? Like, are there some areas where you might say, okay, we really need to lock down this data or we need to be really secure? And other areas of the business where you think it's maybe less important?

I think it really depends on the domains and the data that you're using, and also just the number of people. Right. So typically you'll start with everything, customer data. So in a marketing domain where you have a lot of data consumers, a lot of data analysts, there typically we see that people start where it's predominantly like service accounts or automated workflows. The need for data access management is less so. Prioritization, in short, typically starts with where you have the most data analysts, the most data, and also the most change, because that's where data access management is hard to do.

Well, can you tell me a bit more about why having change in your data makes data access management more difficult?

It's actually the change aspect combined with the volume that makes it so difficult. So going back to how I started, right, with the Chinese walls that you need in your cloud data warehouses. I mean, if there's no change, you set your access controls once and you're good, Right? So that's typically in operational systems. So if you look for instance at Rito, our customers, they do it for analytical data because there's so much change, they don't need Our solution for operational data, because you set your access controls there once and it's done, the change is very limited. Whereas in analytical data, definitely with the frameworks like self service analytics or data mesh, there's a lot of change in your data. Data products are being generated, new AIML models, new reports are being generated all the time. Preferably it's a high paced environment and keeping those Chinese walls up to date at very fine grained levels. With all that change, that is exactly where the challenge is.

So you mentioned the idea of a Chinese wall a few times. Just for listeners who don't know what that is, can you give a quick explanation?

So a Chinese wall means that you have a separation in your company that only certain teams can see the data for their domain, right? So Chinese wall means that somebody in marketing cannot see the data in finance, right? That's a typical issue that you see where you know, you frown your eyebrows that you were working with a company, you sent them your data just for billing and all of a sudden you start getting marketing, you know, messages. That is where their Chinese wall has been breached. So it's really a pain between different teams so they don't see each other's data.

I don't think we get through this without mentioning AI. So first of all, let's talk about the problem. So there's been so many advances in AI recently. Has that created any new data security problems?

AI has been, and I love this topic, just for the record, I'm not against AI, right? There's been a lot of doomthinking, it creates a lot of clicks, it creates a lot of commotion. And so I think in general AI will be for the good now if not managed well. Clearly there are privacy and security risks, even risks to democracy. So no denying that. So I want to start with that caveat now. Issues of the known problems or the impact of AI on privacy, that's a known problem, We've known that for a while now. You know, there's the example of the teenage girl where some kind of AI model knew it was pregnant before she knew and sent her some materials on pregnancy. And that's how our father discovered. Right? So AI, there are clear issues, people not getting bank loans because model decided that computer said no. So the impact on privacy is clear and it's great that we're working on that. And that is very important in terms of security. I think the problems there or the challenges at this stage are I think still predominantly theoretical, but I think what's clearly happening is, and it's Also in that report by Verizon, the data breach report, is that the human link, right. That's the biggest risk in security are the humans operating the systems. So there, the social engineering is on the rise, right? And I'm expecting AI to do that at scale. Human engineering at scale. Just a prime example is some of our guys at the company here. So they've been getting mails from an impersonator pretending to be me to ask them, hey, send me the list of accounts and their contacts. Same happens in companies where the CFO or the CEO sends an email and again, an impersonator with a lot of urgency, you know, wire 1 million to that account, this and that, right? You can really pressure humans into behaving erratically. There was this. There's a video on YouTube where you see a social engineering lady, she calls the bank of the interviewer. So if I were her, Richie, I would call your bank and there would be this noise of a crying baby. And she pretended to be the mother, Richie's wife, brushing the bank into giving the credentials because she urgently needed to do a transaction. And they just do it. So humans are the attack factor. And increasingly that will happen in the movies where you see a hooded hacker typing code away and getting into every system. That's not how it happens. It happens to humans through email, phone calls, LinkedIn messages. That's how organizations get breached. And if you look now at the developments in AI, how easy it is to impersonate a person, just an image, a couple of seconds of voice material, and every CEO like myself has to be public, right? So maybe there's some guy in Russia or China will use this podcast to impersonate me. Because there's plenty of materials here, and with AI, you can just do it at scale. So it's going to be so much easier just to target people and impersonate to be the CEO. So that's one way, AI will be a threat another way. And that's, you know, bear with the trend of moving towards data ops where data teams apply. Best practice from DevOps is that AI will scan your GitHub, right? And they will look for privileges and accounts that they can just use to access your data. And apparently it's a source of data. Breaches is where you use, like the default IAM roles. They scan your GitHub, they take those roles, and boom, they're in and they have all your data. So AI definitely can be a threat there. But I think AI will also be the solution.

It seems like the biggest thing like at least for the moment, is just sort of AI can generate better phishing emails. But also, I mean, you mentioned it's easy to impersonate people. And now I'm thinking, well, yeah, there's a lot of podcast episodes of me. It's probably quite easy to clone my voice, maybe a challenge for our listeners, see if they can do that. But so you also mentioned the idea that you can. Like, there are a lot of, I guess, things like API keys or account credentials that are available in public locations, and it's maybe fairly easy to scan. So it does seem like there are a few new sort of attack vectors there. But then you said that AI might also be useful for mitigating these threats. Can you talk me through how that's going to work? How's AI going to solve the problems?

It's really about scalability, right? So AI, in a way, creates a challenge. You know, with AI, we have so much data. A lot of that data is oftentimes, you know, created by the machines. So you got a lot of data that you have to cover at very granular levels, where access management used to be a predominantly manual process. Now, of course, you can't keep up. So you need AI to support you in that, right? It's like a second pair of arms, second pair of eyes. And so in data governance, and that's a space I come from, something that we've been working on for a while is automated data classification, right? So as data enters your lake or your warehouse, you automatically tag it. Hey, this is sensitive data. Oh, watch out, you got customer data. I mean, you are finding some payment card information here. And then based on those tags, you automatically apply the right policies. By the way, Shameless Plug, that's what we're doing with Rito. So end of Shameless Plug. So that's one thing of making it scalable. Other ways are like automatically finding misconfigurations. You know, maybe you got buckets that are have been misconfigured. But you also see it in threat detection and anomaly detection, right? Seeing weird changes in how people are accessing the data. People that are normally not accessing data in the weekend all of a sudden do it. That's a clear hint, clear example of something odd happening. And that's where AI also helps. And then just finally to close off, AI will also help with recommendations, right? So detecting. And it will also help with recommendations in the sense that it will just scan your configurations or your access controls and then make recommendations to improve that. So it's really about Leveraging the data security people working on the topic.

Okay, so a lot of it's about just automating tasks that might be maybe boring or like that humans just can't do at scale. But you mentioned anomaly detection. I'm quite glad you did, because I always felt like anomaly detection is one of those really interesting bits of data science that tends to be a little bit overlooked. Can you just talk a bit more about, like, what are the cool things you can do with anomaly detection in security?

But not an expert in anomaly detection. So I can tell you what I know. So it basically looks at the way that people use data and then they have like a baseline. So this is my colleague Mark, typically uses that much data, these data sets, to do their job. That's their baseline. And then anything anomaly that's raised as a flag. So all of a sudden, Mark is downloading terabytes over a weekend. Well, it can be an anomaly. You detect it, you raise a red flag. Can be that Mark is disgruntled, he missed a promotion, he's gonna leave the company. But before that, he just gets the whole customer data set. It's a. It's a prime example of what happens. So really just seeing where people diverge from their normal behavior. I gave a funny example. It's a funny example, but in reality, it also means attempts to log in. Right. So any weird behavior that you do with data on your system, because a hacker will typically try multiple ways of accessing the data, multiple ways of accessing the system they're navigating. Right. There's a lot of navigation before. Before they find the crown jewels. And there's typical paths that they follow. And anomaly detection also picks up on these spots that a hacker typically uses to get to the crown jewels.

Ah, fantastic. All right. And so related to this, we talked about the sort of technical aspect of how AI is changing things. Is AI changing security culture as well?

Like I said earlier, the times where you could just do things manually have changed. So the pace is much higher, the scale is much higher. So a lot of automation is needed. And then the data security practitioners. There's a slew of tools out there that help use AI to scale data security workflows. So, of course, these tools are becoming more important. They are training those tools. I think one thing that doesn't change or maybe even became more important is education. So AI is going to be used for phishing, to get credentials for social engineering. So I think if anything, training your employees will become more important. Creating that security and privacy awareness with your colleagues, creating, creating the awareness of data, of the value of the risks associated with data, is going to become more and more important. So that awareness and the training, that's going to become very, very important.

I love that you mentioned education and skills. It's one of my favorite topics. So I guess there's a big difference in what the data security professionals need to know and what everyone else needs to know. Maybe we'll start with the second group. So what are the sort of most important things you think that everyone in your organization needs to know about data security? Like, what's the one thing you'd want.

To teach them when you're working in it, day by day, you will have tendency to say the 100 things that matters. But one thing that matters is people have to realize that data used to be an exhaust. It used to be immaterial, right? You did your process and out of that came data, and it was just a side effect. Now data has become, for a lot of companies, the most strategic assets. So it has a lot of value. But with that value always comes risk, privacy or security risks. Something cannot have value with zero risk. So the one thing that is important for people to realize is data is valuable, hence it is risky. So never make rash decisions. When people are pushing you to do something with the data that doesn't feel right, don't do it. Just hold off, think about it, take a breather, and then just think about best practices. So number one lesson is, as with anything data, when it has value, it's also risky. So be careful with it.

That seems like great advice. Just remembering, yeah, this is a valuable thing, not just some numbers on the screen. And so, yeah, it's something you need to protect. And related to that, for the people who are data security professionals, is there something that you think due to all these recent changes, they might have a misconception and there's something that they used to believe and is now wrong.

Something that we're seeing is, and this is not something general, but what we're seeing is where typically, or more specifically where data access management projects typically fail, is where they try to do too much at once. So if anything, if you want to improve data access management or data security, just go for the least intrusive path and start from your current state. Just get a good sense of what are the business requirements? What is a business strategy? How does data strategy support your business strategy? And then what does that mean in how we're going to use data and hence how we have to manage access to it get a good sense of that, then understand how you're currently managing access, what are the usage patterns? See where is a discrepancy between the preferred ways of managing access and the actual ways of managing access, and then just gradually moving to a better state and then each time iterating, reassessing, reevaluating, adjusting where needed, and then just gradually expand the scope of the program. Where we've seen it fail is to companies that have not. Let's be honest, data access management for most people is not sexy like the data scientists. They don't care, right? Actually, they want their admin privileges. Same for data engineers. It's more of something that prevents them from doing the things they want to do. So they're not waiting for you just to disrupt data operations to improve data access management and data security. So that's the number one piece of advice is just do it incrementally, gradually prove the value early and along the way. And just as you've proven the value, expand the scope of the program.

I think it's very true. It's maybe something that people just want to set once and then forget about it because, you know, they've got other things to do. But as she is saying, it's something you need to maybe at least have someone responsible for monitoring contingency and making sure that processes get improved. Are there any other common mistakes beyond just not doing anything about this? So do organizations just make any big mistakes around this?

Yeah, well, the most common mistake is thinking the tool will fix everything. Actually. I hope I'm not doing harm to Rito in this way as a vendor. Right, but everything starts with culture. Everything starts with people and process. So just buying a tool and thinking it will act as a silver bullet is not a guarantee. And I love to use the example of Facebook. And I know I'm jumping on the bandwagon here, but actually Facebook has great technology in terms of data classification, automated access controls, yet it's privacy breach, security breach after another. So it shows that culture really matters more than the tools, even best tools. If the culture is not there, it's not going to work.

In that case, do you have any advice for maybe what constitutes a good culture to begin with?

I think it's a good culture means, you know, culture where you respect your customers and your business partners trust. That's where it starts. So it's a culture where of course you have to move fast, but don't move fast at the expense of your customer's trust or your business partner's Trust, so don't be careless with their data and just don't do things that are, that create privacy issues or might create security risks. So it all boils down to their trust. And this will also eventually might prevent you from moving faster early, I don't know. But eventually in the long run it will definitely make you a more sound and durable company.

And if you have someone in the organization saying, okay, we need to get better at data security, we need to improve our culture. What's step one? How do you begin?

Step one is really analyzing your business, the business strategy, how you want to use data to support that strategy, and then what that means for access control. So just getting a good grip of that, getting an understanding of your, how you're using data, how your colleagues are using data, how business uses that data, the business process and so forth. And then assessing, okay, how is access managed today? Because ideally your access controls kind of reflect your business process. It's only when there's a discrepancy between these two, you get, you start having all these issues like role explosions, toxic policies, excessive privileges and so forth. When you know that, that's when you assess a change that has to happen. So what do we have to change? Which access controls, which new systems do we have to implement? You introduce that change and then you evaluate and then readjust where needed. And again you do that iteratively, right? So start small and just iteratively analyze, decide on the change, implement that change and then evaluate, assess the impact of that change, learn and do it again. And all the time throughout that process, of course, you train people, you communicate well, and that's how you can gradually expand the scope of the program successfully.

Okay, so it really is all about getting the process right, getting a lot of training in place upfront. And I think a lot of it is about like deciding goals as well. So are there any like specific goals that are kind of good for getting started in terms of improving your data security?

So I think the goals that you set is of course you can have some goals in improving security. I think that's a bare minimum. Reducing the over privileged users or excessive privileges, reducing the reliance on the default roles that tend to be over privileged, unused roles and so forth. So that's, I mean that's what everybody understands. But I think some other goals or targets you want to achieve are just the productivity gains. And that's when you start getting the business on board when you can make them more productive through better data access management. And there a classic example, people go look for A solution is to reduce the time it takes to get access to the data they need. Right. So I've heard organizations where it takes weeks to get access to data. Now with a good data access management solution, good framework, you know, good roles and processes that can be done in a couple of minutes. So just reducing the time for access, also reducing the time you have to spend in answering audit questions. You're going to get audit questions. There's also new regulation upcoming so you can expect, you know, you have to spend time in responding to audit, creating reports. So a good framework can help you save time there and then, you know, God forbid, you know, knock on wood, the time spent responding to incidents. There was a, I forgot the details, but I think there was a long time ago and this is not a security issue, but this was more because of regulation around competition. Actually Microsoft, they missed the tablet market back in the day when Apple came out with the tablet. Microsoft also had a tablet, but there was an audit or they were sued. I, I forgot the details around their competitive behavior and they had to focus their attention on answering questions from the supervisor and the regulator. So they couldn't focus on the tablet marketing, building a tablet. So they missed the boat there and Apple took that market. So I mean yes, there is a prone investment in better security, better data access management, but the time it saves you, responding in case of a data breach, responding to incidents, answering the supervisor and the auditor, it's a lot of time that you save there. Companies, they, they lose, they lose markets because they have been distracted because of audits or supervisory questions or data breaches. Look at optus, they lost 10% of their customers.

I think answering questions with auditors is nobody's idea of fund. I don't know, maybe other auditors. So saving time there seems like a pretty huge benefit. And you also mentioned that in some companies it can take weeks for some process to play through to get access to data. And we talk a lot on this podcast about doing real time data analyt and you really can't do real time analytics if you've got to wait a few weeks to even get started. All right, so are there any low hanging fruits that companies can typically make in order to improve their data security?

Data security in general there you have easy stuff that are pretty straightforward and something that we did actually at Rito when we got our first customers, it's pretty easy to implement. It's stuff like multi factor authentication. Each time you log in, maybe after every 30 days you have to confirm that you are really who you are or you claim to be having password policies like password rotation. You would be surprised how efficient it is to rotate passwords. Because the Internet, how they call it, the dark web, is full of passwords. So relying on your old passwords or combinations of old passwords, which I used to when I was younger, that doesn't work. I'm sounding like a boring old fart. But you know, installing the regular security updates, you know, everybody heard it before, that helps. And now more and more you see that cloud providers, they come with native encryption capabilities. Just switching that on already is very valuable. So that's data security in terms of data access management. And there I'm falling back what I already said several times. So falling back on that is just getting insights in, you know, your access and your usage. A lot of people are blind in that aspect, so getting good sense. How is access configured across my data sources? What are my usage patterns? Understanding that is a low hanging fruit because it helps you prioritize change.

Suppose you do have, you do decide to go ahead, you've got this data security program gone. How do you know when you've been successful? How are you going to measure the successful improvements?

So some of the metrics that I said earlier, so reducing the time to access, reducing the time to answer audit questions, but also just like covering some of the risks that are out there, a metric I saw, I think it was by Microsoft that said that only 1% of permissions granted are actually used.1%. So that means that 99% of the permissions granted are actually not used. So that's a huge security risk. Right. If those are credentials, if a user's credentials are breached and you got 99% of permissions that you can use, of course you just leave the door open. Reducing the unused privileges, reducing over privileged roles, over privileged users, these are some important targets to achieve. And of course reducing the time to access. And the other questions. I think I already said that.

I've got a horrible feeling that if our IT departments listen to this, I'm getting some permissions revoked very shortly. But that does seem like a good idea in general, only give people the permissions that they need in order to do their job.

So that's least privileged access, Right? So purpose based access controls, you only give them access to the data they need to achieve certain purpose. But you'd be surprised how often people forget to revoke access. Right? So the hygiene in revoking access and just in time access, or just enough access where you only get the access at the time you need it and only enough access. That's where we're moving towards. But I mean we're all learning. A lot of companies are still at infancy. So just make sure that you're not the worst because then you're going to get breached.

Do you have any advice on dealing with pushback from data analysts or data scientists when you know they get their permissions revoked, they're not happy. It feels like that may be a common sort of point of organizational tension. How do you deal with that?

I remember getting admin privileges and the sweet, sweet taste of admin rights. You know, of course I didn't tell them that I still had admin rights after a week I was supposed to, you know, they were supposed to be revoked. I was hush hush about it. So I know how valuable it is to have admin credentials. We've seen a lot of companies fail doing that wrong way. Actually when you have to roll out data access management, you're kind of putting your name and fame and your career on the line in the company. That's why a lot of people are hesitant to be the person doing that. Right, because if you take away privileges and you don't give anything in the return, you're about to fail. Right? Because they're going to work around you, they're going to find ways to work around your security. So it all starts with good process to get the access. I'm really in favor of just removing unused privileges for data analysts. But then of course in return, when they need that access again to do their jobs, then it needs to be super straightforward to get that access. And again, something we are working, that's something Ryto helps with. But more important that requires good process. You know, you need to assign owners to prove access and you'd have good workflow in place to request access, configure permissions and then have an audit log of that all.

And before we wrap up, is there anything you're working on at Ryto at the moment that you're particularly excited about?

Yeah. Oh wow. That's a funnily or surprisingly seamless question. So what I was just saying about, you know, automatically removing unused access, that's something we're working on with the Policy Recommender. So we have this AI module, some of our engineers actually use that work at CERN in, and have PhDs in physics. So we have the right people to do that. But there in return, of course, we also have the concept of pre approved access. At Gartner they call it birthright access. But I prefer Pre approved, that's less dramatic. And it basically means that, you know, if you have to do a certain job, that access can be pre approved. So when you request it, it will be automatically granted. And then another way of automating that we're working on or automation that we're working on are tag based policies where you can set policies on the data attributes and user attributes. Again, can write a policy that says if somebody in marketing requests access to customer data for churn analysis, just automatically prove it, maybe reduce access for a month and then automatically revoke it. So we just bring in the automation. That's what we're currently working on.

Okay, so really just about saving people the hassle of having to mess about this manually. That sounds very useful.

Perfect pitch.

Nice. All right, super. Do you have any final device for organizations wanting to improve their data security?

Don't start too soon, but also don't wait too long either. So if you're still proving the value of data analytics and you're a small number of data consumers and you don't have a lot of data. Yeah, I mean, who cares, right? I'm focused on proving the value first. But soon as you see that it's taking traction, you start getting more data consumers on the platform, more and more data, or you start seeing more tools being used. That's really when you start seeing the scalability issues, the growing pains in access management, and that's really the time to start thinking about it. The longer you wait, of course, the harder it will be to retrofit. So. Or find that sweet spot. And that's typically where you see long access request workflows or questions around data access and usage observability. No, that's about right. Time to start thinking about it.

All right, so not too fast, not too slow. Just find the sweet spot. The Goldilocks approach. All right, Fantastic. Okay, thank you very much for your time, Bart. It's been great having you on the show.

All right, thank you very much for having me, Sam.