Adam McCord was named CyberArk’s vice president of sales for Latin America in January, bringing with him 17 years of cyber security experience in a variety of sales and leadership roles in this dynamic and expanding market.
CyberArk enables organizations to defend against both insider threats and external attackers who have made it past the network perimeter by securing access to privileged accounts, thereby limiting an attacker’s ability to move throughout the enterprise network. In his new position, McCord is responsible for expanding the regional sales team and partner network in Latin America to increase awareness and improve access to CyberArk solutions.
We spoke recently with McCord about the cyber security challenges faced by Latin American organizations and the role of privileged account security in proactive security programs.
CyberArk: Congratulations on your new role, Adam. You’ve worked for many years in Latin America, how would you characterize the market?
McCord: There are 50 countries in this territory, and all of them have different regulatory, budgetary and risk profiles. But the common denominator is that attacks are becoming more frequent and the impact of those attacks has become more significant over the last few years. In the past, attacks were more operationally targeted, and today they are more economically targeted. To paint a picture, industry experts project that global organizations will lose a staggering $2 trillion annually from malicious cyber activities by 2019. In Latin America today, approximately $90 billion is lost each year due to cyber crime, and that number is expected to surge as many local organizations remain ill-prepared to deal with developing security risks. It’s estimated that the total, average cost of each of these data breaches is $4 million globally.
The regulatory environment is also significantly stricter today than it has been in the past, driving awareness within organizations, not just of properly managing and protecting privileged accounts, but also of the overall threat environment. Businesses are making investments commensurate with that risk. Another common denominator is the insider threat, which is difficult to manage. From what we have seen in the region, roughly 70 percent of exfiltrated data comes from intentional breaches from within.
CyberArk: What is the status of the CISO in Latin America today?
McCord: Until a few years ago many organizations did not have the office of the CISO; it was a managerial role within the organization. It wasn’t on par with or reporting into the CIO. Today more organizations have a CISO – a person in charge of building a security program who holds a portion of the IT budget. They might call the role something else, but at the end of the day that’s what it is. Organizations understand that in this day and age, to mitigate the risk of appearing negatively on the front page, they’d better have a strong CISO office and a dedicated security program.
CyberArk: What conversations are you having with CISOs?
McCord: Today most assume that the perimeter has been breached and there are bad actors on the network, and the only way to avoid a grievous breach is by removing critical access from those users.
They understand that attackers need to escalate privileges and leverage credentials in order to move laterally and steal data, and as a result, they agree that it is necessary to secure privileged accounts. If you can’t escalate privileges you can’t move. If you can’t move, you can’t find the data. And if you can’t find the data, you can’t steal it. They also know that after a breach, changing all the passwords on critical systems is the first action to begin to rebuild a trusted environment. When they put these two things together, CISOs can take a proactive, preventative approach to help avoid serious breaches.
CyberArk: You mentioned that insider threats are a growing concern. How is this challenge being met?
McCord: There is very little that traditional security can do to stop bad actors inside the network. Everybody has a potential Snowden—the high level admin who is basically God on the network—and they can escalate, they can move, they can make changes, erase logs; they can do pretty much anything they want. Organizations don’t have any way to track and prevent this.
You can have the best technology on the perimeter, but at the end of the day, a malicious user on the network can get around any perimeter-based technology. So it is the protection on the privileged accounts that mitigates those kinds of breaches. This is the last line of defense before your data takes a walk out the door.
CyberArk: What about privilege-related risks in the cloud? Are these being addressed?
McCord: The need to control privileged accounts on the network is understood, and the next logical step is the cloud. Everybody is doing something in the cloud, or will be in the near future. And they’re not moving trivial applications—they’re moving major applications. The cloud creates new challenges in securing and managing privileged accounts – the attack surface is larger and extremely dynamic. CISOs realize the need to leverage the same technology to protect those resources, no matter where they’re located. It’s a natural progression.
————————————————————————
You can learn more about CyberArk’s solutions for privileged account security here.
