Compliance Challenges in 2023 – Asaf Kochan, Sentra

This is Textron TV. Hey guys. Thanks for the throw.

We're here with the stock Cohan who is president for Centra and we're talking about a round of investment. They picked up or dressing data security issues a soft. Welcome the show.

Thank you. Mike pleasure to be here with you. I don't think everybody knows who you guys are.

So what exactly is the issue that you are addressing and what do we need to do to fix the current state of data security? Okay, so we're Centras that was founded about 18 months ago. And it focuses on securing sensitive and critical data in the cloud environment.

The reality is that most organizations are obsessed with the prevention but once attacker breaches or enters an environment. It's like being in the candy store sensitive data is all over it's not secured. It's not protected that in many cases.

Substantial amount of organizations don't really know where the sensor data is so tensor basically fixed this problem with a classifies discovers. And assesses the risk to the data and after that enables the organizations to apply the correct security controls and policies very specifically and accurately on the sensitive data itself rather than protecting all the rest. There's a lot of folks who would say we should just encrypt everything in the cloud.

You hear Amazon talking about that all the time. Is that feasible for organizations, or do we need to kind of have a different approach for different data based on its sensitivity? So the primary feature of the idea behind the cloud is to unlock the potential of data and really to transform data into actionable insights and knowledge.

The reality that it's it's extremely complicated to encrypt data in all Cloud environments because then you can process it. Then you can't manipulate manipulate it then you can't get the insights because you have to decrypt it to do it. So it sounds good.

But in reality most organizations have cloud multi-cloud data Lakes endpoints and services coming from third parties application. If you would encrypt everything it will be ideal, but you wouldn't be able to process and understand the data. Who's in charge of classification of data these days because I feel like sometimes you know, the IT people tend to treat all data relatively equally the security people wouldn't know what data sensitive and the business people might but they're too busy or they don't often classify it.

So, how do I kind of navigate this issue when I got Three stakeholders who are not fully in charge of anything. Like this is spot on the new you touch one of the most complicated questions in organization nowadays who's in charge of the data. And it happens to be that there are many stakeholders in charge of the data.

So as you said it's the people who monetize data who create Revenue the engineers who build applications and services the compliance and the Privacy guides who maintain privacy and Regulation and the security teams who have to protect it. So in reality in some organizations, it's it's it's it's located in under the CDO the chief digital officer the data officer, but in many organizations, there's not yet a studio. And in reality, they're multiple stakeholders who have to align together.

And find a way to collaborate in order to make out the most of the data to make the data profitable secure and align with regulation, of course to develop great product. So it's a complicated task. There's a lot of folks who say they secure data.

What would differentiate you guys from the other players in the marketplace? How did you kind of uniquely go about solving this particular issue? So I would Define it on true levels.

First of all, we are totally 100% cloud-native. Our technology wasn't born on the on-premise environment. It was born in the cloud.

It takes the resources the cloud to the full extent. So it would be the compute the storage the services and obviously the automation with the cloud enables the second layer, which is more strategical Central looks at the entirety of the cloud environment. So we look at the infrastructure there.

We look at the platform layer and we look at the SAS layer. So basically our vision is to be able to protect identify and secure data wherever it is, we're agnostic to what a vendor is holding the data. It might be in Snowflake or in gcp or in Azure or in AWS.

So in mongodb or in a 365 or any other sales force soft application Central discover your sense of data. And assess the risk and help you to secure the most valuable data and this is really the unique feature about Centra. No companies or vendors are so obsessed and focused on cloud.

Most of them come from the on-prem environment. Their technology is bulky and it it's very hard to migrate these kinds of Technologies from these environments to the cloud environment and maintain Effectiveness and they're also very costly Central has the very very unique model of doing it in a very reasonable and low cost price for the customer. We take sometimes the models we use in the past and apply them to new platforms such as the cloud and I think this is no different.

Do you think that maybe we're a little obsessed with thinking about the cloud as something that has a perimeter that needs to be protected and we're not focused enough on Just securing the data and if we did that we might not have to spend as much on the perimeter. Yeah, so so yeah again Mike excellent point you're bringing out up here in the cloud. There's no perimeter.

There's no it's very hard to define the network. It's very hard to define the limits and historically the idea of having a perimeter really belong to the on-prem environment where you had a physical kind of data center. This is why we are so obsessed and focused on the data in this meaning the data is the new perimeter because the data is moving the data is being duplicated.

It's moving to the edge of the cloud. And in this in this approach. Basically, we're saying listen, you're gonna explode your environment with data, which is growing exponentially you have to be able and the cloud enables you Cloud technology enables.

You just says Identify and locate the movements of data and access to the data in the cloud environment. Not all data has equal value. Do you think the bad guys are getting better and identifying the data?

That's the most valuable and they're cherry picking what they need versus just taking everything and hoping for the best. Yes, so just in terms of backgrounds before I found it Etc. I was the commander directs of units 8200 the Israeli Defense Forces.

This is one of the leading cyber agencies in the world. We saw the world from this unique angle and we saw the Bad actors working in action. And in reality, they managed to penetrate 100% of the organizations if an organization thinks it won't be penetrated or breach.

It's living in in the wrong world. So so once they're in basically they will look at the more lucrative assets and make their way to to there and then they'll exploit it and take it out. And in this sense here not all data is being born equal.

So, how do we go about figuring out what data has more value than the other sets of data and needs more rigorous policies because we have this massive amount of data. That's up in the cloud and I think people get overwhelmed or they may not have the expertise. So is there some way I know you talked about the classification but how does that work where you get in there and help me figure out what data is actually more likely to be stolen than something else.

Okay. So the way Centra approaches it is first of all by defining what sensitive and critical data this is key. In this sense, we Define it as data which has the most business impact in case it's breached.

So forever organization, it might be slightly different in general terms two families of data one would be a customer data for organizations who are facing customers. So it's basically all you the personal data of the customers the financial and the credit cards your identity. These are valuable assets for customers and they want to keep it the other family of sense of data would be proprietary intellectual property.

These kinds of assets tend to be in the form of patents Financial reports source code developers Secrets lost encryption keys in the in the cloud all these components were if they're breached the company suffers greatly both from continuity effect and and reputation and and so on the first family of customer data is more regulated. And there's a way to define it in a very clear way. Most of it is is structured the pii and the PCI are structured.

The latter family of data is more unique and proprietary and Central cup of both families in terms of how we do it. We have very strong classifiers which are deployed in the customers environment. So none of the data goes out and it's maintained in the customers environment.

And basically the customer can see Centric cannot seat Centra just get metadata of all the places sensitive data resides. All right. So as we head into 2023 you think we're gonna see a lot more regulations that are aimed specifically and how we handle data and not just here in the US but around the world.

That's a very clear trajectory. There's no compliance without security. There's no privacy without security security is the bottom layer and will also see much of third-party regulation coming in because the third party vendors for hooking into the cloud environments and the South ecosystem.

We saw it in the past that they become targets for supply chain attacks and organizations are penetrated through them and these areas are not regulated today. I think one of the trajectories with the also regulation coming in and defining how should there glut party platforms should protect themselves and it will be in standards and in in policies and it will be kind of an international standard. I assume it will begin from all the us or Europe.

These are the two leading areas where these kinds of things develop from. All right. So you guys just picked up around the financing.

What is it exactly you guys are gonna do with that. So as I said Centra was founded 18 months ago with our seed round. We had a substantial seed round of about 23 million dollar led by Bessemer Ventures and their Ventures and 18 months later.

We have finalized closed the second round the a round which brings us to TOEFL funding of 53 million dollars in in just eighteen months in this sense. This is an up round. It's in a very challenging market and this capital is gonna help us grow and expand in the US market mainly building a go to market capabilities beefing them up and bringing more value the customers.

We already have in terms of features and a coverage for the cloud environment. Great. All right, folks.

You're heard it here. The perimeter is the data now. That's where it all begins and you got to work your way out from there a soft.

Thanks for being on the show. Thank you very much. Mike.

Have a good day. All right back to you guys in the studio.