Ani Chaudhuri of Dasera

Jeremy Snyder (00:03.957)
All right, folks, welcome back to another episode of Modern Cyber. We've got a really interesting conversation on store for you today. We've got somebody who spent a long time and a long career in the tech industry, who's developed, I think, a little bit of a unique understanding and a unique perspective around the thing that we are all trying to protect in our day -to -day job. That is our data. So on Modern Cyber today, I'm just...

delighted to be joined by Ani Chaudhuri. Ani is an award -winning executive and entrepreneur with a track record of building successful products, businesses, and teams. Ani is driven to bringing important solutions to market and has founded four technology companies to date. E -Circle, acquired by Reliance in India, Opelin, acquired by Hewlett Packard, Whodini, acquired by Declara, and Desera, where we are talking to him today. And at Desera, Ani is helping to build trust between consumers and companies by enabling safe use of sensitive data.

Other stops in Ani's career include time at McKinsey, HP, and Tata Steel. Ani, thank you so much for taking the time to join us at Modern Cyber Today.

Ani Chaudhuri (01:04.483)
Thank you for having me on the show. Delighted to share whatever I've learned on my journey.

Jeremy Snyder (01:09.784)
Yeah, awesome. So let's talk about that journey and let's talk about, well, actually, maybe let's start with like the problem that you're solving today. So what is it that Desira helps customers solve today? What challenges?

Ani Chaudhuri (01:20.851)
So Dasera is fundamental to what is happening in the world, which is the world is getting very data -driven. Now, what we want to do is build a world that is a safer data -driven world, which is, yes, we will use the data, but we are also going to protect it like gold. And that's basically what Dasera does.

It automates data security and governance controls for large amounts of data in the cloud, on -prem, structured, and unstructured.

Jeremy Snyder (01:52.688)
That's awesome. I, you know, that is, I will certainly like agree with you on one point is that we are definitely already in, but increasingly in a data driven world. I'm curious about your story and your journey. Like in your career, how did you start thinking about this problem? Was there like a particular moment or a particular customer scenario or let's say one job stop that you had that really got you thinking about this problem?

Ani Chaudhuri (02:19.357)
Yeah, that's a good question. And like every startup that I've been in, there has been a personal side of the story and then there is the macro side of the story. And when those two merge, you kind of have the sweet spot of building something that is meaningful to the rest of the world, but is also meaningful to your team and to you. So Dasera started at a very interesting time. All my life I have dealt with data and I understand the challenges of using data. I understand how

it's almost permeable how data moves around. But about in 2019, my Coinbase account got hacked. at about the same time, and it was apparently something to do with insider threat at AT &T, like long story, there are blogs around that. About the same time, I met my co -founder, Noah Johnson, and he had done some work around privacy preserving algorithms.

Jeremy Snyder (03:07.216)
Okay.

Ani Chaudhuri (03:17.543)
And as a byproduct of that, he had to create a small tool, which would basically look at queries that people run on data and be able to tag them for different types of risk. And so when Noah and I met, was like, this thing about data was important, what had happened with me was important, and we kind of brought those together and we were excited to build the setup.

Jeremy Snyder (03:42.266)
And I'm curious along those lines. mean, when you think about, let's say the initial set of problems that you were thinking about, what was that initial set of problems? mean, obviously data is involved and data is super critical and strategic, but what particularly about the data were you thinking about? Was it just the lack of understanding and visibility into the different data stores that an organization might have, or was it something else?

Ani Chaudhuri (04:06.855)
I think I would say it was something else. We were thinking about it from an insider threat perspective. But when we went and started talking to companies, they said, well, that would be great to have. We don't even know where our data is. We don't know what data we have. We don't know who has access to it. And then comes the risk. And so we kind of went back to the drawing board and plugged in the other pieces, which were more fundamental to getting started.

Jeremy Snyder (04:34.633)
Okay, okay. And so that problem of visibility, I find that to be true across many technologies, not only data and not only cloud. I I spent a long time in cloud security and that was always the first challenge that every customer had is we don't know all the stuff we have in all of our cloud environments. I find it to be true in API security, which is what we do in our day to day. Why do you think that's such a consistent problem for organizations?

Ani Chaudhuri (05:02.731)
good question. See, anytime you have an asset, it is at risk, right? So for example, if you go back like several tens of thousands of years, tribes would fight over food that is preserved for winter. And so anytime you have an asset, it will always be at risk from somebody or the other. And the way I think about it is whether you're looking at cloud security, whether you're looking at APIs like

Every type of cybersecurity in the end is protecting what? Data. And so that is why I do feel that with the type of technologies, configurations, challenges, users, this is always going to be a moving goalpost, so to say. That is not going to change. And the more dynamic we get, the more automation we bring in into our lives, the challenge is going to just become bigger and more widespread.

Jeremy Snyder (05:58.705)
Yeah, and so on those challenges, I know you mentioned that, you know, insider threat was one of the things that you had just experienced when you started the company. I'm curious, you know, how long have you guys been at it at Desera now?

Ani Chaudhuri (06:10.887)
about five years.

Jeremy Snyder (06:12.703)
During that five year process, you must have observed a lot of other kinds of threats and risks around the data. I'm curious, what have you learned over these five years? What are some of the other threats that organizations need to think about relative to their data? Because we hear about, you know, we've heard about misconfigurations and accidental exposures of data in the cloud security space for a long time. On the API security side, we hear about kind of broken object level authorization and scraping and data exfiltration and things like that.

Ani Chaudhuri (06:32.573)
Cough

Jeremy Snyder (06:40.18)
When you think about the threats that you're helping protect customers against, like what are the things that you've learned and what are the things that really kind of, I don't know, should keep customers up at night?

Ani Chaudhuri (06:50.547)
That's a good and hard question and I don't have a complete answer to that. To me, the way to think about it is either data is getting exfiltrated or people are accessing data that they should not be accessing. In the end, these are like, if you think about in bucket terms, these are the two. Everything else, like whether it is vulnerabilities, whether it is broken authentication, all of those are tactical problems to reach data.

Jeremy Snyder (06:55.21)
Okay.

Ani Chaudhuri (07:20.243)
But there is no third factor in terms of data risk. It's either somebody's trying to steal data or somebody's trying to access data, like what else is there?

Jeremy Snyder (07:32.245)
Okay, okay. But the difference between those two being that, you know, on the one hand, if it's somebody trying to steal data, that's an outside bad actor who, you know, shouldn't have access to the environment period, as opposed to the second thing that you mentioned, you know, somebody trying to access data, that somebody who maybe has legitimate access to the organization, but is accessing some data that they may not have access to, let's say, as a requirement of their job function or something like that. Is that kind of the difference between those two?

Ani Chaudhuri (08:00.979)
See, 60 % of data breaches happen involving an insider. I'm not saying that the insider is taking the data out, but through credentials, which basically means that there are also insiders who are exfiltrating data, right? There are also outsiders who are doing things that overrule privacy. And when you think about data, that is kind of the broad umbrella.

Jeremy Snyder (08:12.075)
Okay.

Ani Chaudhuri (08:28.189)
but under that umbrella is also compliance, like what are good practices. So for example, you may have an intern in a healthcare company who may not be fully trained on requirements of HIPAA and may bring in PII and PHI in the same table. That's not a security threat, like a direct security threat, but it will lead to a security threat and that is why there is compliance to help guide some of those behaviors.

Jeremy Snyder (08:54.116)
Yeah, but I'm curious about this compliance topic, right? Because like, you know, we've worked in cybersecurity for a while. You all hear the thing, security is not compliance, compliance is not security, blah, blah, blah. But at the same time, compliance drives a lot of security spending and a lot of security initiatives within organizations. But when I think about, when I think about the compliance projects that I've been involved with, our own SOC 2 companies that I've worked with, customers that I've worked with, and I think about the data side of it,

I always hear basic like four things that are always coming top to mind. Encryption at rest, encryption in transit, role -based access controls, and then like, let's say access audit trail. But there's gotta be much more that really needs to be in place from a compliance perspective or from a security perspective. How do you think about that problem and you know, based on your own understanding and your own learnings?

Ani Chaudhuri (09:47.229)
Yeah, so see what you described the four things are, I think it's an oversimplification of the real world. So for example, in the real world, you may have the same data sitting in five different tables, and you may check all the four that you just mentioned, right? And yet it is possible that one or two of those three copies

Jeremy Snyder (09:56.759)
Okay. Okay.

Ani Chaudhuri (10:15.355)
is unnecessary, which basically increases the level of exposure the company has just because you are storing data in some other place, in an additional place. And so there are fundamental things like how you govern data. And I don't want to say data governance because it falls in the, then you get into data quality and stuff like that, especially from a trade perspective, but how you govern data, what your hygiene factors are around data, I think is a step before

that will lead to better results in the four areas that you just spoke about.

Jeremy Snyder (10:49.485)
Yeah, yeah, I mean, to your point, that example of having multiple copies that always to me speaks to kind of a general hygiene and visibility challenge. And I hear that consistently, you know, we had a guest on the show a little while ago, who's really their their their main message was that cyber hygiene brings you all these positive side effects that you don't even think about. And if you could just have good hygiene on your environments, and you kind of eliminate unnecessary assets,

Ani Chaudhuri (10:58.279)
Mm

Jeremy Snyder (11:18.459)
you're not only saving yourself a ton of time and probably money if you're running on cloud environments, because you're not paying for wasted resources, but you're just reducing your overall load and also reducing the attack surface and the threat against the organizations. So this question of let's say like multiple copies of data, do you find that organizations don't even realize how many copies of data they've made? Okay.

Ani Chaudhuri (11:40.303)
yeah, almost 100 % of our customers have either discovered new data stores or new data or new ways to access just in the initial assessment. And riffing off like what you just said, like does it reduce vulnerability? See, in the end, cybersecurity is very similar to military concepts. So for example,

In cybersecurity, you will never have infinite amount of budget and you will never have infinite amount of control of what you want to do as a security professional. So you're faced with what is called the defender's dilemma. And so defender's dilemma is that you've got like, let's say you've got 50 places where the enemy can come through and you have to decide given that you can only protect 30, what are the 30? Now, when you have better hygiene, you are actually reducing that 50 to 40 or that...

or even down to 30. So it allows you to have better probabilistic models in terms of deploying your resources so that you have a much better odds in the defender's dilemma.

Jeremy Snyder (12:50.237)
Yeah, I mean, it's like if you think about in a ratio or just a division equation and you have a numerator and a denominator, if you can reduce the denominator, you can increase the overall probability of success, even if the numerator doesn't change, right? Yeah, that makes total sense. So talk to me a little bit about, because you mentioned during the assessment process, this always comes out. So when customers are kind of embarking on, let's say like a data security journey, what does that process looks like? What are the kind of the steps? it, know,

Ani Chaudhuri (12:57.949)
Right.

Jeremy Snyder (13:18.336)
I think of security posture management as always being kind of a discovery inventory assessment. Is it pretty similar in the data world?

Ani Chaudhuri (13:26.489)
It is very similar in the data world, but I will also caution us when we think about any of our product that we sell to security professionals that the journey starts with assessment. Actually, it does not start with assessment. The journey starts with what a company wants to do, like what is my strategy. A lot of times it's very tempting to like, OK.

we've got the solution, let's bring it in, but it is better to figure out like, is it that we are trying to do? What are the trade -offs you're willing to make? What are the resources that will be available? And then pick a solution that caters to what you're trying to do in a phased manner. So yes, the journey does start at assessment when it comes to getting stuff done at a tactical basis. The thing about...

Posture management and I have always had a little bit of a challenge leaning into just posture is that yeah in posture it will tell you where you are but in the end you have to kind of solve for it. If you think about what is happening in Russia and Ukraine and I'm going to talk about a slightly more controversial topic here. If you looked at posture this war would have been over in a week right but the reality is like two years later there is

it's still ongoing. so posture is maybe a starting point. And sometimes it does also provide a false sense of security if you're not able to automatically remediate or escalate the issues that are coming up.

Jeremy Snyder (15:01.684)
Yeah, it's interesting. This question about auto remediation has also come up on the podcast a number of times with guests having very, very strongly opposed views. We had one guest on here who was like, no, automated remediation is actually an anti pattern because what you need to be doing is secure by design. So anytime you find a problem, you should go back to the root, redeploy the environment with the fix in place, automate everything down to the nth degree. And another guest who was like, yeah, that's, that's great in theory.

but in practice the way most organizations operate, it's not practical, you know, maybe 75, 80 % of the time, especially when usually the problems are, let's say like individual items, individual resources, individual misconfigurations. Why would you tear down an environment only to rebuild it to fix one misconfiguration? I'm curious because data is maybe a little bit different. You know, when we had that conversation, it was largely about cloud infrastructure and cloud resources.

things like compute and network resources. How do you think about that from a data perspective? mean, you know, is it a little bit different in the data world in the sense that we're talking about access to data stores, databases, and so on? How do you think about that and how do customers think about it?

Ani Chaudhuri (16:21.359)
Anybody who thinks that automation is going to take away efficiency is wrong. I can tell you upfront. The way to think about it is, you think about cars. You've got brakes and people are taught to drive in a safe manner. Then why do you have seat belts? And the point here is this, that it's not either or. It is the power of and.

which means there is going to be a degree of automation. And the objective of that automation is to take care of things that are repetitive so that resources who can use their subjective and objective judgment, which is people, have fewer things to look at. And so they will make better decisions and they will have better time to kind of make the system overall more efficient and secure.

Jeremy Snyder (17:17.699)
Yeah, that's really interesting. I mean, I like your perspective on that. I'm curious when you go into organizations and you talk to them about, let's say, like starting a data security journey or undergoing a data security initiative, how does that tend to play out? Because I imagine that comes kind of during the secondary phase, right? They go through some assessment and then they have to make decisions about

what's automation, what's this? And to your point, it's not either or, it's like, we're gonna solve this side this way, and we're gonna solve that side the other way. Like how do customers make those decisions?

Ani Chaudhuri (17:56.977)
I think there's a bell curve here. So there are companies that are super sophisticated. They've thought about it. They even may have some like homegrown stuff, right? And on the other side are, and I wouldn't say companies, I would say teams, teams that are still learning about data security. And some of it comes like, when you think about data security, it is a slightly different field.

Jeremy Snyder (18:11.565)
Okay.

Ani Chaudhuri (18:24.839)
compared to other forms of security. Why? Because in this field, the people who are responsible from a company compliance perspective are writing PDFs like thou shall do this, thou shall not do this, that is the compliance folks. They hand it to the security folks, most of who understand infrastructure better than they understand data. Now, because they don't have context to the data that a data scientist or a data team is using. So then...

Jeremy Snyder (18:36.932)
Yeah, yeah.

Jeremy Snyder (18:46.456)
Okay.

Jeremy Snyder (18:49.783)
Yeah, yeah, they don't know what's in it. They don't know is it production staging PII non PII, etc. Yeah

Ani Chaudhuri (18:56.531)
Not just that, more importantly, they don't know how this data is used by certain people in certain roles. And so now the data team is involved in this as well. And if you think about that bell curve, the best companies already have exposure, like the security teams in the best companies already have exposure to data. So they have kind of a rough idea. On the other part of the journey, on the other side of the bell curve are companies that are like, we have just

Jeremy Snyder (19:02.598)
okay, okay.

Ani Chaudhuri (19:25.319)
figured out how to protect our infrastructure, we don't even know what data we have. And so there is an entire spectrum of companies in terms of sophistication, in terms of resources, and in terms of intent.

Jeremy Snyder (19:37.924)
Mm -hmm. Yeah. That lack of contextualization is something that I find very often. And I mean, I know we, based on some customer feedback, we ended up building a section of our product to generate incidents that really are just like, hey, something went wrong. Let's gather all of the related data to that point in time and everything that kind of went on and provide that context to the security or the security operations team.

to help them understand that. Your point about, you know, let's say like security teams, whether it's InfoSec, cloud security, what have you, not having that context is something that really resonates with me. How do you help customers solve that?

Ani Chaudhuri (20:23.923)
Well, first thing is education. Whether they buy the product or not, one of our... If you care about the space, you should be happy if you can even educate one customer, whether they buy it or not. Because when they are ready, when they realize it, when they have the resources and the budget, maybe they'll think about you. But in the meantime, you have lifted all boats around data security by creating this wave. And that is part of the job of early companies.

It's inefficient, like from a pure dollar spent perspective, but if a space is new, the burden of education is on the people who are spending most amount of time on this, which is us.

Jeremy Snyder (21:05.748)
Okay. Okay. And, you know, as they go through that process, do you find that like afterwards they have a better understanding for, let's say, avoiding some of the bad practices going forward, avoiding the duplicate copies of data, avoiding the, you know, let's say like the overly permissive folder permissions or something like that. do you find that organizations generally get better?

Ani Chaudhuri (21:32.435)
100%. They get better at things that they know are broken, and they get better at things they didn't know were broken. So there is no question about it. Even a plain, simple assessment, a low -cost assessment, is a must. It's a must -have. We are all holders in our lives in some form or fashion. Sometimes we forget what we hold it.

Jeremy Snyder (21:42.141)
Okay.

Ani Chaudhuri (21:59.475)
You don't even know that you were not the one to hold it, but it is hold it at home because your spouse or your partner or your kids have kind of brought things in. That is true with data as well, except that data can be replicated. If you bought something that you're not going to use, you're not going to make 10 copies of that. But with data, it is possible. So 100 % people learn so much.

Jeremy Snyder (22:18.94)
Yeah.

Jeremy Snyder (22:22.505)
Yeah, yeah, that's great to hear. I want to shift gears for a second. I know you guys recently published a case study about a healthcare organization and some of the challenges that they faced. Could you talk us through that? I think it'd be really interesting to hear and understand how the customer went through that process and what were some of the benefits they came out with.

Ani Chaudhuri (22:31.091)
Mm

Ani Chaudhuri (22:41.427)
Yeah, so I don't know which specific use case you're talking about, but I'm going to talk about a couple of them that without naming names, of course. So one use case was we had a customer, didn't, they were like, one thing I have to say is that that particular company's team and the leadership knew exactly what they wanted to do, right? And they brought us in and they basically said, we want to know

Jeremy Snyder (23:05.322)
Okay.

Ani Chaudhuri (23:10.151)
what data we have, who has access to it, what are the risks? Post that process, after we kind of deployed our solution, it ran for a couple of months, the CISO basically said information that used to take them like two to three weeks and two to three people working on it was available to them in five minutes. So one person just logging in, right? So if you think about it now, certainly you've got this level of organization that you didn't have before.

Jeremy Snyder (23:14.184)
Okay.

Ani Chaudhuri (23:39.027)
So this is one example. The other example is also another healthcare company. They also knew exactly what they wanted to do. And I know, and these are success stories I'm sharing because these are the most sophisticated ones. Now imagine how the world is for people who are not so much here. So their use case was that they wanted to make sure that there was no de -identified data in their non -production databases. And there wasn't a dynamic way of doing that because there were rules to follow. was identification to be done.

Jeremy Snyder (23:50.995)
Yeah. Yeah.

Jeremy Snyder (24:05.525)
Okay.

Ani Chaudhuri (24:08.613)
And we were able to basically create an inventory for them in terms of showing them what data was not, you know, de -identified and then create a workflow that would automatically de -identify data based on a bunch of rules. like this is, and the amount of data like is the billions of records that they wanted to take care of.

Jeremy Snyder (24:28.395)
Yeah, yeah. This last one in particular again really resonates with me. This is a problem that I hear time and again. And one of the largest API data breaches that has happened to date was exactly a case of a testing API in a staging environment. But the data that they were using in that environment was actually a direct copy from production. It had not gone through a de -identification process. And it's really interesting this question about de -identification because I've seen a couple of different approaches. I've seen those who kind of take

Ani Chaudhuri (24:49.277)
That's right.

Jeremy Snyder (24:58.347)
production data or let's say like a subset of production data, maybe a sampling sample number of records. And then they run it through a fuzzer slash de identifier of some kind, tokenizer, whatever you want to call it. But then I've also seen a lot of interest in an area called synthetic data, where, know, it's much more about like, hey, I'm going to describe my data structure to you.

Ani Chaudhuri (25:11.986)
Right.

Ani Chaudhuri (25:17.939)
correct.

Jeremy Snyder (25:22.905)
some kind of machine and you're just going to generate millions of synthetic records that are probable or reasonable for the data structures that I'm using. Do you have any thoughts about what's a better approach or is it very much like, just depends on what works for your organization?

Ani Chaudhuri (25:38.899)
It's always what works for your organization, but the more important thing is that no matter which method you take, you need to verify that you're actually doing what you're supposed to do using the tool that you chose. You can have this tool that is creating synthetic data, but guess what? If somebody didn't use it, then you have production data. And it's not like companies that have de -identification tools.

Jeremy Snyder (25:59.894)
Yeah. Yeah. Yeah, yeah.

Ani Chaudhuri (26:06.323)
don't know that they need to de -identify. The bigger problem is it's much harder to execute than to ideate. There is one very interesting thing that I had read many years back. said, ideas don't move mountains. Bulldozers move mountains. Ideas tell you where the bulldozer should go to work. To me, automation in today's world tell the bulldozers where to go to work on the data.

Jeremy Snyder (26:34.841)
Yeah, yeah, that's a really interesting analogy. I like that a lot. I've got a couple of questions to just kind of wrap up our conversation today. One is obviously we're talking in 2024, we're kind of like legally obligated to talk about AI and kind of ask your take on it. I imagine AI is creating a lot of concerns around data security and around how data is being used. What's the impact that you're seeing today and what's the impact that you're expecting over, let's call it the just the next 12 months?

I always hesitate to ask people about any more than that because stuff is changing so quickly.

Ani Chaudhuri (27:09.287)
Yeah, I think the first basic one is what data is being used. How is that data being used by the AI tool and what controls can you put in place? Just getting that visibility first is going to give you the ability to switch on and off, like start there. And then you can figure out like what the alternative paths are. There's no way around this thing. Think about retailers. When e -commerce happened, they thought this, you

Retail is growing, but retailers are shutting down, right? So AI is going to be there. It's going to create an amazing amount of impact and people are understanding it and they're thinking about it, I think in a very right manner. Like everybody's talking about it and thinking about it.

Jeremy Snyder (27:42.158)
Yep. Yep.

Jeremy Snyder (27:52.952)
Yeah, yeah. And then I'm curious, you we've seen a lot of changes in the cybersecurity, let's say macro landscape, right? We've seen a lot of consolidation in certain areas. We've seen new, you know, new challenges pop up like data security. You know, if you asked me five, six years ago, I think when you guys started the company five years ago, I wasn't thinking about data security as a separate problem from other areas. So we see this stuff kind of, you know, new challenges emerge companies.

are created to help customers solve those challenges and then consolidation happens. I'm just curious your perspective. mean, what do you see happening around the data security space? Is this a space that's gonna be a long lasting space or is this a space that ultimately, know, kind of combines with other things that are very complimentary to deliver better solutions for customers?

Ani Chaudhuri (28:41.235)
I think it is about context here. So the way to think about it is there are about 3 ,500 plus companies in cybersecurity. What is going to happen, and this is my guess, is there are going to be less than 10 that will provide 360 degree context to different types of variables that impact data protection.

Jeremy Snyder (28:44.421)
Okay.

Jeremy Snyder (28:54.683)
Okay.

Ani Chaudhuri (29:10.277)
If you think about API security, it is a form of data protection. If you think about cybersecurity, CSPM, every one of those is a form of data protection. And the more context you bring in, the more efficient you get if you can properly use that context. And so there's going to be continuous consolidation in this space. I don't believe that independent data security is

Jeremy Snyder (29:27.505)
Yeah.

Ani Chaudhuri (29:38.855)
has a long shelf life. think what is going to happen is that either some data security companies are going to go very big and they're going to consolidate other ways of securing that data or people who are already protecting data are going to pull in these. And you can just see in the last six quarters, there have been like six or seven acquisitions in our space.

Jeremy Snyder (30:00.539)
Yeah, gotcha. Yeah, I think that's really an interesting perspective. And that whole point about context is something that I've thought about a lot. And I've written about that consolidation and that contextualization in the cloud security space and spent a lot of time working on exactly that problem. People can find that on our blog, et cetera. Ani, thank you so much for taking the time to spend with us today on Modern Cyber and share your perspectives. For those who want more, what are some good places to find you or some good ways to get in touch?

Ani Chaudhuri (30:29.543)
The best way to get in touch with us is go to our website www .dasera .com. You spell Dasera as D -A -S -E -R -A or you can drop me an email at ani .dasera .com.

Jeremy Snyder (30:44.2)
super easy and Ani is just A -N -I. We'll have Desera and we'll have a couple of other things linked from the show notes of today's episode. Ani Chaudhary, thank you so much for taking the time to join us on Modern Cyber today.

‍