Cybersecurity is everyone's job, says McAfee's Christopher Young

Christopher Young (left) and Anand Ramamoorthy
Image: Aditi Tailang

There is a high degree of awareness and maturity in India regarding cybersecurity, says Christopher Young, CEO, McAfee. The head of the global device-to-cloud cybersecurity company spoke to Forbes India along with Anand Ramamoorthy, managing director, South Asia. They discussed Aadhaar, McAfee’s India plans and the role of the CEO in the age of cyber-threats. Edited excerpts:

Q. What are the key reasons for the rise in cybercrimes over the past few years?
Young: Cryptocurrency has spawned a whole series of ransomware attacks, [which block access to private data on a personal computer until a ransom is paid]. These attacks are easier to implement than a broader data breach. In a data breach, an attacker has to break into a cyber environment, steal and extract information and then they must sell or monetise it. Whereas ransomware is a direct transaction—you infect a user’s machine or machines, collect a ransom and that is monetised.

Q. What do you think of India’s Aadhaar programme from a cybersecurity standpoint?
Young: The intent of the [Aadhaar] initiative is to provide a mechanism for developing and protecting digital identities. Like with anything where you have information and data that is sensitive, it’s got risks. Those risks need to be managed, they have to be secured, but I look at those things as a net positive. The society has to move forward. We cannot move forward if we don’t try new things. No organisation, no society, no country is going to survive if they try to do everything on paper. We’ve got to have better digital identity systems.

Anand Ramamoorthy: It’s always a question of greater good over challenges. Which other country has biometric data of 1.2 billion people that is being effectively used for downstream services? I think there is going to be innovation around how to use it more effectively, and how to cleanse it. Just because you have a car accident, you don’t stop driving. There is absolutely no question about the need for Aadhaar or the value that it provides.

Q. Then how can Aadhaar be made breach-proof?
Anand: Broadly, what are the elements at play here? You have a database; so you could have database protection, and you are looking at the whole life cycle of how you capture data in the first place, which is where we have some concerns. This is all in the public domain. When biometrics are taken from 1.2 billion people in the country, the process can get leaky, depending on how you take the data, how you locally store it, when is it uploaded, who tracks it. So the data integrity part in this is certainly critical.

The good part is, if you look at the kind of people involved in Aadhaar, UID, GST and all these iconic projects, it’s a great mix of private and public. With Nandan Nilekani, who is a technology veteran, conceiving the whole programme; that kind of collaboration ensures that you bring the best-in-class technologies to the mix. And they have that. We look at Aadhaar as an amazing cornerstone of Indian technology.

Q. In the context of the recent Facebook debacle, should India (and other nations) enact new rules?
Young: There’s a lot of open space underneath that question. The General Data Protection Regulation (GDPR) is a good example of European Union moving to give consumers more control over their data; more control over their information. I expect governments to become more actively engaged in making sure that social media sites are enabling their users to really understand where their information is being stored, how it’s being used.

Q. On a scale of 0-10, how cybersecure is India?
Young: India might be a developing country relative to the West, but I see quite a high degree of sophistication amongst Indian companies and the government. If you think about it, a lot of Indian systems integrators (SIs) are providing security services and solutions to some of the most demanding companies and governments around the world. The companies here are buying the same products and services that are being bought in the West. I do see a strong amount of focus on cybersecurity across the board, and that’s encouraging because it starts with awareness, then it’s about priority and then about action. If you think about the maturity curve of cybersecurity, in India you’ve got a good level of awareness.

Anand: There was a recent survey, where India was ranked No 10 in terms of overall security posture, which is a combination of investments, regulations and deployment, which is clearly a reflection of what Chris said. But we are also innovating very differently. A good example is our whole digital wallet revolution, where the mobile phone becomes the centre of the universe as a medium for all transactions. And then we have a new industry coming up in India, cyber-insurance. These are all indicators of maturity.

Q. How are things looking up for you in India?
Young: India represents a really important market for us on a variety of levels. It’s a market for us in terms of businesses and customers that we work with; that's both true in the corporate government space as well as on the consumer side. We work with a number of Indian SIs that are very global in nature. We have thousands of people here across McAfee. We have consistently grown our teams here in high single-digits and we expect to continue to grow in India over the foreseeable future. We have added a lot of functions here, not just technical people. We have got services people; we have business analytics and HR teams that are here. So we are doing a lot in the country.

Q. How critical is the CEO’s role in creating a cyber-security culture in a company?
Young: One of the most important jobs of a CEO of any company, is you are responsible for the culture and priorities of the company. Culture is a function of priorities. You’ve got to have not just tools and tech, but also a culture of security. Meaning, you understand it, you’ve prioritised it and you actually have goals, measurements and you have action in and around it. Cyber-security is everyone’s job in the organisation.

Five years ago, cybersecurity wasn’t really thought of as the CEO’s problem. Now, if you ask CEOs what are the top five things that keep them up at night, cyberattacks are likely to make that list.