Listen: Next in Tech | Episode 86: Data Privacy and Security at 451NEXUS

View Full Transcript

Transcript provided by Kensho.

Eric Hanselman

Welcome to Next in Tech, an S&P Global Market Intelligence podcast where the world of emerging tech lives. I'm your host, Eric Hanselman, Chief Analyst for the 451 Research arm of S&P Global Market Intelligence. And today, we're going to be discussing data privacy and security with returning guests, analysts Paige Bartley and Justin Lam. Welcome back to both of you.

Paige Bartley

Great to be here, Eric, always.

Justin Lam

Eric, it's a pleasure to be with you.

 

Question and Answer

Eric Hanselman

And great to have you on. And we've got a -- sort of a dual purpose here. To start off with, you're going to be talking about all this at 451NEXUS in greater detail, and we've got time to be able to touch on here at the podcast.

But talking about something that is -- I don't know, it seems trite to call this a tremendously important topic. But if we think about it, this is one of those things where technology and personal life really start to come together. I mean we hear all about data breaches, advertising surveillance, a lot of the abusive information that takes place with disinformation campaigns, all of these aspects of the different facets of data security, data privacy, data governance.

And I'd like to dig into some of, I guess, the current state of all of these various pieces, how they're interacted -- or how they're interrelated and how they interact and really what both of you are seeing in your research. So I guess kicking off, what are some of the biggest challenges when you start looking at these disciplines? Paige, I want to kick it off with you first.

Paige Bartley

Sure. I think historically, one of the biggest challenges is that we've seen some of these things in separate spheres. So if we think about data privacy, you have your consumer hat on as a consumer out in the market, and you think about data privacy as the context of invasive ads or corporate surveillance. And on the other end of the spectrum, the business that's actually trying to manage your data is thinking about data privacy or data security in the context of regulatory requirements or business requirements.

And really, that's -- you can't really separate those spears anymore. You can't separate this clean divide between consumer life and what the business needs to execute because businesses are handling all of that personal data. You may be in a business-to-business industry, but if you go a few degrees away, you're dealing with that consumer market as well. So everything is interconnected.

And just with the extreme digitization of all customer interaction that we've seen, especially over the last couple of years with the pandemic, everything sort of consolidated into these digital channels. The data that's generated from that is often very personal data. It's very sensitive data. Businesses are handling more of that than they ever have been before.

It's -- as a business, you can't just think in terms of your regulatory requirements. You really need to think about your impact on your customers and consumers because they're sensitive to that. And we have actual consumer research that we do at 451 Research and S&P Global Market Intelligence where we look at those consumer trends. And consumers will vote with their wallets when they feel that, that privacy and security is not respected. And I think that's a very important detail.

Eric Hanselman

Well, it's one of those things that we've had Sheryl Kingstone and her team talking about customer experience and how do you engage and not creep in those sorts of aspects. I mean this is really something where all of these aspects of data have really become entangled and enmeshed with each other.

Paige Bartley

Exactly. Yes.

Justin Lam

Yes. And I think that from a security practitioner standpoint, what security practitioners think of as the effective harm that is done by the loss or the abuse of data, we oftentimes think in terms of a threat model as far as what are the threats to the confidentiality of the data, the availability of the data and whatnot.

But I think there's just an ongoing maturity about how practitioners are to actually think about the ongoing threats to the data, how those threats actually change. And that's one of the other big things that's happening, that represents a challenge. Between that and the pervasiveness and the scale of the data, I think those are all massive things that are really adding to these challenges to these disciplines.

Eric Hanselman

Well, I will actually invoke something that we've been talking with as a team a little while back, and I quote that someone brought up, which was that we've -- in tech, we've become very fond of referring to data as the new oil, the new water, the new currency, what have you. But this was a quote in -- if either of you know where it came from, we can credit it appropriately, but I don't actually know what the source was.

But the data is actually uranium that, in fact, it's tremendously useful if you handle it carefully. But it comes with a whole set of consequences and risks that are wrapped around it. It's got byproducts that are hazardous. There are a whole bunch of different aspects to it but, I guess, really embodying a lot of the complexity that exists in dealing with data.

Paige Bartley

Yes. I actually think that the -- going back to data as the new oil, I think that analogy still fits, right? Because if you think about the revolution, the Industrial Revolution and our use of fossil fuels and how that advanced humanity in so many ways, but now we're reaching this backlash where there is more awareness around the effects of that having on our planet, our culture, individual lives across the world.

The same is true with data. With the revolution we're seeing in data, you can do very powerful things with data. You can improve people's lives. You can advance society. But the parody with that is that there is going to be a backlash when privacy is not respected and consumers start to realize that I'm being tracked in a way that I feel uncomfortable with. And I -- my trust in this brand is being eroded, and I don't feel safe anymore. That's the backlash. It's like oil was to the Green Revolution as is data is to the privacy revolution in a sense.

Eric Hanselman

Interesting parallels. There are so many different ways we could explore these analogies and look into them. I mean, I guess, we've got oil spills and data spills, a lot of different pieces to it.

Justin Lam

Well, Eric, I just like to add with the analogy to data and uranium. I think that there is something that we see is the half-life of data that's out there. You have organizations that don't necessarily understand the liability simply because they've been holding and maintaining data for so long. Cloud storage technologies make it just so inexpensive to hold on and retain data indefinitely. So as far as people are understanding what that risk is, you really have to be thinking long term as well. So I think it's a pretty apt analogy with -- between uranium and data.

Eric Hanselman

That is a great tie-in to that analogy. Data half-lives. Well, again, it's another good aspect of the concerns that have come out of a world in which it was hard to hang on to data, but now it's become so inexpensive, so easy to hang on to data. In fact, the volumes of data become that larger challenge.

Justin Lam

Right. Right, certainly.

Eric Hanselman

So in thinking about how organizations should deal with this, I mean if we think about this intersection of data privacy, security, governance, various aspects, I guess, what do those disciplines have in common? And how should organizations be thinking about them?

Paige Bartley

What those disciplines have in common from my perspective in the world of data management and tying that into what you might consider insight initiatives within the organization, essentially trying to maximize the value of data within the organization, is that data governance, data security, data privacy, all of these things essentially require very granular control of data within the organization.

And historically, we've often butted heads, right, between data security, data privacy versus analytics or AI initiatives. And that's really missing the point, right? The fact that if you as an organization wish to minimize your risk and maximize the value of data, at the end of the day, you need to fully understand what data you have, where it is, where it's flowing, who has access to it.

It's a very granular element of control that is the common denominator between all of those practices, whether you're doing it for a so-called reactive purpose like needing a compliance requirement or whether you're doing it for something very proactive like building an AI or ML model. It all comes down to how well you can control and trust that data within your organization.

So I think that's the key commonality across many of these practices and why we're seeing a lot of convergence today and emergence of roles such as the Chief Data Officer within organizations that are really looking at this at a higher level, not just at a technical sense like a Chief Technology Officer or a Chief Information Officer might.

But a Chief Data Officer is typically looking at how do we create cohesive data strategy within the organization, both meeting our requirements, whether that be for privacy or security or threat reduction, but also how do we align our objectives so that we're actually maximizing the value of our data and moving forward as a business. So it's a 2-sided coin.

Eric Hanselman

Different aspects of a lot of these different capabilities. Well, one of the things I want to touch on, and I led in with this at the outset, is that you are going to be talking about this at NEXUS, and I wanted to talk about some of the things that you're going to be working with in the session at NEXUS. I guess there, that really is the point at which you're going to be dealing with, I guess, the collision of these various disciplines. How would you describe that collision itself?

Paige Bartley

There's a market collision within the technology products that are available as well as a collision within the organization as we spoke earlier where these functions are starting to overlap. And I think it's become inevitable that organizations need to stitch together their strategies between security, privacy, governance in order to make these practices feasible and successful long term.

And that's something that I'm seeing in the technology provider market. Of course, they're picking up on that as well, and we're seeing broader platforms that cater to a wider array of needs within the organization or within the enterprise. So there's maybe less of a sniper point solution sort of approach because people are realizing that government security privacy are all deeply intertwined. And it's very difficult to orchestrate a technology ecosystem where you have a different tool for every little requirement that you have, right?

So it's -- there's some consolidation and broader platform approaches in the technology market, but there's also a change in the mindset within organizations as well as there's increased collaboration between business units that may have traditionally been more isolated. So compliance is collaborating more with privacy, and privacy is collaborating more with analytics and AI. And it's -- now that data is essentially the underlying fabric of the organization, this collaboration has opened up new venues for how things are done.

Justin Lam

Just in addition to what Paige is saying, I just foresee that, basically just years of working in the industry, that there's not going to be a true north that emerges anytime in the near future. I think that these subjects that we're talking about, especially as they are entering into the public mindset, they're entering into the legislative mindset. This idea of a true north where all the disciplines can align and they can find harmonization, I think that's a little bit a ways off.

So I think that you'll still see, as organizations wrestle with this, that the stakes will continue to be defined and redefined given the changes in landscape, given the changes in technology. And that's what's going to make this seem like a collision is because the outcome and a settled outcome might not be known for quite some time.

Eric Hanselman

So you're talking maybe more along the lines of tug of war as opposed to collision.

Justin Lam

Yes. Right.

Eric Hanselman

Justin, come on, it's like isn't there one true path, and I guess the answer is quite yet.

Justin Lam

Yes. Yes. I mean if anything, if history has sort of been any sort of guide, I think that it's not so much whether we'll always know the answers to all the questions, it's how much -- is how dynamically and how well we can live with the question. And I think as the organizations unify and they put these disciplines together, which is a great sign, I just think that it's not so much as finding all the total answers on privacy or security, I don't think there's ever a finish line for that, but how well organizations can align and how well they can proactively anticipate what future needs are. That's kind of where we, I think, can see the continued wrestling.

Eric Hanselman

Well, you talk about this being a never-ending journey. I mean that's from the security perspective, from so many aspects of technology. We've seen it. I know it was top of mind for me recently when we were talking about the payment card industry standards. The new payment card industry security standards are now talking about ongoing processes for securing as opposed to point of time.

And this is really something where we're getting back into that expectation that this is an ongoing process in which we've got to continue to refine. And I guess in my heart of hearts, I hope that there is one horizon that we can hopefully all point towards but that we may be actually on different paths to get to that same horizon.

Paige Bartley

I'd like to think back to the era where GDPR was first implemented, right, and there was this rush to a perceived finish line, right? There was a May 26, 2018, date, right, or whatever it was that year. Every organization that was bound by that regulation was treating it as a finish line.

And now that we've seen the regulatory landscape completely expand and proliferate, and consumer awareness likewise has put pressure on organizations to change their behaviors and how they handle and how they steward data. Organizations are realizing that, that deadline mentality is not sustainable. So there is a maturity curve that's playing out here where organizations are realizing we can't treat this as a one-off project.

And for me, I see that as encouraging. The organizations are starting to treat government security and privacy more as an ongoing process that doesn't have a finish line, that constantly has to be evergreen improved, but that you can't just treat your requirements as something that has a deadline and then you're done because that's when you fall behind competitively.

Eric Hanselman

Well, and to your point, I mean, this is something where, as Justin said, it's a matter of ensuring that organizations are comfortable living with the question. And the question is, are you secure? Is that -- is the data -- is your data where you think it is? Is it sufficiently protected? Are your privacy concerns sufficiently addressed? And that's something that is a lingering and refreshing question that continues onward as organizations try and pull all this together.

Justin Lam

For sure. I think that if there's any sort of parallel that we could have as far as data goes, I think it's always intriguing to look at what organizations have been doing with their finances and the financial governance associated with those things. You see maturity models in how accounting standards have evolved especially as corporations have become so different in their structure and they become multinational.

And if you look at the same ideas and that maturity applying to data, clearly, the idea of there ever being a finish line, that doesn't happen in finances. In finances, companies generate annual reports every single year. They generate accounting statements that are audited every single year. They have these controls in place for their financing.

So seeing that similar kind of maturity in that mindset going away from the idea of financing and financial due diligence, being something of a one-off task, but more or less something that this needs continual vigilance, I'd like to see that continue with the aspects of handling all things in data security and data privacy.

Eric Hanselman

That's a really good comparison because it's the idea that data is a thing of value just like other corporate assets, and you have to manage it on an ongoing basis in the same way.

Justin Lam

Right. Right.

Eric Hanselman

Well, this has been a fascinating conversation. There are so many different aspects, and as I say over and over again, there's the -- if only we had more time, given our format and everything, there are so many good things that we -- good conversations that we could have around this and extensions of this. I think there are more conversations to have, so hopefully, I can entice both of you back again to continue this.

But in the interim, our listeners can check out the detailed discussion that will be happening at 451NEXUS, kicking off October 31, where both of you will be talking about data privacy and security and it's -- their interrelations.

Justin Lam

Yes, we're very much looking forward to that session, and we're very much looking forward to continuing the conversation. It's never a dull moment. That's for sure.

Paige Bartley

Absolutely.

Eric Hanselman

Especially not when juggling uranium and oil. Yes, I don't know if we could come up with any sort of metaphor that would bring the 2 of those together. I think that's probably a dangerous place to go, but we may just have to leave it there for now.

Justin Lam

We all have our kryptonite allergy somewhere. So...

Eric Hanselman

Even more elements to bring into the process. Well, thank you to you both. This has been great. I look forward to hearing everything that you're going to be going into at 451NEXUS. For our listeners, there will be a link to the 451NEXUS event site, so you can get over there, get registered and listen into all the great content. Paige and Justin, thank you very much.

Paige Bartley

Thank you.

Justin Lam

Thank you.

Eric Hanselman

And that is it for this episode of Next in Tech. Thanks to our audience for staying with us. And thanks to our production team, including Caroline Wright and Ethan Zimman on the Marketing and Events teams and our studio lead, Kyle Cangialosi. I hope you'll join us for our next episode, where we're going to be digging into more 451NEXUS content with payment technologies with Jordan McKee. So I hope you'll join us then because there is always something next in tech.