Data security, particularly when it comes to mobility, remains one of the biggest challenges for every organization. From large corporations to small businesses to government agencies, everybody is struggling to stay ahead of the game.
Absolute Software is a Vancouver security company that is trying to help. It’s proprietary service is embedded in hundreds of millions of devices across the world and helps an organization monitor and track their equipment — and the data on it. There are many related applications, especially when it comes to managing the fallout from a lost or stolen device.
Photo: Loren Moss of Finance Colombia sat down with Jorge Hurtado and Christopher Bolin of Absolute Software to discuss data security during Andicom 2016. (Photo Credit: Finance Colombia)
Absolute Software’s Chief Product Officer Christopher Bolin, who joined the company in early 2015 after a decade at McAfee, and Sales Director Jorge Hurtado were both recently in Colombia at Andicom 2016. They are looking to expand business in the country and the region.
During their time in Cartagena, Bolin and Hurtado sat down with Finance Colombia Executive Editor Loren Moss to talk about their technology, data protection, and how customers in Colombia are becoming more advanced when it comes to cyber-security
Finance Colombia: Can you tell me a little bit about Absolute Software to give us some background on your business?
Christopher Bolin: We work with hardware vendors around the world, and we put a small bit of code inside firmware. We’re in more than half a billion devices, and what that firmware module allows us to do is to track and see devices no matter where they are in the world.
We can actually access those devices and anything that we monitor on the device. We can make sure that it’s there, we can make sure that it’s healthy, we can check data security, application security, and even user behavior. The thing that’s really unique about what we do is having a massive footprint of embedded devices and the fact that we can reach them when other solutions cannot — because we’re actually in hardware, not just in software.
Finance Colombia: What kinds of devices are we talking about?
Christopher Bolin: Mostly mobile laptops, but we’re also in tens of millions of Android-class phones and other phones and tablets. Our traditional strength has been in understanding where mobile objects are.
Finance Colombia: What implications does that have for the consumer? If buy a laptop, I don’t know that this device is in here. But I guess that I’m now being tracked by the manufacturer without my knowledge. The manufacturer knows because they opted to put the chip in there. What kind of privacy implications does this create?
Christopher Bolin: Yeah, sure. It’s a great question. So, first of all there’s no communication at all to or from Absolute, from a customer, unless the customer consents. So primarily we sell to organizations — we don’t sell to individuals. We do have a consumer product, but that is more of a “runs when installed” process. You elect to be part of it. A customer has to want it. The module itself is completely inactive until it’s activated.
We often sell with our OEM (original equipment manufacturer) partners. We work with Dell, HP, Lenovo, and 23 other OEMs and ODMs (original design manufacturers). Often they will enable our product from the factory, so the customer actually has visibility into all the movement of the device from the time it ships.
Finance Colombia: Here in Colombia — you were at ANDICOM — what is the value proposition?
Jorge Hurtado: So, we’ve been in business for 23 years, and we’ve had this relationship with the audience for over 13 years. We’ve been embedded in more than 500 million devices. In the case of Colombia we have the relationship with the audience. HP is a strong relationship, Lenovo is one of the strongest we have, and also with Dell. We are active in about more than 400,000 devices in Colombia itself.
Most of them are in the product sector. Institutions like CPE — Computers for Education — have the majority of their devices active. Then we have the education secretariat. And we have public sector in Cundinamarca, Quindio, and some other local states that also have our product.
And then we are in enterprise, corporate accounts, but those I cannot reveal because it’s part of their privacy. They might buy our products because they want to understand how the user is using the device and so forth. It is part of security.
Finance Colombia: What is a typical use case? Cundinamarca — or a corporation — how are they using your product?
Jorge Hurtado: First of all you have to take into consideration that the most important aspect of a company is data. So that is what we are: a security company that secures data.
In the case of local projects, like CPE, most of those devices have been purchased with tax dollars. So they have to protect those devices. They have to report that those devices have been in use, how they are using the money, and where those devices are.
So it’s a way to protect assets and data. And also you have to consider that in Colombia there are protection laws on data. So that’s the other issue that they want to cover by buying our product.
Finance Colombia: And your device is also a tracking device?
Christopher Bolin: Sure. One of the primary use cases is device location. If a device is stolen or lost, a corporation wants to understand where it is and you literally can pull up a map — a Google map — and it shows exactly where the device was when it last called in. When it’s connected, we know where the device is.
There are a lot of libraries that have been developed by Google, by Microsoft, and by other parties that actually triangulate based on WiFi signal. Even if you’re not connected via WiFi, based on where your IP address is, you’re able to determine the location. It’s exactly the way an iPad works. There’s no GPS puck in an iPad, but when you turn on location services it very accurately knows where you are.
Finance Colombia: So if the Ministry of Education — or if I’m a company with a field sales force — beyond a device being stolen, beyond knowing where my field sales staff is, or field engineers or something like that, what is the value to me beyond simply that?
Jorge Hurtado: When you talk to them about the end-point, they don’t have a clear answer. What they will say is that they have encryption, they have malware antivirals and so on. But they don’t have any real safe security policies for end-points, right? That is where we are important.
That’s our value proposition: We can help IT managers to control what they cannot control and to see what they cannot see when a device goes out of the network. That is the most important part.
And then the second part, because of the persistent module, we are able also to persist in our applications. When you take a look at the statistics, 80% of IT calls or support calls are because a user deactivated an application or the application got corrupted. So for us, being able to persist in the application is a huge help for the IT manager.
Applications like VPMs, antivirals, and mission-critical top applications — that also helps in productivity, right? So it’s not just a tracking device. It also helps in other areas of data security, which is very interesting.
Then going beyond that, which is the case in Colombia, a lot of customers are seeing our product as an inventory asset …
Finance Colombia: Like GPL.
Jorge Hurtado: Right. Because we are able to tell what the whole thing is in the computer, on hardware and software as well. So they don’t have to purchase such expensive devices, especially to work out of the network. And that is the key part: to work out of the network
Christopher Bolin: To take a quick step back and see why we’re important — why mobility is important — is exactly to your point. The way we’re using computing assets to run our businesses — our organizations, our government — has fundamentally changed. We’re using online services to do our day-to-day tasks, and mobility is exploding. There are more than five million devices that go online additionally every single day now. We’re no longer able to secure our assets with a fortress-based model.
In the old days you built the firewall, right? You put IPS around it. You continued to layer around the fortress and your assets to protect it. But with ever-increasing mobility, the fortress-model doesn’t work. And you have to assume that every single end-point that accesses your intellectual property or your assets internally is the perimeter now. If I can’t see it, then I don’t know these ingress and egress points from the network.
So what Absolute does is this: I can tell you with a high degree of assurance what the device is doing, where the device is, what data is on it, and if it was encrypted. If there’s an event that occurs, I can allow you to do remediation that is completely unique. You can say: “I want that device to be frozen,” “I want to send a message to the user,” or “I want to brick it completely.”
Finance Colombia: Here in Colombia, what tends to be your target customer? Where do you find the IT or security departments to be most receptive to your product offering, specific to the region?
Jorge Hurtado: That is an excellent question. I’ve been in the company for six years, and at the beginning it was very challenging talking with the chief information security officers and talking with IT managers.
The reason why is because, when you talk to them about their security policies, they are saying that they have some. Or then the question might be, “Well, do you have back-up on that data?” On 50% of the devices, the breeches originate on the device. They don’t pay attention to that. So they don’t have a real policy.
But they’re starting to get there. I meet with customers every week and it’s amazing. It’s amazing. They don’t want to spend time or money — until something happens. You will be amazed. Big companies are losing these devices every week.
But the trend is going up. There is more culture around security now, but it still is a challenge. So the sweet spot right now is the government, the public sector. Because they’re using tax money to purchase all of these devices, so there are laws that they have to comply with.