Transcript
Real stories, real defenses, and real recoveries, straight from the practitioners building and defending modern data environments. Data sovereignty more and more, but a lot of people would struggle to define it beyond keep our data in country. In reality, it touches everything where a backup can legally sit, to which government can compel access to it, to how a merger or acquisition can trigger a completely different set of rules overnight. Now, today, we're taking a step back from any one product or platform, and we're just talking about the issue itself, what data sovereignty really means, and why it's becoming a bigger deal, and what organizations should be thinking about as they navigate. Now, welcome to the latest session of Zero Downtime. I'm Jed Wallace, a senior technical marketing manager with Cohesity. And luckily, today, we're joined here by Bob West, a data and AI security officer with Zyera. Bob, why don't you tell us a little bit about yourself? Yeah, absolutely. First of all, thanks for having me, Jed. So I have worked in cybersecurity for a little over 30 years. I've had the opportunity to have the CISO title three times, twice with large banks. I've done consulting with Deloitte, E&Y, and on my own. And my role at Zyera is my third product role. Most recently, I was on the Prisma Cloud leadership team at Palo Alto Networks. And one of the benefits of my experience is that I can look at things from multiple lenses, right? If we're having a conversation with one of our customers or a prospect, I can put myself back in my CISO chair. I can look at things from a product perspective in terms of how do things fit together architecturally So that's the greatest hits. Yeah, I really think we, coming into say the vendor side of things, we have a lot of perspective because a lot of times we spent 10, 15, 20 years, what I would call in traditional IT, you know, getting that experience and being actual boots on the ground, you know, and then transitioning over into subject matter experts or something like that, which is, it's a neat job and transition. Yeah. And I apologize for interrupting you, but I think, you know, a lot of times if you've only had experiences with a product company, it's really hard to understand to your point. So how does this play in an enterprise, right? What are the issues? You know, how do things fit? How do you make sure that you create the right level of resiliency in a very broad context? And so, you know, I'm fortunate that I can look at things from multiple perspectives. I mean, at the end of the day, it's the ability to empathize, right, with the customer because you've been in their shoes before, right? Dealing with data, you know, products and all that other good stuff. Definitely. So if you're ready, I want to pick your brain with a few questions I have and, you know, give the audience some good information on data sovereignty. Let's do it. So if you're ready to kind of jump in, let's do it. So let's start with the basis, right? How do you even define data sovereignty and why does it feel like it's become like a much bigger conversation over the past couple of years in your mind? Yeah. So fundamentally, data sovereignty refers to a company or a government that needs to retain control over its information. So let's dig into that a little bit. So for example, I'm a company or a government and pick your favorite, let's use Canada as an example. Sure. There are regulatory requirements such as PIPEDA, which is a privacy regulation in Canada that says, I need to make sure that I protect citizen information properly. And if it escapes my control, there are challenges. So I think one of the reasons that has become a big issue is the changes in the geopolitical climate. Forget your political perspective right now, we have tension in between the United States and Canada. I have. I'm well aware of that. Yeah. And so let's say for argument's sake, one of the political parties has a database and they're keeping information in Salesforce, which has been pretty common for the parties. So number one, the issue is if I'm storing that in the United States or any other jurisdiction, the U.S. could do a blind subpoena and gain access to that information. And you wouldn't know that that subpoena was issued until after the fact. So a lot of it really- Yeah. That's a sad state of affairs. Yeah. Yeah. And so it's their responsibility to make sure that citizen information is protected properly. And there's a number of ways to do that. But the ideal scenario is that as an enterprise or a government, that the data is stored in an environment that doesn't risk the exposure of that data, right? And so fundamentally, that's the case. Same thing holds true in terms of enterprises. There's a lot of nation state issues that we're dealing with. And so the better that you can protect the data and retain control over it, it minimizes the risk of another government or organized crime gaining access to that information. Yeah, it's pretty sad state of affairs that countries that were indeed allies at one point now you have to question whether your data is safe and that's in said country. Yeah. And let's hope that that climate changes sooner rather than later. Exactly. I mean, it's interesting how something that sounds so straightforward like, where is my data? It turns out that it's one of the most complicated questions that organizations can ask, I mean, globally, right? Yeah, absolutely. And if I could give you another example, sure, Microsoft stood up data centers in Europe I believe Ireland was the first one, if I'm recalling correctly. And the reason that they stood them up was to make sure that they were complying with EU regulations such as GDPR. Yep. When it was stood up, and I want to say this was about 10, 11 years ago, by the way, this is my strategic advisor dream. I do not do podcasts or webcasts without her. And if you're lucky, you might see Katie as well. Awesome. So, I believe this was in 2014, 2015, it could actually have been 2016. The US took the position that they could subpoena information from Microsoft, irrespective of where the data resided. And in this particular case, the position was that they could subpoena information from Microsoft's data centers in Europe. So that poses a really significant issue in terms of sovereignty of a company or a government, right? And just fundamentally complying with regulations across the board. Yeah, I had quite a bit of experience with data sovereignty before the term became one of those buzzwords or phrases that people used. And that was voter data. We had to make sure that the data was here in the US, was being backed up in the US, and we weren't using any kind of cloud region to back up secondary copies, third copies or whatever outside the US, right? And we talk about some of our most critical data, I would say voter data is that. Absolutely agreed. And there might be one or two stories in the press right now. Right. Now, okay, so for organizations operating across multiple countries, how do they even begin to reconcile data laws that can conflict with each other? I mean, what does that actually look like in practice to you? So that's a very good question. And, you know, we work with global companies that have operations in 150 or more countries. So I think the short answer is it's very hard to satisfy every country around the world in terms of their regulations. Having said that, the spirit of it is that you do what's commercially reasonable to protect information. I'll give you a really good example. Let's say you're using ISO 27,000 or the NIST cybersecurity framework to protect information. If you're taking a comprehensive approach, that will get you very close, if not exactly on target to complying with GDPR, which is one of the strictest privacy regulations. It is. It definitely is. Yeah. So then you have to figure out what's the difference in between GDPR and other privacy regulations around the world. Yeah. And, you know, I think you can tell a good story to most governments, unless there's an unusual situation, to say, you know, we're doing what's commercially reasonable to protect the data that you have and pick your favorite repository, right? Yeah. And let's say for argument's sake, you know, it becomes a contentious issue. You can then have conversations with the government directly and either come to an agreement to say what you're doing makes sense, or you can make a business decision to say, given the constraints, we may choose not to do business with this particular government or companies in that country. Yeah. Those are hard conversations. Without question. For sure. Yeah. Yeah. So it's less about finding one right answer, and you would say it's more about building a strategy. You know, it's flexible enough to hold up in, you know, a dozen different jurisdictions at once. Right. Yeah, absolutely. And for example. This leads me to my next question. So Swiss citizen information. Where is the organization getting? Go ahead. Go ahead. No, no, no. Finish your thought. Yeah. So, for example, if you think of Switzerland, Swiss citizen information cannot leave Swiss borders. Hard stop. So if there is enough revenue opportunity for doing business in Switzerland, you can make the decision to say, yeah, it does, in fact, make sense to stand up an entity within Switzerland. Again, it depends on each particular case, but there's always ways to get things done. Yeah, there is. And thank goodness for Switzerland. There you go. Right. They have pretty good watches along Bahnhofstrasse. Very true. Very true. So where do you see organizations getting data sovereignty wrong? I mean, are there common misconceptions or, you know, blind spots that tend to catch people off guard? Yeah. You know. So again, another good question. I think a lot of times companies don't do their homework in terms of really understanding what it means to comply with regulations in multiple countries. So I think bucket number one is just lack of knowledge in terms of what constitutes data sovereignty and how you make sure that you comply with the respective regulations. And I think the second thing would be the velocity of business. And companies will make a decision to say, yeah, we need to make a lot of revenue addressing data sovereignty. Not that it's right, but they may perceive it to be a secondary issue. Right. And then I think the other thing is just keeping up with regulations, right? Regulations change on a periodic basis. And so, you know, keeping up with regulation is important and they may not have the regulatory compliance expertise in-house. And like anything else, understanding who has the answers to that is one of the fundamental things that you need to do to make sure that, in fact, you are addressing data sovereignty issues. Right. I mean, that's a great point. I mean, it sounds like the risk often isn't malicious. It's just not realizing that the rules that change right under your feet. Yeah, absolutely. I mean, a really good example of that is the EU AI Act. Right. You know, it's a new regulation. I am willing to bet that a substantial percentage of companies in countries don't understand all the requirements and as such, they may be flying blind. Yeah, especially when you don't live in that country. Exactly. Right. So, yeah. So how would security and compliance leaders be thinking about the balance between data sovereignty requirements and the operational reality of running it in a global business? So the foundation is having proper governance. Right. You know, you've got to have the right dialogue established with the legal and compliance groups. And those are the ones that can really either help you understand what regulations you need to comply with. If they don't have the answers, then you engage outside counsel, whether it's a public accounting firm, whether it's attorneys, a combination of the above. Right. But ultimately, the most important thing is establishing a dialogue with legal and compliance and then they can bring in, you know, the subject matter experts, whether they're internal or external to the company. And then again, one of the major things that's important about proper governance is that decisions can be made to align with business priority. And CISOs and CIOs, that's just not their responsibility. And they probably have limited knowledge around data sovereignty or any other regulation. Right. Yeah. You know, we talk about in the security space, right, which this, of course, I think lives in the security space as well, is that it takes a village, right? You have to have compliance, legal analysts, data backup admins, CIS admins, like you have to have all these people talking and working in lockstep to make sure that they're in compliance. Yeah. Yeah. And I think you just raised a really good point in terms of, you know, I think people look at day-to-day operations and look at the systems they rely on to make sure that those systems are protected properly and that the information is stored in the proper jurisdiction. But a lot of times when you think about backups, they may be stored in a separate jurisdiction. And so really looking at things from an overall lifecycle perspective to understand, here's the entirety of my organization, right? It's not just the production information. It's test systems, development systems, backups, et cetera. Yeah. And, you know, it's about, I say this a lot, knowing your data, right? Like where it lives and what actually, you know, is in the data. Is there PII, stuff like that, right? Yeah. Yeah. Knowing that, you have to know that in order to, you know, be compliant or know where you need to be able to store the information or the data. So like I said, you're in compliance. Yeah, absolutely. For example, Dream, who's sitting on my lap right now, I don't think she'd be very happy if her feline information was leaked out somewhere, right? Really the only, I just live to serve Katie and Dream. I mean, that's really all that there is. That's the only important thing in life for me. Yeah. I should bring in my two miniature Datsuns and they'd probably steal the show. No doubt. But it comes down really to designing, you know, for that tension from the start, right? Rather than treating it as an afterthought, once the regulators come knocking on your door. Yeah. You know, and I find it interesting. There's always tension in between security and other organizations in an enterprise, right? It could be the business. It could be the technology organization. Yeah. I haven't told you, but I'm an absolute governance bigot. So if enterprise decisions are made with the right group of people when conflicts happen, that really addresses the foundational issues. So for example, let's say application developers don't like the security team. They don't like security testing. And the first step to address those types of issues is security speaking to the developers of the development team. And the top track is, look, you know, as security, we're here to help give you the tool to make sure that the environment is protected properly. And here's why it's important to do security testing. I think you hit on a good point is, I mean, there's actual jobs out there. It's their job to actually liaison between these said departments, right? It's this person's whole entire day is to make sure that these departments are playing nice and communicating, you know, which I find interesting because in the past, it's I've been in, you know, the situations where, you know, we're fighting with security because, you know, security can make your job a little harder, right? Especially if you're a sysadmin or a developer, security is 100% necessary, but that doesn't mean that it doesn't have a cost to it, right? Well, that's right. And a lot of it really depends on your approach and how you communicate things. You know, there's a lot of security groups that are still the business prevention units, right? And, you know, there are the guys and gals that say no, and that's not the right approach. So where I was going with this is that 80% of the time, providing context in terms of why security is important to developers, it gets you there. But then there's the 20% of the time where the developers go, yeah, whatever, you know, why don't you go take a walk in the park? If the proper governance has been established, and the decisions have been made as an enterprise, at that point, the logical response is, you know, look, as security, it's my responsibility, whether it's a CISO or someone else on the CISO's team, to make sure that the enterprise is protected properly. And I appreciate your perspective, but at the end of the day, if it's not something that you have the desire to do for whatever reason, it's my responsibility to escalate the issue. And ultimately, the direction is going to come down through your reporting structure. And that's not something that I want to do as security. But if you maintain your current position, it forces my hand, right? And so, you know, you think back at Teddy Roosevelt, you know, speak softly and carry a big stick. You know, you've got to have the checks and balances. And we can talk at some other point in terms of, you know, incenting people to do the right thing. But ultimately, that's the correct path to go down. Yeah, so what I was saying is that you've got Teddy Roosevelt saying, speak softly and carry a big stick. So you've got to have the right incentive in place. But people, just from a psychological perspective, respond better to positive incentive as opposed to negative. Yeah. And many times we get that wrong. And so it's a much longer conversation for another day. But getting the right balance in place as an organization is the ideal scenario. Yeah. Telling a developer, hey, if you don't, you know, put this in place and we have a data breach and we lose, you know, hackers get a hold of some PI, that could be someone's job, right? Yeah, exactly. And to your point, I, as security, want to make sure that you as a developer aren't the root cause of an issue, right? And I think a lot of times we don't spend the time communicating to people, what does this mean to me? Right. So looking ahead, how do you see data sovereignty, you know, the landscape evolving? I mean, are we heading towards a more, you know, more regulation, more fragmentation or some kind of convergence? I mean, what should leaders be watching for? I think the answer is yes. I think it's a little bit of... In short, yeah. So let me expand on that. If you look at things like agentic AI, for example, there are most organizations right now are going through a ready, fire, aim exercise, right? You know, they know they have the need to use generative AI. Agents can make your life easier, but they also don't understand the risks. And if there aren't the right controls in place around agentic AI, for example, it's very easy for data to go outside of the organization's control. There's a lot of people that don't understand. There's a social media site called Maltbook that is designed for agentic AI. So if you don't have the right controls in place and an agent goes to Maltbook, what's to prevent it from sharing the information that it's gathered for you as an enterprise? Right. You know, that's one of N types of things that are going to happen. So I think of the EU AI Act, for example, being version 1.0 of regulation around AI. I think it's going to change. So this is a starting point, right? Absolutely. You know, the thing that I communicate to people is, to your point, you know, this is a good baseline. Use it as a reference. There's going to be other regulations that follow. But if you are using, you know, NIST's guidance on protecting AI ecosystems, you're more than likely going to be able to comply with the EU AI Act. And the majority of subsequent regulations that are published by governments. Right. That's a great note to end on. And, you know, this isn't a settled issue, right? It's a moving target, which, you know, it means you have to stay part of the ongoing conversation and, you know, it's not a one-time checkbox, you know, on a list of things you have to do to become compliant. Yeah. And I think one last thing, apologies for interrupting you, but... Yeah, no, absolutely. Have you heard of this little thing called quantum computing? Just a little bit, yeah. Yeah, yeah. You know, one or two people might have heard about it as well. But that's the next wave in terms of, you know, when you have quantum-ready systems in production, how do you address them? Right. Yeah. That's definitely food for thought. So, I mean, thank you so much for joining us today and, you know, to find out more about how organizations are thinking through data resilience and security strategies. I implore people to go to coecd.com for our latest insights and our best practices. And if you found this discussion useful, follow, you know, follow us for more Zero-Time episodes and you know, where we'll explore more trends that are shaping data security in 2026 and beyond. Thank you again, Bob. And that's a wrap of another episode of Zero Downtime. And thanks everybody for watching. Thanks, Chad. Thank you so much.
