Name: The Unstructured Data Blindspot: Why Your Most Valuable Assets Are Your Least Protected
Uploaded: 2026-02-19T18:46:12.306Z
Duration: 30 min 8 s
Description: The Unstructured Data Blindspot: Why Your Most Valuable Assets Are Your Least Protected

Transcript for "The Unstructured Data Blindspot: Why Your Most Valuable Assets Are Your Least Protected": Welcome and thanks for joining us at Rubrik here on a webinar about the unstructured data blind spot. Why are your most valuable assets your least protected? My name is Jeff Hughes. I've been with Rubrik for about five years and I head up the engineering team that is responsible for all unstructured data here at Rubrik. Prior to Rubrik, I've spent about fifteen years, you know, when we used to count data pre petabyte era into the petabyte era. And really, I found that the management side of this is honestly the more challenging side than just storing it these days. And so I'm excited to talk to you about that as well. Jennifer, would you like to introduce yourself? Sure. Thanks, Jeff. I'm Jennifer Glenn. I work for IDC. I've been there for approximately four years. I cover information and data security, so that looks at everything from your information protection tools like DLP, data classification and discovery, all the way down through, you know, encryption and key management and that sort of thing. So, looking forward to talking about this today. Great. Thanks, Jennifer. And Chris, do you mind introducing yourself? Sure. Hi. Thanks, Jeff. My name's Chris Vesperman. I work for Walpert, a U. S.-based company that works worldwide. I'm the team lead of the SysAdmin Group, covering all things, on prem and cloud, infrastructure and all things related to that. I've been in the IT field for, over twenty years, hitting pretty much all the infrastructure verticals and also DevOps and security ops. Great. Thanks, Chris. You know, to dive right in, I thought I'd give a story of, here at Rubrik, we help customers all the time in in the recovery process, And just give an example of what we see out there in terms of how attacks happen and what that blind spot can look like. In this scenario, came out pretty well, but there's a lot that went into this. So the customer that we were working with is in the eDiscovery business. They focus on helping, you know, the legal establishments out there recover and search for data that's needed in various court cases. Obviously the availability of that data is particularly critical for their business. In this scenario, their primary NAS filer and their secondary NAS filer had a vulnerability that led to a root compromise on both of them. On the primary side, all the data was deleted. They formatted the system. On the secondary, they had locked it down in a way and encrypted much of the data in an effect to have a ransom associated with that. It was about six petabytes across both of those systems. Fortunately, since they are very oriented around the legal cases that are active, they had the ability to restore those key customers within the first thirty six hours and get back to some of their business with a full recovery in ten days here. This is really what the anatomy of attack looks like in the positive case. What I think that we often see though, is that unstructured data is very large. And what we found is the usual story of it's growing massively, but also that it consumes a major part of your infrastructure. When you see it's over 90% these days in terms of the footprint you have there. And being that large, it's very easy to be not talking about it. In fact, the most common story that I hear is, I don't think it's possible to protect that data. And so today I wanna talk a little bit with the folks here in Jennifer and Chris of just what our experiences are around this, and really how do you identify the specific assets that really are critical to your business and understand that deeply. I'm gonna hand it over to Jennifer to give a little bit more context and some data associated with this, to understand just the lay of the land of what we see out there in the industry. No, thanks, Jeff. I think this is great. I, you know, when we were initially talking about this and you were talking about the data blind spot, you know, I was looking at the data we had, and I said, I'm not sure if maybe it's a blind spot or is it maybe getting lost in a crowd or obfuscation by volume, because we really look at the data that we've estimated that there is essentially 92% of all data in the enterprise is considered unstructured, and it's continuing to grow, so this will be a problem as the years go on. And I mean, when you think about the amount of data that is being generated in an organization in general, 92% of that being unstructured is just simply a massive amount of information. And so when I think about what all that data is, though, and I think, you know, just focusing on all data is one thing, but not all data is equal, right? And I think I'll probably say that at least five times in this webinar, but what I really think is the data that we really should focus on is the data that we know is valuable, right? Value could be anything, whether it's quality or volume, but what we really want to talk about is what data is sensitive, what data is confidential, and obviously, so coming from the security space, we have a taxonomy at IDC, and the way that we think about this public would be something in your press releases or on your website. Internal data is considered to be information you may not want out there, but it's not going to get you in trouble. But when you start looking at sensitive data, that's your PHI, your PII, That's 22% of all overall data, and then when you look at confidential data, which is your really specific, critical to your business data, your industry secrets or your trade secrets and intellectual property, that's another 22%. So almost half of organizational data is sensitive and confidential, which, you know, I think is a really important fact to know when you're looking at the overall gaps and blind spots in what data you have. Alright, so what I really want to talk about when we talk about sensitive and confidential data is that we have a lot of data and it's at risk, right? There is a big hole that sort of opens the door for ransomware attacks to come in, look at your data, and really put your company on the ropes. In this slide, I put up this number here that 50% of organizations that we've spoke to have experienced ransomware and paid some sort of frenzy, right? So clearly, that's a lot of money that's being put out there. I would say most of that money is roughly around $100,000 which, you know, for a mid sized business is certainly not pocket change. Then you add in the downtime, right? When your data is not available, whether that's unstructured or structured, you know, it's not available. It's not there for revenue. It's not there for productivity, and 36% of those experience that disruption and unavailability of data for longer than a week. And then this final piece, which I think is really interesting, I threw up a big number on there for attention, but when we talk about ninety two percent of these organizations that have experienced this ransomware, ninety two percent had some sort of data exposed and exfiltrated. Now, looking at that from the more important piece, right, your sensitive and your confidential data, I would say that only 24% of the total had sensitive data exfiltrated, and so again, 24% may not be as big of a number as 92%, but I think Jeff and Chris can maybe agree that 24% of data being exfiltrated is not is that good. You know, go back to your your last point of view of just if that 24% is your most sensitive data, that's pretty critical. And that's where I see that there could be a big gap. You know, I also, being in the business of ransomware recovery, I see this pretty frequently, but I was wondering, Chris, you know, as a practitioner out there, what has your experience been with ransomware? Both, you know, incidents that you've been a part of and and what that looks like. Thanks, Jeff. Yeah. Fortunately, I've only had to deal with the remediation of two ransomware attacks, so I can give a little bit of information about the first one. The data affected was a mapped drive, corporate file share that we all use on a daily basis. A user had a compromised machine and ended up encrypting all of the data that they had access to. The malware wasn't as advanced as what we're seeing today. We didn't have that sprawl using tactics like worms to increase its foothold. So we had basically one single share that was completely encrypted. This wasn't a large amount of data. We were unsure of what data was valuable, what data was old. The main task at that point was just to how do we stop this from happening? How do we recover this data? And how do we prevent it in the future? No, absolutely. Know, it's it's interesting. When I talk to folks outside of the IT world, you know, and I talk about ransomware and it's it's ever presence, it's also interesting to hear, look, you've had experience with this as well. It's not just like a one off sort of thing. These are happening daily. I can certainly attest to that as well. You know, what was most important in that process? I'm sure you were in the pressure cooker as, you know, all sorts of folks were pushing to remediate this. What were kind of the key things of how you guys investigated, what you understood out of it, and and really what the outcomes were as well? Yeah. So after we identified the the source of the ransomware infection, we were able to completely remove the compromised device from our environment network. And then it was just a matter of looking and researching to try to figure out what what data was compromised. So we knew the the data on that user's machine was compromised. And then it was questions of what did they have access to, which took a little bit of research, asking the user, looking at their Active Directory account, group memberships, and then combing through basically what, at least at our best effort of what are these groups used for? What access do they give? Are there gonna be nested paths with access they have? Just trying to trying to ID what their footprint of access. That was done kind of at the same time of just digging in to our different shares on our file servers, finding all of those files that have been renamed with text files of with the, you know, the Bitcoin address to, you know, send the ransom to. And in this scenario, how how did your backups perform? That was one of the well, I think one of the positive situations in this. We were extremely diligent about testing backups. They're they're no good if you can't prove they work. So we were able to fairly quickly recover that data to minimize any disruptions to the business. But whole situation in general just raised, at least those of us in IT going through this recovery process, a lot of questions. And I'm sure you can imagine that IT leadership and business leadership had pretty much similar questions and even more, you know, about the situation, how we got there, and where do we go from here. Yeah, no, it makes sense. You know, Jennifer, I'd be curious on your take of these sorts of events, and what you see across the industry as well. You know, when I talk to users, when they call and talk about ransomware, it's very similar to what Chris was saying. I think, you know, a lot of the questions from a security side that I hear are, what was accessed? How do we know? We need to know what was accessed so we know sort of the action to take afterwards, right? Do we need to make an incident notification or an exposure notification? You know, how do we prepare for any sort of violation of compliance, right? We have to understand where we're at from that, and then also, as Chris was saying, what's next? Like, how did you know, we have to figure out what went wrong so we can go back and make sure that it's you know, that we've corrected all of the open vulnerabilities, if you will. I think what was also interesting, and you sort of talked about this with Chris kind of a little bit, maybe you alluded to it a little bit, maybe this was in our earlier conversation, but I'm interested on sort of the other people that were involved in this. Clearly, as a backup, that was very important. You play a very important part of responding to ransomware, but I know looking at some of the data that I have, when it comes to ransomware, it's kind of a team sport when it comes to recovery, right? It's not just the data resilience team, right? It brings in security. It brings in maybe business leadership. Do you have any more that you might share on that? I think that would be really interesting to hear, Chris. Yeah, that's a great point, Jennifer. Yeah, it was an all hands on deck situation, honestly. We had different groups from IT. We had our legal counsel, legal team involved. A lot of folks wearing a lot of different hats. It was, you know, as we were cleaning up the encrypted data that we knew about, we kinda relied on a few other folks that a few other folks that had access to large amounts of data and just asking them, hey. You browse around. Look for anything weird. We also had another team looking to see if we could identify, have any other machines been compromised? Was this a a blanket attack, email attack across the company, or was it more targeted or maybe just random? They're trying to work with IT leadership and our legal team of this was the first time this happened in this organization. There was a lot of what do we do conversations. We weren't quite sure, And that in itself showed a gap. We really didn't have a plan for when you run into a situation like this. You hope you never have to. But it it does kind of it shows the holes in your armor, if you will. Know, bringing it back to the the IT side as well. I feel like there was a couple of pieces there that I I see very commonly, which is just the visibility aspect. It sounds like it, the visibility of what got, impacted was, as you said, folks browsing around and saying, Hey, do you have access to this? Or what doesn't look right? The other is, you know, backups work to this scenario. How do we ensure that that's always the case? So, you know, I wondered if Jennifer, you could talk a little bit about that. I think that's a good point about the backups, because what we're seeing more and more in our research on ransomware is that attackers are really starting to ramp up their attacks on backups. They're trying to ruin them or delete them and basically make it so that recovery is really challenging. Now here you could see it's almost, oh gosh, almost 50%, almost half of the situation where the backups are targeted. Now luckily, 22% of the time, they're successful the attackers are successful, so it's a lot less, But again, going back to what we were talking about before with the sensitive data, here with the backup too, I mean, 22% is a lot smaller than some of these other numbers, but that 22% can contain a lot of really valuable and important Yeah. I feel like this really highlights the first blind spot that I see in unstructured data. When I talk to a lot of organizations out there is, if you have petabytes, tens of petabytes of data, do you even back it up? You know, I think it's pretty interesting that, a lot of times folks don't know if backup strategies can go do that. And many times replace it with replication. I give the example, upfront when I was talking about the e discovery company that we worked with. They did have a primary and a secondary filer for Doctor scenarios. And fortunately in this scenario, they did have a backup. But in many cases I see with just based on the size, unstructured data can be a place where you don't back up. You know, I was wondering if you've seen that much too, Jennifer. Yeah. You know, I have to say, that's not something I talk about a lot, but I mean, just given the gap of or just given how much unstructured data there is in the organization, it's a lot to back up, right? It's a lot to go after and I think it's, and we'll talk about this in a later slide, but I think sometimes the value of that data, the sensitivity of that data, is sometimes subject to opinion on whether it's sensitive or not or depending on who has it, and so sometimes backing it up based on that level of value or sensitivity is not always of utmost importance, but when you think about, again, the volume of that data, if a good portion, you know, I think we said 22% of organizational data, of that 92%, right, is going to be sensitive, right? Another 22% is going be confidential. If you're not backing up that 22% of the 92% of unstructured data, you're missing a very big amount of data that should be available and easily backed up. Yeah, no, you know, it's a, I wanted to give another example that I'd worked with out there. In the healthcare space, we see very, very large amounts of data, particularly usually in medical imaging or electronic health records. And this particular hospital system that was attacked, they were using replication. And in that scenario, it was a long recovery process that in fact impacted patient care. There's a great study out there that shows that, you know, depending on ransomware's effect, it can have differentiated outcomes for patients. And so this is both the risk side of it, can be very high in terms of what are the, you know, we're not just talking about business outcomes, but health outcomes here as well. So the risk of this data being missing can be incredibly high. On top of that, now you're talking about the financial implications that can come out of that as well. You know, I was curious of, know, one of the pieces Chris, that you said that was so key was the visibility side of it. You know, what were some of the outcomes you had after going through this experience of looking through data, trying to kind of crowdsource what was impacted, etcetera. You know, what was that life like after the recovery process? It was interesting for a while. So one of the topics we started discussing was, one, the situation. So we had basically two departments. Their data was compromised. We started asking ourselves, what if our whole file server was compromised? Do we do we know enough about our data to be able to ID we need to recover this particular set of data first? Not knowing the importance and value of the data was kind of one large roadblock we had ahead of us. So different conversations with multiple business leaders and departments to be able to get I think we just had an Excel list, honestly, of here's our most most needed and most sensitive data. So if we're ever in this situation again, once once we start a recovery process, you know, we had our hit list to go down. Basically, of data to restore. So that was something that was identified in our postmortem conversations, just to have that information. Now that we have that information, how do we use it? And how do we prepare ourselves or others to be able to use that information in the unfortunate scenario that a situation like that would happen again and possibly be worse. It was great that Chris had identified kind of, Hey, what is the classification of our information? Organization, I was curious what your take was, Jennifer, and what you see across the industry. Yeah, across the industry, I will tell you that a lot of the questions I get are on classification, right? That seems to be the hardest, the most difficult challenge that most companies I talk to are dealing with: how to classify things appropriately, because that's also where you get the accuracy for any action taken on it, right? But when we did a survey a couple of months ago on just talking to, you know, CIOs and CSOs the data that they're responsible for, I thought this chart was really interesting because when you look at the gaps between confidential data and sensitive data and what's being protected or monitored and is visible on a workflow map, 72% of the companies that we spoke to, 72 of those respondents, mentioned that they had more than three quarters of their confidential data mapped. Now, if you remember back when we first talked about it, confidential data is your company secrets, your trade secrets, your secret recipes, or things that are really powerful to your organization that can really impact the viability of the organization, right? And most organizations know these off the top of their head, so it's really easy to identify those, find them, know where they are, and put the appropriate protections around them, right? Have them mapped and visible. But when it came to looking at the sensitive data and we identify sensitive data as, you know, things that, you know, do have value. They're very important. It's the PHI. It's PII. It's some of these records that have value to your customers, that have privacy value and compliance value, that there were actually a lot smaller. I would say only about a third of the companies that we spoke to, a third of those respondents mentioned that they had 75% or more of that sensitive data mapped and monitored appropriately. So to me, that just extends like there's a really big gap in being able to truly classify sensitive data enough to feel comfortable putting it on a map. But then I think also to the point of what we've been talking about is unstructured data. Sometimes it's really hard to find that unstructured data to be able to classify it and map it appropriately. I was just going to say the same thing. You know, I find that unstructured data is where a lot of that sensitive information lives. You know, whether that's, I've worked with medical imaging, like I was referring to a hospital system before, or when you start going into, you know, I worked with a insurance company, where all of their claims records are going to contain a lot of information about your customers, that you probably don't want out there, including the events that were not so fortunate in their life as well. So that, the really that, that unstructured data and sensitive, I find overlaps quite a bit. And I think I see you nodding as well, Jennifer. Yes. Yeah. You know, want to get around to the kind of, what can we do about this? You know, we've talked a lot about the challenges with it. I was wondering if you had any best practices you see out there, Jennifer. Yeah. I mean, you know, obviously I work in the security space. So a lot of the organizations that I speak to are putting data security technologies in there. Data classification, obviously, is the top one and discovery. But data security posture management has also really emerged as a technology that companies really use to not only find where all of their data is, but sort of understand its use, understand who has access to it, and really sort of create a better overall visibility of where all that sensitive data is, right, and the dependencies on that data, because I think that's also really important, right? And it also offers context to take action. I know Chris was talking about, you know, how do we where do we go from here once we're done looking at that ransomware?' Like, I think you need to have that clear idea of where all of your data is in order to, you know, take a better action moving forward. Yeah. You know, I always call this like, how do you get more granular on unstructured Is that, in reality, you know, unstructured data has varying amounts of value, you know, hugely from, hey, this is my dumping ground to, this is my highly, you know, sensitive information. And so both that visibility, but also capability of going wide. Right? You know, if if you are saying, oh, that whole system over there, it's scratch space. Is it really? Do you know? You know, I I I here at Rubrik, we do have a, you know, DSPM solution that is really around helping you understand that because I often find that it's, if you try to take broad strokes at your unstructured data, you know, that assumption can really backfire on you as well. You know, the other side of this is having a common framework to work with across organizations. Think going back to, you know, Chris, the example you gave there of, Hey, look, when you're in one of these events, everybody wants to have a piece of that. Everybody's wearing any hats. I was wondering if you could talk a little bit more about, you know, again, what you think would help in bridging that conversation from you as the ITER person to the legal side of the house as well. How visibility or the scale of this really has been challenged in your experience. I think probably the largest challenge to overcome would be, you just mentioned it, just the scale of it. So ten, fifteen years ago, the amount of unstructured data that a company's had, nowhere near the size that it is now. One of the probably one of the bigger hurdles is being able to classify that much data and to put tags on how important it is, its value, is it confidential, is it sensitive, all these different tags that Jennifer was mentioning in the surveys that they did. As the data grows, it's just that much harder to be able to do that initially if you're not someone lucky enough to have done it when your data is very small and grown over time. But also the rate at which your data grows. How do you scale that process of being able to keep data identified and tagged? Yeah, know just that. And then, I've seen this as well on just the protection side of how do you get an efficient copy of all that data? You know, if we have just the sensitive data identified, it's still comp, you know, it composes a large amount of data involved there. And so, you know, that's something that certainly I've spent a lot of time with helping customers out as well. But, Jennifer, I'd love to get your take on kind of the key challenges or requirements you see out there. Yeah, I think Chris touched upon this, and we actually did talk a little bit about this before, but the bringing together all of the different teams, all of the different sort of constituents of data and business risk, right? Every legal team needs to understand this risk. Your security team, your IT team, the backup team. Understanding where that risk is really is an area where communication is important, right? I think it's really important to make sure that as these companies are pulling this together, that they're also kind of speaking in the same language of business risk. I think that's something that I see as something moving forward that needs to be done. Yeah. You know, frequently I see that an organization, each part of it is going to have its own toolset. You know, on the InfoSec side, you've got your SCENE tools telling you where you're at. On the IT side, you might have that data classification, but do these two intersect in a way? And then, you know, go deeper to the application side and saying, Hey, how is this data used and who are the users associated with it? And it becomes an even more complicated So I totally agree that having a common framework to look at and use is something that when it is in place in an organization, I see that they're a lot more fluid in doing these things. And I definitely say it's a goal to hit for. You know, I think that we spent a lot of time on this today. I was wondering if you have any more final thoughts on the topic of just this blind spot around unstructured, Chris and Jennifer.