Stop Thinking IT Security – Think Business Risk! Simon Piff, Vice President, Security Practice IDC Asia Pacific @spiffatidc www.cloudsec.com | #CLOUDSEC
IDC FutureScape: IT Security Products and Services ‐ APeJ Implications By 2019, 50% of all online transactions will incorporate biometric authentication driven by 1 a ubiquitous technology infrastructure that enables low implementation costs and broad user acceptance. Cyberattack By 2019, more than 75% of IOT device manufacturers will use security and privacy as 2 Companywide Disruption 3 competitive positioning to capture the attention of security and privacy advocates and earn consumer trust. 3 By 2019, nearly every major multinational corporation with ties to the U.S. or Europe will Biometric Consumer PII 4 Authentication face significant cybersecurity attacks aimed at disruption of commodities. ORGANIZATIONAL IMPACT 1 Over the next two years, 80% of consumers in developed nations will defect from a 4 business because their personally identifiable information is impacted in a security or business units 2 departments breach. Multiple Doc #AP42209917 By 2018, 30% of enterprise cybersecurity environments will incorporate cognitive/AI IOT Security 5 and Privacy technologies to assist humans in dealing with the vastly increasing scale and complexity of Cognitive Cloud Security cyber threats. Cybersecurity Gateways By 2018, 30% of enterprise customers will leverage analytics ‐ as ‐ a ‐ service to help solve the 6 5 Incident Response challenge of combing through security related data and events 7 6 Retainers or a business 10 department Analytics ‐ as ‐ a ‐ Service 9 A single By 2020, cloud security gateway functionality begins to be integrated as part of web 7 unit Cloud, Hosted, & SaaS service offerings to entice IT leaders to move offerings to the cloud. Security Services IP enabled By 2020 30% of U.S. broadband homes will have at least one IP enabled home automation Home 8 8 Automation or security monitoring sensor/device Reactive security services such as Incident Response and Forensics services will marginally 0 ‐ 12 12 ‐ 24 24+ 9 increase by 2020 but still overshadowing proactive services TIME (MONTHS) TO MAINSTREAM 10 By 2025, on premises security management will be a thing of the past subsumed by SaaS security and Network ‐ based security. 3 IDC FutureScape: Worldwide IT Security Products and Services 2017 Predictions – Asia/Pacific Excluding Japan Implications. Doc #AP42209917
Getting Past The Eye Test (on Previous Slide) • Mobile biometrics • Analytics • IoT • Cloud security • Cyber ‐ terrorism/warfare • Incident response and Forensics • Consumer reaction • Security as a service • Machine learning/ AI
So Much For The Future. What about today?
IDC IT Security MaturityScape Benchmark Report ‐ APeJ 84% at Stage 43.8% 40.2% 1&2 9.2% 6.1% 0.7% Proactive Partner Predictive Professional Compliant Companion Naïve Novice Reactive Responder Robust security program with strong Risk recognized as an element S olid security program and control Full-time staff address most Employ basic operational compliance and early exploration of of overall business value framework address all regulator significant security requirements security measures and act on the cost effectiveness of solutions proposition for technology, and needs and internal risk but look to external sources to security needs as they arise the security strategy approach assessments provide guidance in compliance- seeks most efficient and oriented program effective ways to manage enterprise security Business Outcome Business Outcome Business Outcome Business Outcome Business Outcome Organization Organization invests Organization has an Organization Organization keeps successfully manages significant resources efficient and effective unknowingly accepts auditors at bay but can risk but lacks and money but has economics driven large risks that leave it be challenged in a understanding of difficulty describing security strategy, extremely vulnerable breach scenario and critical overarching value proposition in including risk returned overspends on business context strategic terms per unit cost, for entire ineffective measures portfolio n= 852
IDC IT Security MaturityScape Benchmark Report - India 51.5% 94% at Stages 0.1% 1&2 1.3% 4.6% 42.5% Compliant Companion Naïve Novice Reactive Responder Proactive Partner Predictive Professional S olid security program and Robust security program with Employ basic operational Full-time staff address Risk recognized as an security measures and act control framework address strong compliance and early most significant security element of overall on security needs as they all regulator needs and exploration of the cost requirements but look to business value arise internal risk assessments effectiveness of solutions external sources to provide proposition for guidance in compliance- technology, and the oriented program security strategy approach seeks most efficient and effective ways to manage enterprise security Business Outcome Business Outcome Business Outcome Business Outcome Business Outcome Organization unknowingly Organization keeps Organization invests Organization successfully Organization has an accepts large risks that auditors at bay but can significant resources and manages risk but lacks efficient and effective leave it extremely be challenged in a money but has difficulty understanding of critical economics driven security vulnerable breach scenario and describing value overarching business strategy, including risk overspends on ineffective proposition in strategic context returned per unit cost, for measures terms entire portfolio
31.4% 19.4% Source: IDC Asia/Pacific C-suite Barometer Research 2017 India 8
The Critical Issue for all organizations • It’s not about IT security – this limits the view and places all the resolution onto over ‐ stretched IT teams. • It is about Business Risk – this engages the business units, the executive and the board, and helps define the role IT play in the process.
Attacks are Everywhere!
A Highly Transformed Industry • Niche engineers design advanced products • One organization employs hundreds of malware designers, linguists and other professionals • Key products will the keyboard language before choosing to execute, or not • Avoidance technology embedded in many “applications” (seeking bare metal, and not a VM before executing • Use social engineering for targeted campaigns • Extensive use of big data and analytics to identify further opportunities • Delivers 24x7 helpdesk support • Offers a range of offerings “as a service” • Leverages Cryptocurrency for global transactions
However … old habits die hard
Distributed Integrity Prevention Detection Mitigation Response Endpoint, AV, firewalls, patches, Monitoring, analytics, IDS, DLP, Mesh, Hub & Spoke. IT response user training, 2FA, gateways, tags and tethers More process driven than Crisis Management response micro-segmentation technological Legal mitigation, press & PR strategy
Essential Guidance
Re ‐ Format the Issue • It’s not IT security. It’s what IT can do to limit business risk • Engages other parts of the organization that need to have a stake • Ensure the CEO/Board understand there is no such thing as being connected, and 100% secure • Drives the conversation from protection, to risk management and mitigation • IT security has at least two distinct mindsets • Hunters – who are constantly tasked with seeking threats across the internal systems • Remediation team – who respond to and remediate the threats that the Hunters detect
The funding model for IT Security is more akin to Military Spending that Military Spending traditional IT metrics of ROI
Understand Your Unique Environment • What is at stake for the business? • Legislative compliance • Core Intellectual Property • Personally Identifiable Information (customers, employees, partners) • Business Continuity • Understand the Threatscape • What do you own that is of value to the hacking community? • How equipped are you to protect this from a persistent threat? • How well do you monitor you internal systems and critical employees? • What level of access do you provide to customers, partners and contractors?
Resourcing!! • The future is SecDevOps • Embed security at the outset, no more bolting ‐ on after the fact • Chief Security Officer • Have one! • Not reporting into IT! • The “Hunter” team only reports into the CSO (Remediation team is part of the CIO, COO remit) • CEO engagement • If the CEO does not have a KPI for security, then it will never get the attention it requires
Recommend
More recommend
