Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
As enterprises look for ways to leverage the cloud, mobility, Big Data, and social media for competitive advantage, CISOs can no longer give blanket refusals to IT experimentation.
June 30, 2015
4 Min Read
Change has been a constant in the cybersecurity industry over the past few years. One of the more subtle shifts is that CISOs have had to learn to appreciate -- and use -- the word “yes.”
For years, information security executives have been conditioned to say “no” to any new technology initiative that was perceived as presenting potential risks to the organization. The average security practitioner instinctively says no to almost everything. Whether it was no to requests to move into the cloud, to open up a site to external users, to expand use of mobile devices in the workplace, to adopt social media for business applications, the answer was no because of the possible security risks these ventures represented. Saying no became the security chief’s biggest data protection strategy.
But security executives are learning -- and are continuing to accept -- that saying no can actually put their careers at risk. As enterprises look for ways to leverage the cloud, mobility, Big Data, and social media for competitive advantage, giving blanket refusals to IT experimentation and innovation is no longer an option.
Bring-your-own-device and “shadow IT” are now commonplace at many organizations. And the move to the cloud has become so popular that it’s now unimaginable that a security executive would be able to keep business users from accessing cloud-based applications and storage systems.
Not surprisingly, security practitioners have been struggling with this growing need to say yes to different projects. After all, their mission is to identify what they consider to be risks and protect the organization from being hurt by those threats. But saying yes is a requirement in today’s increasingly and connected digital world.
Rather than trying to swim against the current or blindly ignore the security risks these projects might present, CISOs and other technology professionals involved in security need to focus on learning about the business benefits of these initiatives and finding the tools that can help safeguard corporate data and systems in these new environments.
Concurrently, as part of this change in thinking, security executives need to be in on the discussions about the business goals of using technologies such as the cloud and mobile devices, so they can gain a better understanding of the value of these initiatives to the organization and how IT assets should be secured.
As security executives accept the consumerization of IT, they also need to switch from a “Plan A” to a “Plan B” security strategy. With Plan A, the thinking has been that the organization is not going to experience a breach and that technology such as next-generation firewalls and intrusion detection will prevent breaches from happening.
Most current security blueprints are based on Plan A, with a heavy emphasis on technologies that protect the perimeter and somehow stop attackers from getting where they shouldn’t be. This made some sense when all the data and users only existed behind the corporate firewall.
It’s becoming quite clear, however, that Plan A is not working as it should be. Consider the number of huge data breaches that have occurred over the last year or two, and you can see that cybercriminals are finding ways to defeat current security defenses.
In today’s security landscape, it makes more sense to move to a Plan B, where the focus is on protecting data. This can involve a number of different technologies that are available today and would be potentially important components of the strategy.
It’s also clear that data encryption should play a major role in any Plan B. Someone is going to get past the network perimeter defenses at some point, so organizations need to make sure that whoever gets in can’t use the data. Another way of looking at encryption in the context of Plan B is that it is the ultimate way to “unshare” data in shared environments.
Many organizations will likely struggle with moving from Plan A to Plan B, simply because the former has been in place for so long. People who work in security programs are accustomed to working with what they are comfortable with -- and this usually means firewalls and other legacy security technologies. But not a lot of staffers today are experts in encrypting an infrastructure. (Hint: if you want a secure career in security, you might want to get into encryption.)
In the final analysis, security executives need to evolve and say “yes” to more new IT initiatives. They can do so while feeling confident they are doing everything necessary to protect corporate information resources by taking a Plan B approach.
About the Author(s)
Chief Strategy Office, Gemalto, Identity & Data Protection
Tsion Gonen serves as Chief Strategy Officer for Gemalto's Identity and Data Protection Division. He is responsible for developing global business and product strategies, and identifying and capitalizing on emerging market trends within the information security market. Prior to assuming his role as Chief Strategy Officer, he oversaw Safenet's (acquired by Gemalto in 2014) Data Protection product portfolio strategy and execution. Gonen joined the company in April 2009 from Aladdin Knowledge Systems, where he led the company's global sales and marketing efforts. Prior to that role, he led Aladdin's Content Security business unit. He holds a bachelor's degree in Electrical Engineering from Tel Aviv
You May Also Like
Unbiased Testing. Unbeatable ResultsFeb 22, 2024
Unbiased Testing. Unbeatable ResultsFeb 22, 2024
Your Everywhere Security guide: Four steps to stop cyberattacksFeb 27, 2024
Your Everywhere Security Guide: 4 Steps to Stop CyberattacksFeb 27, 2024
API Security: Protecting Your Application's Attack SurfaceFeb 29, 2024
A screen displaying many different types of charts and graphs to show what data is being analyzed.Cybersecurity Analytics
Use the 2023 MITRE ATT&CK Evaluation Results for Turla to Inform EDR Buying Decisions
A Solution Guide to Operational Technology Cybersecurity
Zero Trust Access For Dummies, 2nd Fortinet Special Edition
Migrations Playbook for Saving Money with Snyk + AWS
Buyer's Guide: Choosing a True DevSecOps Solution for Your Apps on AWS