Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

8/9/2018
10:30 AM
Paul Stokes
Paul Stokes
Commentary
50%
50%

Oh, No, Not Another Security Product

Let's face it: There are too many proprietary software options. Addressing the problem will require a radical shift in focus.

Organizations and businesses of all types have poured money into cybersecurity following high-profile breaches in recent years. The cybercrime industry could be worth $6 trillion by 2022, according to some estimates, and investors think that there's money to be made. But like generals fighting their last battle, many investors are funding increasingly complex point solutions while buyers cry out for greater simplicity and flexibility.

Addressing this problem requires a radical shift in focus rather than a change of course. Vendors and investors need to look beyond money and consider the needs of end users.

More Money, More Problems
London's recent Infosecurity conference included more than 400 vendors exhibiting, while RSA in San Francisco boasted more than 600. And this only includes those with the marketing budgets and inclination to exhibit. One advisory firm claims to track 2,500 security startups, double the number of just a few years ago. Cheap money has created a raft of companies with little chance of IPO or acquisition, along with an even greater number of headaches for CISOs trying to make sense of everything.

The market is creaking from this trend, with Reuters reporting mergers and acquisitions down 30% in 2017, even as venture capital investment increased by 14%. But the real pain is being felt by CISOs trying to integrate upward of 80 security solutions in their cyber defenses, as well as overworked analysts struggling to keep up. The influx of cash also has caused marketing budgets to spike, leading to a market in which it is deemed acceptable for increasingly esoteric products to be promoted to CISOs as curing everything.

All of this feeds into a sense of "product fatigue" where buyers are frightened into paying for the latest black box solution, only to see their blood pressure spike when they find that they don't have the necessary resources to deploy or support these tools. This situation does not benefit any of the parties — the overwhelmed CISO, the overly optimistic investors, or the increasingly desperate vendors caught in limbo between funding rounds when their concepts weren't fully baked to begin with.

Addressing complex modern threats calls for sophisticated tools and products, but we cannot fight complexity with complexity. Security operations center teams cannot dedicate finite analyst capacity to an ever-expanding battery of tools. Fragmentation within the security suite weakens company defenses and the industry as a whole, and the drain on analysts' time detracts from crucial areas such as basic resilience and security hygiene.

Platforms, Not Products
The industry doesn't need more products, companies, or marketing hype. We need an overhaul of the whole approach to security solutions, not an improvement of components. Security should be built on platforms with a plug-and-play infrastructure that better supports buyers, connecting products in a way that isn't currently possible.

Such platforms should be flexible and adaptable, rewarding vendor interoperability while punishing niche solutions that cannot be easily adopted. This would lead to collaboration within the industry and create a focus on results for end users, rather than increasingly blinkered product road maps. Such platforms could act as a magnifying glass for innovation, providing a sandbox to benchmark new technologies and creating de facto security standards in the process.

This move from proprietary architecture to open modular architecture is a hallmark of Clayton Christensen's disruptive innovation theory, and it is long overdue within the security industry. Buyers will have greater control of their tech stacks, while vendors and investors will get to proof-of-concept faster, and see greater efficiency within the market.

One example of such a platform is Apache Metron, an open source security platform that emerged from Cisco. Metron has been adopted by a number of major security providers and provides a glimpse of what the future of security should look like.

Collaborating, creating industry standards, or making technologies open source does not mean that vendors can't make money; in fact, the reverse is true. Customers will be more willing to invest in security solutions that they know are future-proofed, that don't come with the dreaded "vendor lock-in," and that simplify rather than further complicate their architecture. 

Like all of security, there are varying degrees of risk and reward, but this approach is starting to look like the only logical future in an increasingly frothy, confusing, and low return-on-investment field. There will be a correction in the security market, whether it is in a month or a year. The fundamentals that will cause this are already evident, so there is an excellent opportunity to learn the lessons in advance and minimize the pain by contributing toward the platforms of the future.

Related Content:

Learn from the industry's most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Click for more info

Paul Stokes has spent the last decade launching, growing, and successfully exiting security and analytics technology companies. He was the co-founder and CEO of Cognevo, a market-leading security analytics software business that was acquired by Telstra Corporation. Prior to ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
njtrout
50%
50%
njtrout,
User Rank: Apprentice
8/9/2018 | 12:12:53 PM
Couldn't agree more
Couldn't agree more, However, 30+ years of product development in the security industry has led to this problem.  How do you undo 30+ years of proprietary code.  For instance, anti-virus vendors have never agreed upon a standard format for log files.  It's been a long and vocal battle.  one which mught never come to agreement.  Issues like this have pushed copmpanies to develop SIEM products to integrate all the output from security programs.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/27/2020
6 Ways Passwords Fail Basic Security Tests
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/28/2020
'Act of War' Clause Could Nix Cyber Insurance Payouts
Robert Lemos, Contributing Writer,  10/29/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How to Measure and Reduce Cybersecurity Risk in Your Organization
In this Tech Digest, we examine the difficult practice of measuring cyber-risk that has long been an elusive target for enterprises. Download it today!
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7759
PUBLISHED: 2020-10-30
The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController. This can be exploited by sending a specifically-crafted input in the relationIds parameter as demonstrated by the following request: http://v...
CVE-2020-7760
PUBLISHED: 2020-10-30
This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vu...
CVE-2020-27014
PUBLISHED: 2020-10-30
Trend Micro Antivirus for Mac 2020 (Consumer) contains a race condition vulnerability in the Web Threat Protection Blocklist component, that if exploited, could allow an attacker to case a kernel panic or crash. An attacker must first obtain the ability to execute high-privileged code on the targ...
CVE-2020-27015
PUBLISHED: 2020-10-30
Trend Micro Antivirus for Mac 2020 (Consumer) contains an Error Message Information Disclosure vulnerability that if exploited, could allow kernel pointers and debug messages to leak to userland. An attacker must first obtain the ability to execute high-privi...
CVE-2020-27885
PUBLISHED: 2020-10-29
Cross-Site Scripting (XSS) vulnerability on WSO2 API Manager 3.1.0. By exploiting a Cross-site scripting vulnerability the attacker can hijack a logged-in user’s session by stealing cookies which means that a malicious hacker can change the logged-in user’s pass...