Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

3/8/2017
10:30 AM
Stan Black
Stan Black
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Trust, Cloud & the Quest for a Glass Wall around Security

In the next year, we're going to see a leap towards strategic, business-level objectives that can be resolved by simplifying infrastructure and granting greater visibility in real time.

With more businesses committed to the cloud, we all need to be asking questions about where our data is stored, how it’s accessed, how data is regulated as it crosses international borders, and how threats are detected, mitigated or (hopefully it doesn’t come to this) remediated.

Security is a business and needs to be treated like one. Instead of getting into the technical weeds and trying to solve security problems with tactics, businesses need a smart strategy. That starts with asking the right questions and up-leveling the conversation with the goal of getting to the heart of a problem to put an end to it.

As found in a recent study by Citrix and the Ponemon Institute:

  • 64% of respondents said they do not believe their organization can effectively reduce the inherent risk of unmanaged data.
  • 68% said their employee-owned devices might be allowing criminals access to corporate networks and data.
  • 60% said that they’re not effective in protecting sensitive apps and data at-rest, in-use and in-motion
  • Only 37% of respondents said their organization is highly effective in using access control and multi-factor authentication solutions to protect information on devices, servers or in the cloud.

All of these statistics show the same thing – businesses are still trying to solve security business challenges with tactics, instead of looking at the big picture. The industry itself needs to adopt a more proactive, preventative mindset, and build security into solution architectures. Only by doing that can businesses get back to the core of their business and let IT companies worry about IT.

Prevention Trumps Detection
As businesses get smarter about security, we’re going to see them taking a closer look at prevention technologies rather than detection. This will move the industry to a more strategic level, versus tactical problem-solving through traditional detection and analysis services that merely confirm that you have a problem. (Not helpful!) Organizations need to know where to find the solution and what they can do about the problem. These are the business-level questions that need to be addressed first.

In the next couple of years, we’re going to see more adoption of prevention technologies that incorporate machine learning and predictive analytics that identify normal versus abnormal behaviors. The process of behavior analytics will be automated to proactively identify anomalous behaviors, flag them, and require additional credentials to “pass go.” As more businesses adopt and become familiar with cloud security and emerging technology best practices, trust is going to become a measureable outcome.

Don’t Underestimate Trust
For the first time, we’re seeing that trust can be delivered across the hybrid infrastructure without ten layers of detection and "deterrents.” In the next year, we’re going to see a leap towards simplification of infrastructure, and removal of security technologies that aren’t adding value.

Going back to the Ponemon study, respondents said that the top two goals of a new security framework include a unified view of users across the enterprise (53%) and the ability to keep up with new or emerging attacks (48%). These are business-level strategic objectives that can be solved by simplifying infrastructure and creating more visibility.

This simplification is going to naturally lead to a more unified view across the enterprise. The goal is to give IT a glass wall where they can easily see what’s happening across the enterprise and address issues in real-time. The outcome of that will be a more strategic security organization that can stop threats before they become breaches.

Related Content:

 

Stan Black, CISSP, is CSIO of Citrix where he is in charge of the secure delivery of applications and data to some of the world's largest organizations in healthcare, financial services, public sector, and manufacturing. Black defines a converged cyber security posture ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Cloud Security Threats for 2021
Or Azarzar, CTO & Co-Founder of Lightspin,  12/3/2020
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Assessing Cybersecurity Risk in Todays Enterprises
Assessing Cybersecurity Risk in Todays Enterprises
COVID-19 has created a new IT paradigm in the enterprise and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27772
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in coders/bmp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned int`. This would most likely lead to an impact to application availability, but could po...
CVE-2020-27773
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in MagickCore/gem-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned char` or division by zero. This would most likely lead to an impact to appli...
CVE-2020-28950
PUBLISHED: 2020-12-04
The installer of Kaspersky Anti-Ransomware Tool (KART) prior to KART 4.0 Patch C was vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges during installation process.
CVE-2020-27774
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of a too large shift for 64-bit type `ssize_t`. This would most likely lead to an impact to application availability, but co...
CVE-2020-27775
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned char. This would most likely lead to an impact to application availability, but c...