Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

3/8/2017
10:30 AM
Stan Black
Stan Black
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Trust, Cloud & the Quest for a Glass Wall around Security

In the next year, we're going to see a leap towards strategic, business-level objectives that can be resolved by simplifying infrastructure and granting greater visibility in real time.

With more businesses committed to the cloud, we all need to be asking questions about where our data is stored, how it’s accessed, how data is regulated as it crosses international borders, and how threats are detected, mitigated or (hopefully it doesn’t come to this) remediated.

Security is a business and needs to be treated like one. Instead of getting into the technical weeds and trying to solve security problems with tactics, businesses need a smart strategy. That starts with asking the right questions and up-leveling the conversation with the goal of getting to the heart of a problem to put an end to it.

As found in a recent study by Citrix and the Ponemon Institute:

  • 64% of respondents said they do not believe their organization can effectively reduce the inherent risk of unmanaged data.
  • 68% said their employee-owned devices might be allowing criminals access to corporate networks and data.
  • 60% said that they’re not effective in protecting sensitive apps and data at-rest, in-use and in-motion
  • Only 37% of respondents said their organization is highly effective in using access control and multi-factor authentication solutions to protect information on devices, servers or in the cloud.

All of these statistics show the same thing – businesses are still trying to solve security business challenges with tactics, instead of looking at the big picture. The industry itself needs to adopt a more proactive, preventative mindset, and build security into solution architectures. Only by doing that can businesses get back to the core of their business and let IT companies worry about IT.

Prevention Trumps Detection
As businesses get smarter about security, we’re going to see them taking a closer look at prevention technologies rather than detection. This will move the industry to a more strategic level, versus tactical problem-solving through traditional detection and analysis services that merely confirm that you have a problem. (Not helpful!) Organizations need to know where to find the solution and what they can do about the problem. These are the business-level questions that need to be addressed first.

In the next couple of years, we’re going to see more adoption of prevention technologies that incorporate machine learning and predictive analytics that identify normal versus abnormal behaviors. The process of behavior analytics will be automated to proactively identify anomalous behaviors, flag them, and require additional credentials to “pass go.” As more businesses adopt and become familiar with cloud security and emerging technology best practices, trust is going to become a measureable outcome.

Don’t Underestimate Trust
For the first time, we’re seeing that trust can be delivered across the hybrid infrastructure without ten layers of detection and "deterrents.” In the next year, we’re going to see a leap towards simplification of infrastructure, and removal of security technologies that aren’t adding value.

Going back to the Ponemon study, respondents said that the top two goals of a new security framework include a unified view of users across the enterprise (53%) and the ability to keep up with new or emerging attacks (48%). These are business-level strategic objectives that can be solved by simplifying infrastructure and creating more visibility.

This simplification is going to naturally lead to a more unified view across the enterprise. The goal is to give IT a glass wall where they can easily see what’s happening across the enterprise and address issues in real-time. The outcome of that will be a more strategic security organization that can stop threats before they become breaches.

Related Content:

 

Stan Black, CISSP, is CSIO of Citrix where he is in charge of the secure delivery of applications and data to some of the world's largest organizations in healthcare, financial services, public sector, and manufacturing. Black defines a converged cyber security posture ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
4 Security Tips as the July 15 Tax-Day Extension Draws Near
Shane Buckley, President & Chief Operating Officer, Gigamon,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...