Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

3/8/2017
10:30 AM
Contributor, Dark Reading
Contributor, Dark Reading
Commentary
50%
50%

Trust, Cloud & the Quest for a Glass Wall around Security

In the next year, we're going to see a leap towards strategic, business-level objectives that can be resolved by simplifying infrastructure and granting greater visibility in real time.

With more businesses committed to the cloud, we all need to be asking questions about where our data is stored, how it’s accessed, how data is regulated as it crosses international borders, and how threats are detected, mitigated or (hopefully it doesn’t come to this) remediated.

Security is a business and needs to be treated like one. Instead of getting into the technical weeds and trying to solve security problems with tactics, businesses need a smart strategy. That starts with asking the right questions and up-leveling the conversation with the goal of getting to the heart of a problem to put an end to it.

As found in a recent study by Citrix and the Ponemon Institute:

  • 64% of respondents said they do not believe their organization can effectively reduce the inherent risk of unmanaged data.
  • 68% said their employee-owned devices might be allowing criminals access to corporate networks and data.
  • 60% said that they’re not effective in protecting sensitive apps and data at-rest, in-use and in-motion
  • Only 37% of respondents said their organization is highly effective in using access control and multi-factor authentication solutions to protect information on devices, servers or in the cloud.

All of these statistics show the same thing – businesses are still trying to solve security business challenges with tactics, instead of looking at the big picture. The industry itself needs to adopt a more proactive, preventative mindset, and build security into solution architectures. Only by doing that can businesses get back to the core of their business and let IT companies worry about IT.

Prevention Trumps Detection
As businesses get smarter about security, we’re going to see them taking a closer look at prevention technologies rather than detection. This will move the industry to a more strategic level, versus tactical problem-solving through traditional detection and analysis services that merely confirm that you have a problem. (Not helpful!) Organizations need to know where to find the solution and what they can do about the problem. These are the business-level questions that need to be addressed first.

In the next couple of years, we’re going to see more adoption of prevention technologies that incorporate machine learning and predictive analytics that identify normal versus abnormal behaviors. The process of behavior analytics will be automated to proactively identify anomalous behaviors, flag them, and require additional credentials to “pass go.” As more businesses adopt and become familiar with cloud security and emerging technology best practices, trust is going to become a measureable outcome.

Don’t Underestimate Trust
For the first time, we’re seeing that trust can be delivered across the hybrid infrastructure without ten layers of detection and "deterrents.” In the next year, we’re going to see a leap towards simplification of infrastructure, and removal of security technologies that aren’t adding value.

Going back to the Ponemon study, respondents said that the top two goals of a new security framework include a unified view of users across the enterprise (53%) and the ability to keep up with new or emerging attacks (48%). These are business-level strategic objectives that can be solved by simplifying infrastructure and creating more visibility.

This simplification is going to naturally lead to a more unified view across the enterprise. The goal is to give IT a glass wall where they can easily see what’s happening across the enterprise and address issues in real-time. The outcome of that will be a more strategic security organization that can stop threats before they become breaches.

Related Content:

 

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23381
PUBLISHED: 2021-04-18
This affects all versions of package killing. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23374
PUBLISHED: 2021-04-18
This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23375
PUBLISHED: 2021-04-18
This affects all versions of package psnode. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23376
PUBLISHED: 2021-04-18
This affects all versions of package ffmpegdotjs. If attacker-controlled user input is given to the trimvideo function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23377
PUBLISHED: 2021-04-18
This affects all versions of package onion-oled-js. If attacker-controlled user input is given to the scroll function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.