Information security discussions have moved from wiring closets to corporate boardrooms. In early 2012, Bloomberg Government and the Ponemon Institute issued a study that showed 172 US-based organizations -- from multinational corporations to the federal government -- spend a combined $5.3 billion on cybersecurity.

These institutions estimated they will have to spend $46.6 billion to adequately address today's attacks -- from state-sponsored campaigns to rogue activism that threaten data and the nation's critical infrastructure. Our systems have become so tied to the Internet, this "grid" can be compromised with a single swipe. The threat is real, relevant, and happening right now.

It appears 2013 will be remembered as the year when the avalanche of data -- from social media and enterprise big data -- collided head on with our ability to maintain the security and privacy of that data. The data generated by individuals, corporations, and government organizations is exploding and can neither be contained nor controlled. Chief information security officers (CISOs) and IT professionals, as the stewards of that data, with conventional approaches are bringing a sword to a gunfight.

[ Here's how to make your network more bulletproof. Read Can Your Network Beat Malware? ]

The world has become fluid. There are few enforceable boundaries between the corporate and the personal, the local and the remote, the datacenter and the cloud. According to Cisco's Global Mobile Data Traffic Forecast, by the end of this year, "the number of mobile-connected devices will exceed the number of people on Earth." Data is being consumed and produced across billions of devices scattered across ad-hoc network connections and crossing boundaries without pause. There's no perimeter in the cloud and the tools we have no longer work.

As a venture capitalist actively investing in the security market, I see three critical issues and related opportunities for information security pros:

1. Walled gardens have become wild gardens
CISOs are losing the security arms race. Even highly secure organizations -- including the security companies themselves -- have been breached. The reason is simple: the security model traditionally applied no longer matches the real world. Systems fail because of an attempt to control and contain by drawing boundaries, while data, users, and devices are becoming dynamic and mobile. Data has become liquid. Location-centric, device-centric, port-centric tools are simply inadequate to the task.

Security architecture has to become both dynamic and adaptive. Security tools will become more automated, using machine learning and big data analytics to respond to attacks. This will be done in a more fluid manner, focused on the data and the applications themselves and less on the port and the device. CISOs need to re-architect their security paradigm and invest in data-centric approaches such as DNSSEC, AES encryption, and TLS/SSL, and assume their perimeter has been compromised.

2. BYOD = BLOT
Organizations tolerate a "bring your own device" policy, but it actually "brings lots of trouble." Intellectual property leaks are multiplying. The reason? Security is focused on the containers rather than the data itself. Mobile security is mostly about device management. Datacenters and operating systems protect their perimeter with network and file-access controls. This containment model is failing because the data is moving too fast between devices and users. Even the NSA fell victim with an internal, human-led compromise. Mobile device makers are rushing to add containment controls, such as fingerprint scanners, but there is still inadequate focus on the data itself.

1 of 2