Secure Your Network From Modern Hazards

Information security discussions have moved from wiring closets to corporate boardrooms. In early 2012, Bloomberg Government and the Ponemon Institute issued a study that showed 172 US-based organizations -- from multinational corporations to the federal government -- spend a combined $5.3 billion on cybersecurity.

These institutions estimated they will have to spend $46.6 billion to adequately address today's attacks -- from state-sponsored campaigns to rogue activism that threaten data and the nation's critical infrastructure. Our systems have become so tied to the Internet, this "grid" can be compromised with a single swipe. The threat is real, relevant, and happening right now.

It appears 2013 will be remembered as the year when the avalanche of data -- from social media and enterprise big data -- collided head on with our ability to maintain the security and privacy of that data. The data generated by individuals, corporations, and government organizations is exploding and can neither be contained nor controlled. Chief information security officers (CISOs) and IT professionals, as the stewards of that data, with conventional approaches are bringing a sword to a gunfight.

[ Here's how to make your network more bulletproof. Read Can Your Network Beat Malware? ]

The world has become fluid. There are few enforceable boundaries between the corporate and the personal, the local and the remote, the datacenter and the cloud. According to Cisco's Global Mobile Data Traffic Forecast, by the end of this year, "the number of mobile-connected devices will exceed the number of people on Earth." Data is being consumed and produced across billions of devices scattered across ad-hoc network connections and crossing boundaries without pause. There's no perimeter in the cloud and the tools we have no longer work.

As a venture capitalist actively investing in the security market, I see three critical issues and related opportunities for information security pros:

1. Walled gardens have become wild gardens
CISOs are losing the security arms race. Even highly secure organizations -- including the security companies themselves -- have been breached. The reason is simple: the security model traditionally applied no longer matches the real world. Systems fail because of an attempt to control and contain by drawing boundaries, while data, users, and devices are becoming dynamic and mobile. Data has become liquid. Location-centric, device-centric, port-centric tools are simply inadequate to the task.

Security architecture has to become both dynamic and adaptive. Security tools will become more automated, using machine learning and big data analytics to respond to attacks. This will be done in a more fluid manner, focused on the data and the applications themselves and less on the port and the device. CISOs need to re-architect their security paradigm and invest in data-centric approaches such as DNSSEC, AES encryption, and TLS/SSL, and assume their perimeter has been compromised.

2. BYOD = BLOT
Organizations tolerate a "bring your own device" policy, but it actually "brings lots of trouble." Intellectual property leaks are multiplying. The reason? Security is focused on the containers rather than the data itself. Mobile security is mostly about device management. Datacenters and operating systems protect their perimeter with network and file-access controls. This containment model is failing because the data is moving too fast between devices and users. Even the NSA fell victim with an internal, human-led compromise. Mobile device makers are rushing to add containment controls, such as fingerprint scanners, but there is still inadequate focus on the data itself.

Rather than focusing on the containers, CISOs and IT pros must take a more data-centric approach with an emphasis on data encryption, both at rest and in transit. To achieve security in a world of mobile and dynamic data, encryption must be ubiquitous, automatic, and on by default. Ubiquitous encryption at scale is hard to do, but it can be done. And if done well, it can render data irrelevant if breached. One way to attain broad data encryption is to institute corporate-wide policies that say data can never be in the clear when it is in rest or in motion and to standardize on a commercial key management system.

Figure 1: Fingerprint scanners, like the one in Apple's iPhone 5s, do nothing to protect the data stored on a mobile device.

3. Third parties: The weakest link might not be yours
As data moves between devices and users and finally comes to rest, it might not end up on your own infrastructure. Rather, the data might end up in a cloud server or in an online backup service, file share, collaboration software, workgroup server, or partner database. Most likely it's in all of the above.

CISOs increasingly rely on partners for data processing and data storage, whether in the form of cloud providers or more traditional data processors and colocation facilities. Few companies operate without some footprint on Amazon's Cloud, Salesforce's CRM, or smaller SaaS players. Third parties represent a risk vector and companies must evaluate the risk of offloading data to a third party. There are new services available from vendors such as BitSight, Mandiant, and Terremark that offer independent metrics and scoring services for third-party risk.

You can prepare for the risks of moving data or processes to third parties by cataloguing all the third parties that store your data, requesting a security audit, and implementing encryption algorithms so that the data is not stored in the clear.

The information security market is in a perfect storm, but I see tremendous opportunity in this crisis. After all, every cloud has a silver lining.

Having a wealth of data is a good thing -- if you can make sense of it. Most companies are challenged with aggregating and analyzing the plethora of data being generated by their security applications and devices. The How Existing Security Data Can Help Identify Potential Attacks report recommends how to effectively leverage security data in order to make informed decisions and spot areas of vulnerability. (Free registration required.)