FINAL WORD
A change in philosophy is also as
much about culture and collaboration
as it is about technology.
I
t’s not surprising that there’s a security
headache on the horizon, but this
time of our own making. Just the
management of all these new solutions
is a huge challenge.
Here are six ways that can help partners
turn their conversations with customers
from spending even more on security point
solutions, to adopting a new security strategy
for their operations, their mobile workforces,
their apps and their brand reputation. for example, signals a shift in the industry
away from pure perimeter defence to
looking at the ‘bigger picture’ for enterprise
IT security.
A change in philosophy is also as much
about culture and collaboration as it is about
technology and requires the breaking down
of traditional silos of IT, security and other
functions within the organisation.
Change the conversation from
perimeter defence to how fast
they can react A key problem is that the industry is
heavily focused on chasing threats, which
are largely unknown in nature – this is
putting more emphasis on the attacker than
on the defender. But given the size and
complexity of the threat landscape, this is
an overwhelming task. We only know what
is bad once we’ve found it – in practice, the
sheer number of threats means that we
don’t, indeed can’t know what bad looks like
before we’ve found it. Continuing to chase
after bad is destined for failure. Even worse,
the industry continues to invest the bulk of
security R&D, time and innovation on the
sort of reactive, ‘search for bad’ solutions
that we know are becoming less and less
effective over time.
Being hyper-focused on reactively
chasing threats means many organisations
are increasingly underinvested in preventive
security solutions – solutions that can shrink
the attack surface and don’t solely rely on
having to react to threats that are identified
as ‘bad’. Knowing what ‘good’ looks like and
being able to detect deviations from it – a
thing every IT or security expert will fully
understand – is much more effective. No
The existing 30-year-old model for IT security
– secure the network perimeter with an
ever-higher and thicker firewall, then plug any
holes that appear due to new technologies
(such as mobility, cloud, new devices and
apps, SaaS, etc) with point solutions – just
doesn’t work in today’s businesses.
In the modern world, traditional security
is either ineffective, or too complex, or
too expensive, or too difficult to manage,
and usually all of these together. Why?
Because the attack surface being exploited
by malware has dramatically increased. We
need a new approach.
With the sheer volume of threats out
there, security breaches are inevitable –
what matters today is not spending all
your budget on trying to prevent them,
but instead, how fast can you detect them
and how quickly and effectively you can
mitigate their effect. Organisations need
to move beyond pure endpoint detection
and response, to a more holistic approach.
VMware’s recent acquisition of Carbon Black,
INTELLIGENT TECH CHANNELS
INTELLIGENT
TECH CHANNELS
Issue 26
Ensure customers can plan for
the unknown
one knows your apps, data, devices and user
environment better than you – after all, you
probably wrote and provisioned them in the
first place.
It’s one reason organisations have to
plan their IT security to accommodate the
great unknown. They will not survive by
reacting to a threat as it is defined today –
the landscape is evolving too quickly. Any
strategy that is reliant on knowing what the
threat upfront is, is already behind the curve.
Work with businesses to adopt an
inside-out approach
Modern business is reliant on collaboration
and connectivity. Security has to reflect
this and needs to be designed from the
inside out: inside the application, inside the
network and at the user and content level.
The traditional response to any security
crisis is to spend more money on even more
tactical point solutions. But with more than a
third of organisations admitting to having 26
or more security solutions installed already
(with some actually having more than 200),
the response is becoming a problem in itself
– one of management, skills and integration.
To add insult to injury, they are becoming
less and less effective – breaches continue
to threaten even the largest and well-known
companies and it needs a new approach.
Use software to make the
network and infrastructure
intrinsically secure
But how do you make the network and
infrastructure intrinsically secure? Given the
complexities involved, the only answer is
through software.
65