Security to drop out of CIO spending top ten
Gartner performs Security 3.0 conjuring trick
Posted in Management, 18th September 2007 09:44 GMT
Watch Now : Virtual Machine Movement with Hyper-V
Security pros need to get more proactive about dealing with threats and adopt strategies to persuade their colleagues to take on security spending as part of their projects, according to analysts Gartner.
The changes in roles for security specialists come as the internet security market enters what Gartner described as the third major stage of its development.
Always a sector of the industry that relishes one-upmanship, the Web 2.0 phenomenon is accompanied by Security 3.0. The first stage of security, according to Gartner, belongs to the time of centralised planning and the mainframe. The widespread use of personal computers ushered in reactive security to deal with threats such as malicious computer hackers and worms (security 2.0). Security 3.0 is characterised by an era of more proactive security, according to John Pescatore, a VP and distinguished analyst at Gartner.
Security 3.0 involves an approach to risk management that applies security resources appropriately to meet business objectives. Instead of bolting security on as an afterthought, Security 3.0 integrates compliance, risk assessment and business continuity into every process and application.
For security managers the process involves persuading their counterparts in, for example, application development to include security functions in their projects. In this way security expenditure in real terms can go up even as security budgets (as such) stay flat or modestly increase. Security budgets freed from firefighting problems can then be invested with a view to managing future risks.
"Even a reduced security budget does not necessarily mean reducing security-related spending," Pescatore said. "Security professionals need to think in terms of changing who pays for security controls," so they can "move upstream" and spend their time and resources on more demanding projects, he added.
Gartner predicts that security spending will rise 9.3 per cent in 2007, but will drop out the first ten spending priorities for CIOs for the first time since the prolific internet worms of 2003. Malware threats these days have evolved into targeted attacks featuring malware payloads designed not to draw attention to themselves.
This "run silent, run deep" malware means that security is a less high-profile function than before, as improving business processes and reducing costs become the pre-eminent priorities for IT directors. "Saying security is a journey not a destination no longer works," said Pescatore. "New threats don't poke their heads up so playing 'whack a mole' is no longer viable. Security is now more like playing a game of chess where the bad guys go first, so the black hats are playing with the white pieces.
"As in chess, there are strategies to deal with this," Pescatore explained. "Enterprise need to think in terms of reducing the attack aperture and funnelling attackers towards a strong point." ®
Watch Now : Virtual Machine Movement with Hyper-V
COMMENTS
Secure the information
Good article, high;ighted the required move away from tactical security implementations towards a more strategic view.
For a while now I have been talking to business about securing the information in a structure was and as part of the project the will create/use that information. This is a fundimental shift from the traditional security model of securing the network. This is still required, however business need to understand that the target of attack is the data/information, not the network.
Security 3.0 should be a natural step forward for most organisations as increased controls from SOX, PCI etc impact on how projects are delivered.
spot on
Very well put, companies should focus on designing secure systems not systems with security. There should be provision for making security decisions based upon business value that is unique to the organisation in the same way that web 2.0 ajax technology delivers a web experience that is unique to the user.
The threats we face are no less than before but as sais malware these days is much more 'run silent run deep' than ever before - there will be no more major worms to make the press but the bad guys will make increasinngly more money, this is a paradox that compounds the problem of getting funding for security ... less perceived threat but more actual threat....so you build secure systems with system funding rather than go for unique budget for security. A good example of this is the drive for PCI compliance - the card payment guys are forcing traders to build secure systems with no sensitive information in the clear so it just gets done that way.
There is a company who is at the forefront of helping organisations understand how to deal with security www.securitymob.com (disclaimer i'm not an employee)
Top 10 SIEM implementer’s checklist
The new Office Garage series:
IT infrastructure monitoring strategies
