In this interview, Latha Maripuri, Director, IBM Security Services and Marc van Zadelhoff, Director of Strategy, IBM Security Solutions, discuss the increasingly complex information security landscape by addressing budget strategies, cloud computing security, mobile devices and more.

We live in complex times. The black hats have seemingly endless resources while the good guys have to get management approval for all their tools. What can a large organization do to stay on top of the fast-paced threat landscape while fighting on a limited budget?

The threat landscape is changing rapidly with new software vulnerabilities, malware, phishing methods and web-based attacks coming out daily. In addition, as the 2010 X-Force Trend & Risk Report points out, cyberattacks are getting more sophisticated, targeted, organized and harder to detect. Not to mention that as the planet becomes more interconnected, instrumented and intelligent, it is also creating emerging complexities and security risks that businesses must address.

Corporations should focus on running their businesses and use service providers for security expertise in order to mitigate their risk of being impacted. Sophisticated security analytics, such as leveraging IP reputation data, can help protect a company, but these skills are often not found in-house.


Organizations should consider a lifecycle based approach for security that ensures the environment is regularly assessed against current and relevant threats. This proven approach generally begins with assessment and flows into design, deployment, management, and continual education. The nature of the evolving threat requires this level of maturity; else the organization may deploy technology without a full understanding of the most critical needs.

Consideration should also be given to outsourcing and software as a service (SaaS) solutions. These service based offerings are generally geared towards reducing cost and complexity while improving the organization’s overall security capability. These solutions bring together the shared security expertise of certified resources around the world, and this can contribute to reducing the staffing requirements for in-house security teams.