In this interview, Latha Maripuri, Director, IBM Security Services and Marc van Zadelhoff, Director of Strategy, IBM Security Solutions, discuss the increasingly complex information security landscape by addressing budget strategies, cloud computing security, mobile devices and more.
We live in complex times. The black hats have seemingly endless resources while the good guys have to get management approval for all their tools. What can a large organization do to stay on top of the fast-paced threat landscape while fighting on a limited budget?
The threat landscape is changing rapidly with new software vulnerabilities, malware, phishing methods and web-based attacks coming out daily. In addition, as the 2010 X-Force Trend & Risk Report points out, cyberattacks are getting more sophisticated, targeted, organized and harder to detect. Not to mention that as the planet becomes more interconnected, instrumented and intelligent, it is also creating emerging complexities and security risks that businesses must address.
Corporations should focus on running their businesses and use service providers for security expertise in order to mitigate their risk of being impacted. Sophisticated security analytics, such as leveraging IP reputation data, can help protect a company, but these skills are often not found in-house.
Organizations should consider a lifecycle based approach for security that ensures the environment is regularly assessed against current and relevant threats. This proven approach generally begins with assessment and flows into design, deployment, management, and continual education. The nature of the evolving threat requires this level of maturity; else the organization may deploy technology without a full understanding of the most critical needs.
Consideration should also be given to outsourcing and software as a service (SaaS) solutions. These service based offerings are generally geared towards reducing cost and complexity while improving the organizationís overall security capability. These solutions bring together the shared security expertise of certified resources around the world, and this can contribute to reducing the staffing requirements for in-house security teams.
Despite significant technological innovations in the last decade, the overall security architecture is constantly growing to accommodate more software and hardware. The growing complexity of managing large deployments sometimes takes a toll on the patching procedures while keeping up with new attack vectors is a daunting task. Are we ever going to see a protection infrastructure that is much smaller and way more efficient than what we see deployed today?
For most companies, security has traditionally been an afterthought - a bolt on to infrastructures that are already built or applications which are already widely deployed. This often creates an extremely complex and costly environment to manage and maintain.
We are seeing more of a shift towards embedding security early in the development cycles. New applications should take into account secure engineering principles from the beginning. Also, as companies look at server consolidation, virtualization or cloud computing, they have an opportunity to incorporate security from the start and be more efficient.
As an example, we recently helped a large hotel chain meet a series of PCI requirements across their various properties by deploying cloud based services for security event and log management. This solution offered a short time to value, had virtually no overhead, and didnít require the costly purchase or implementation of an off the shelf security information and event management (SIEM) application.