Reinvent your security approach
Posted on 17 December 2012.
Tasked with ensuring the success of business-changing IT initiatives from mobile and BYOD to virtualization and cloud services, IT security is finding that existing security controls and processes create complexity instead of reducing risks.

At the same time, highly publicized breaches and new forms of attacks have raised awareness of the business impact of cyber threats to the board level. It’s time to reinvent your security approach – here are 2013 predictions from Gidi Cohen, CEO of Skybox Security:

1. Next-generation vulnerability management – Today, vulnerability management is one of the security processes that organisations use to find and mitigate risks; yet, vulnerability scanning can disrupt network operations, and delivers huge numbers of found vulnerabilities without the context needed to focus mitigation activities on real priority risks.

In 2013, organisations will seek out ways to correlate contextual information about network access paths and existing security controls into a next-generation vulnerability management solution that will deliver the actionable vulnerability remediation options every day that are needed to effectively prevent data breaches and cyber attacks.

2. Continuous security monitoring – The highly dynamic threat landscape requires enterprises to adopt continuous monitoring of their security risk posture rather than performing periodic security assessments. While we are already seeing this trend in vulnerability management (above), it also applies to areas such as firewall compliance, network access, and end point controls.

The transition to continuous security monitoring enables the IT security organisation to move from reaction to threat prevention. A high degree of automation is required, leading organisations to seek out risk management tools that can keep pace with continuous changes on a daily basis without taxing the resources of the security teams.

3. IPS emerges as key component of risk migration strategy – After 10 years of rapid sales but slow adoption, intrusion prevention systems (IPS) will play a key role in enterprise risk mitigation strategy in 2013.

Whilst many organisations currently use vendor-recommended IPS settings, selectively tuning the IPS based on your specific network vulnerabilities bridges the security gap and enables organisations to reap greater benefits from next-generation firewall deployments.

4. Big data for security – We see a dramatic expansion of the attack surface, fueled by the growth in mobile and other endpoint devices. Security organisations are recognizing the need to take a big data approach to security assessment – collecting huge amounts of data, and applying new predictive analysis tools to identify risks and breach traces in real time. In 2013 and later years, this approach will become more methodological.

Specifically, we anticipate collection and correlation of network topology data, firewalls capabilities, vulnerabilities, asset information, business context, and new threats. This contextual analysis will enable security analysts to focus on the high risk attack scenarios in a faster and more methodological way.

5. Emergence of the CIRO – The Chief Information Risk Officer will be the next evolution of the CISO, who can communicate to the board in the risk language they understand, rather than security jargon. CIROs will be looking to security to reduce risk whilst enabling the organisation to achieve their strategy / objectives.





Spotlight

New Zeus variant targets users of 150 banks

Posted on 19 December 2014.  |  A new variant of the infamous Zeus banking and information-stealing Trojan has been created to target the users of over 150 different banks and 20 payment systems in 15 countries, including the UK, the US, Russia, Spain and Japan.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  
DON'T
MISS

Mon, Dec 22nd
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //