Gartner’s top ten strategies for security professionals
Today’s security professionals battle threats from outside the organisations well as those from their own employees. But what about threats that they already know exist? The next few years will see a variety of attacks as well as progress in the technologies and processes that prevent them. The top strategic planning assumptions for security in the next two to four years.
- Through 2020, 99% of vulnerabilities exploited will continue to be ones known by security and IT professionals for at least one year.
Companies should focus on fixing the vulnerabilities they know exist. While these vulnerabilities are easy to ignore, they are also easier and more inexpensive to fix than to mitigate.
- By 2020, a third of successful attacks experienced by enterprises will be on their shadow IT resources.
Business units deal with the reality of the enterprise and will engage with any tool that helps them do the job. Companies should find a way to track shadow IT, and create a culture of acceptance and protection versus detection and punishment.
- By 2018, the need to prevent data breaches from public clouds will drive 20% of organisations to develop data security governance programmes.
Develop an enterprise-wide data security governance programme. Identify data security policy gaps, develop a roadmap to address the issues and seek cyber insurance when appropriate.
- By 2020, 40% of enterprises engaged in DevOps will secure developed applications by adopting application security self-testing, self-diagnosing and self-protection technologies.
Adopt Runtime application self protection for DevOps. Evaluate less mature vendors and providers for potential security options.
- By 2020, 80% of new deals for cloud-based CASB will be packaged with network firewall, secure web gateway and web application firewall platforms.
While concerns exist about customer migration to the cloud and bundling purchases, companies should assess the application deployment roadmap and decide whether investment is justified.
- By 2018, enterprises that leverage native mobile containment rather than third-party options will rise from 20% to 60%.
Experiment and become familiar with native containment solutions. Keep in mind that enterprises with average security requirements should plan to move gradually to native containment.
- By 2019, 40% of Identity as a service IDaaS implementations will replace on-premises IAM implementations, up from 10% today.
Enough limitations have disappeared on IDaas that companies should start experimenting on small-scale projects. While a clash of regulations could derail the increased implementation, companies should work to recognise the current limitations and benefits.
- By 2019, use of passwords and tokens in medium-risk use cases will drop 55%, due to the introduction of recognition technologies.
Passwords are too entrenched in business practices to disappear completely, but companies should look for products that focus on development of an environment of continuous trust with good user experience. Begin by identifying use cases, and press vendors for biometric and analytic capabilities.
- Through 2018, over 50% of IoT device manufacturers will not be able to address threats from weak authentication practices.
By changing the enterprise architecture, IoT introduces new threats. Early IoT security failures might force the industry towards authentication standards, but companies should identify authentication risks, establish identity assurance requirements, and employ metrics.
- By 2020, more than 25% of identified enterprise attacks will involve IoT, though IoT will account for only 10% of IT security budgets.
As IoT continues to grow, vendors will favour usability over security and IT security practitioners remain unsure of the correct amount of acceptable risk. Companies should assign business ownership of IoT security, focus on vulnerable or unpatchable IoT devices, and increase IoT-focused budget.
Earl Perkins, Research Vice President at Gartner.