There was an interesting piece of research by TheInfoPro, part of 451 Research, published at the end of the year. It noted that 45% of respondents in North America and Europe said they had witnessed a significant uplift in security budgets between 2011 and 2012. That’s despite Deloitte saying that total IT spending in the same period was lacklustre.
TheInfoPro’s annual report is said to be based on extensive live interviews with security professionals and primary decision-makers at large and midsize enterprises in North America and Europe. It found that top projects looking to gain a share of increased budget allocations include mobile device management (MDM), endpoint and network data leakage prevention (DLP), and application-aware firewall implementations.
It suggested that the combined effects of IT Consumerisation and the ‘Bring Your Own Device’ trends have driven Mobile Device Security to take over the top slot as the key pain point for security managers in 2012, going from 11% of responses in 2011 to 15% in 2012. It also noted that application-aware firewalls continue to be one of the hottest technologies in the network security category – 8% of respondent implementation is planned for within six months, the researchers said, with another 14% having longer term plans pencilled in.
Driven by damaging headlines about customer data breaches, and the threat of higher fines by the likes of the UK’s Information Commissioner’s Office (ICO), Endpoint data loss prevention continues to be a top project, with 10% of respondents reporting short term implementation plans, the research found.
"47% of security managers we interviewed noted a planned budget increase between 2012 and 2013 with only 8% constricting their spending," said Daniel Kennedy, TheInfoPro’s Research Director for Information Security. "Securing employee owned mobile devices is the chief headache for security managers, and 2013 will be a key year for mobile device management implementations – 20% of enterprises report projects underway within the next six months, with another 9% planning implementations in the longer term."
Shifting borders
In fact it’s not just bring your own device that has made enterprise borders something of a shady area. The traditional demarcation between what was inside the corporate network, and where its boundary lay, has almost completely gone away. Remote and flexible working, the desire to bring partners and customers closer to the organisation, and yes, increased staff mobility, have all played their part. Cloud computing means that often some of the data storage and processing is many miles, even continents away from the corporate data centre.
Content from our partners
The Director of the IBM Institute for Advanced Security Europe, Martin Borrett, explains, "I think we must recognise that there has been a major shift in how organisations protect their data. Trends like cloud and social mean companies are now dealing with massive amounts of data. They’ve also move beyond a single, siloed perimeter to a multi-perimeter type of scenario. That has meant they need to move more intelligence closer to the endpoints and targets. In the world we live in now, you can’t rely on a single measure.
"It’s become much more about the data and the applications, and where you are working from," Borrett says. "Not long ago, a company was a group of people who worked in an office nine to five and then left. They accessed the business services they needed to do their job in the office. Now there has been a fundamental shift. Staff typically access business services on the move. There’s a very mobile workforce using very different devices, from tablets to smartphones. Organisations are looking to things like cloud as being more cost-effective and agile. These factors have dramatically changed the landscape in the last ten years and we expect to see more of that. In that environment the notion of a single, well-defined perimeter doesn’t work very well at all."
So what needs to be done? According to Borrett, organisations are having to focus more on the data, and that means a greater focus on the endpoints rather than the perimeter. "For example if people are using devices beyond the firewall are they patched correctly, are the right policies in place?" Borrett asks. "You can’t just rely on a firewall, you need to look across a number of layers."
The view was certainly borne out by TheInfoPro research, which found endpoint protection technologies high on respondents’ shopping lists. "Technology has had to evolve," Borrett says. "As the data volume, variety and velocity has changed technologies have had to adapt. In many ways it’s like a Big Data problem: the huge volumes [of data], the variety of structured and unstructured data that needs to be secured. One of the key questions is how you get security intelligence and visibility over key areas in your environment. Can you spot threats in a proactive way?"
Read the full Q&A with Martin Borrett, who goes on to look at some specific ways in which enterprises should be thinking about endpoint protection and the impact of BYOD, here.
