The threats and challenges you face haven't changed much in the past year, but you're finding a better recipe for protecting your corporate data and networks, according to our eighth annual Global Information Security Survey.
It's an old problem in the security industry — vendors, public-relations firms and the media coin all these catch phrases and buzz words to describe the latest threat or technological solution. Then the smarter industry voices get all uptight about it.
IT security practitioners typically greet vendor-based studies with scepticism because they come off as a sales pitch for whatever products that vendor sells. People become especially leery when a study leads to the predicted death of a particular security tool. But when looked at cumulatively, such studies offer small snapshots of why companies are making certain security decisions.
The term Software as a Service (SaaS) has been around a long time. The term cloud is still relatively new for many. Putting them together has meant a world of hurt for many enterprises, especially when trying to integrate security into the mix.
We reached out to several IT security professionals in an effort to zero in on the true elements of an effective DLP programme. This article will focus specifically on five technological approaches that, when used together, offer a solid data defense.
1. Data discovery, classification and fingerprinting
A company can buy every top-of-the-line security product known to man, but it won't make a difference for data loss prevention (DLP) unless end users are educated on their own role. Technology is indeed critical to DLP, but security experts say user awareness is key to keeping sensitive data safe from online predators.
"DLP is a process first. The technology is simply an enabler for the automation of the process," said Rick Lawhorn, a Richmond, Virginia-based chief security officer. "The process needs to include education and awareness training and cover human resources, records management and compliance. The objective is to continuously train data owners and data custodians (the employees) on the company policies to reduce instances of non-compliance."
The information security market has seen a ton of consolidation in the last couple of years, which can be a nightmare for IT shops trying to keep track of who really owns the software they're using and whom to call when the tool needs servicing.
But there's another school of thought that such consolidation is actually making the security industry a less aggravating place. After all, the market has become saturated with so many vendors it can be difficult determining who sells what your enterprise truly needs to tackle a given malware or compliance issue.
Besides, most IT shops would rather see security baked into the larger IT infrastructure provided by the likes of Microsoft, Cisco and others than spend money on a growing array of bolt-on devices.
With that in mind, CSO online conducted an unscientific poll, asking security pros about five security mergers they would like to see. Respondents suggested the big IT providers like Microsoft, IBM and Cisco go in search of more security acquisitions to further integrate digital defenses into the pipeline. Others want to see bigger security vendors like Symantec and McAfee buy up smaller companies that have features they currently lack.
We narrowed it down to three top-five lists submitted by three security industry leaders: Lawrence Pingree, a San Francisco-based security pro with ties to McAfee, BuddyFetch and the Digital Forensics Association (DFA); Richard Stiennon, chief research analyst at IT-Harvest; and Mike Rothman, keeper of the Security Incite blog and senior vice president of strategy at elQnetworks.
Security practitioners used to be seen as propeller-hat wearing introverts hunched over computers in dark, cold basements for weeks on end, shunning daylight and anyone who tried to start a conversation with them. But times have changed.
In the past week I've read a lot of stories about President-Elect <a href="http://www.csoonline.com/article/464719/subject/Barack+Obama">Barack Obama</a> possibly having to relinquish his <a href="http://www.csoonline.com/article/450166">BlackBerry</a> come Jan. 20 for a variety of reasons that are just plain dumb.
At first, this was going to be a column about the PR machine's hyperbolic efforts to connect the state of IT and security with the current financial crisis. Indeed, some have shamelessly sent me story pitches that try to get some bang out of the Wall Street meltdown.