Information security is one of the biggest challenges facing enterprises this year. Being hacked by criminals is becoming depressingly familiar for a many businesses. A roll call of prominent brands has succumbed to what is an unprecedented number of attacks. Increasing threats, regulations and complexity have catapulted network security up the corporate agenda. Considering billions are being spent on cyber security each year, why are businesses continuing to fall victim to cyber attacks?
The changing dynamics of the workplace have led to increasing complexity of enterprise security. Employees bringing their own devices to work, escalating the growth of data and need for corresponding protection. The proliferation of new cyber threats, daily, and the sheer number of security solutions available make a chief information security officer’s job a formidable challenge. These are issues that need to be examined in greater detail.
Employees and BYOD
The consumerisation of technology has been one the biggest trends in recent years—one that shows no sign of abating. Consumerisation has brought a whole new range of devices into the workplace, often as part of a sanctioned Bring Your Own Device (BYOD) program. These additional devices can create security and management headaches for enterprises as they struggle to deal with the implications of securing corporate data. Employees using their own devices also create numerous additional access points to the network—leading to many more opportunities for cyber criminals to attack the enterprise network, as well as leading to greater potential for data leakage.
Data growth is rocketing
Exacerbating the impact is the explosion in data. Over the last five years, data on the internet has increased five-fold, to almost 2 zettabytes (billion terabytes) and this trend is likely to continue on an exponential scale in the foreseeable future. Video is one of the main culprits—in January 2012, YouTube reported that 60 hours of video were being uploaded every minute to the site, equating to over 300,000 full-length feature films each week.
Aside from video, amidst this avalanche of data there is important confidential information such as legal documents, state secrets, company IP and healthcare data. The challenge for businesses is to identify what they are actually responsible for in this growing mass of information.
Compliance demands protection
Companies need to identify and protect confidential information—and not just to protect their own assets. An increasing raft of international regulations and legislation are demanding that enterprises show due care and diligence in protecting confidential information. This is an area that Australia is yet to cover in depth, but with the advent of more and more sensitive information going online—for example, healthcare—this will need to be addressed.
New threats daily
There are currently over 45 million different viruses in circulation, with over 2000 new ones appearing each day. The steady increase in threats, coupled with manyfold new vulnerabilities created by employees using their own devices for work purposes, means it is nearly inevitable that an enterprise’s defences will be overcome at some point. Businesses need to develop new methods and systems for protecting critical company information and sensitive customer data.
Solution overload, outsourcing and increasing cost pressures
The combination of rising threats in security, changing employee behaviour and increased regulation has led to myriad solutions being made available by vendors. The sheer scale and complexity on offer can make it confusing for businesses to know what to choose for optimum protection.
There is also an increasing disconnect between the budget available for security and the wide-ranging nature of the chief information security officer’s area of responsibility. Previously, security was only about being able to connect the network securely and safely. Now a CISO needs to be a business leader while also managing security policy, compliance, access and application security. Finding the right staff is also crucial, and the higher demand for IT specialists has created a skills shortage which is, in turn, driving the uptake of outsourced security services.
Businesses are looking to outsource their security needs to third party suppliers to utilise their specialist capabilities and knowledge which the business may lack internally. Managed security, from specialists, can better handle the complexities posed by increasing threats, regulation and costs, and can free up internal resources. It can also help simplify the business’s security controls, audit and reports—something that is vital for efficient compliance.
By taking complexity out of the equation, a business will be able to focus on developing its responses to security incidents, ensuring that its reputation does not suffer while also establishing itself as a leader in doing business securely. As we rapidly move into a mobile age, it is vital for business to adapt and grow with the times, or risk becoming a risk itself.
Gordon Makryllos is the Managing Director of Orange Business Services, Australasia