The rapid adoption of cloud-based applications has left many organisations exposed in worrying ways because they are still relying on legacy security tools that focus on low-level analysis rather than considering security at an application level, a senior security specialist has warned.
The cloud "is now becoming part of the norm as to how we do business," Palo Alto Networks head of network security Samantha Madrid told CSO Australia during a recent Australian visit. Yet despite this normalisation, she said, many organisations were still failing to appreciate that the new environment required a new approach to security. Users and even many technologists had become "desensitised" to new security requirements and enabling tools – leaving them trying to fix 21st-century services with 20th-century tools.
"You have to think about the technology that you're using and whether it understands the way you communicate," Madrid explained. "The challenge with legacy technologies is that they communicate and make decisions first and foremost on protocol. But that's a cumbersome mindset because it's not how users communicate."
Users "email files, and upload files to cloud shares and enterprise applications," she explained. "If the backbone if your security cannot understand applications, and recognise users by name so you can enforce policy, then you're already a step behind."
Like its many change-minded security peers, Palo Alto Networks is working to bring old security models into the present day – which carries additional challenges in the form of bring your own device (BYOD) models where the preponderance of Web-connected applications makes protocol-based security even more complicated.
Application-level security models offer greater flexibility and the ability to enforce content-based policies – such as controls over the distribution of credit card numbers through online channels – which make them essential in closing the security and compliance gap the broad use of devices creates.
For Madrid, the appeal of BYOD and growing demand for attendant security flexibility have created something of a raison d'être for 2016 and beyond.
Noting market penetration of just around 10 percent,
"For us it is a mission," she said. "We want people to continue to have an environment where they feel comfortable with their devices, so that an organisation can truly embrace BYOD and not choose your own device policies. To do that, we have to think beyond just 'allow' and 'not allow'."
"Security is now part of the fabric where I think historically it hasn't been. And we are laser focused on continuing to innovate on this. For us, it is a mission."
Security ALERT!
Need help making the right choice for you business? Need to update your system but don't know where to start? CSO can help, check out our security hub today.
Gigamon Transform Security Zone