Story image

Gartner - 6 security and risk management trends

04 Jul 18

Gartner has identified six key trends in cybersecurity that can guide IT leaders and security service providers as they approach business leaders during this time of increasing threat awareness.

1. Executive cybersecurity awareness

IT security is a board-level topic and an essential part of any solid digital business strategy.

Business leaders have not always been receptive to this message, but a recent string of high-profile incidents have changed sentiment.

Prominent examples include an Equifax data breach that cost the CEO, CIO and CSO their jobs; a WannaCry attack that caused worldwide damage estimated at between $1.5 to $4.0 billion; and Verizon's recent $350 million discount on its purchase of Yahoo! as a result of the latter's data breach.

"Business leaders and senior stakeholders at last appreciate security as much more than just tactical, technical stuff done by overly serious, unsmiling types in the company basement," says Gartner research vice president Peter Firstbrook.

2. Regulatory mandates on data protection

Customer data is the lifeblood of ever-expanding digital business services.

Incidents such as the recent Cambridge Analytica scandal or the Equifax breach illustrate the extreme business risks inherent to handling this data.

Moreover, the regulatory and legal environment is getting ever more complex, with Europe's GDPR the latest example.

At the same time, the potential penalties for failing to protect data properly have increased exponentially.

In the U.S., the number of organizations that suffered data breaches due to hacking increased from under 100 in 2008 to over 600 in 2016.

"In this new reality, full data management programs - not just compliance - are essential, as is fully understanding the potential liabilities involved in handling data," says Firstbrook.

3. Security product agility

New detections technologies, activities and authentication models require vast amounts of data that can quickly overwhelm current on-premises security solutions.

This is driving a rapid shift toward cloud-delivered security products.

These are more capable of using the data in near real time to provide more-agile and adaptive solutions.

"Avoid making outdated investment decisions," says Firstbrook.

"Seek out providers that propose cloud-first services, that have solid data management and machine learning (ML) competency, and that can protect your data at least as well as you can."

4. Machine learning integration

The shift to the cloud creates opportunities to exploit ML to solve multiple security issues, such as adaptive authentication, insider threats, malware and advanced attackers.

Gartner predicts that by 2025, ML will be a normal part of security solutions and will offset ever-increasing skills and staffing shortages - but not all ML is of equal value.

"Look at how ML can address narrow and well-defined problem sets, such as classifying executable files, and be careful not to be suckered by hype," says Firstbrook.

"Unless a vendor can explain in clear terms how its ML implementation enables its product to outperform competitors or previous approaches, it's very difficult to unpack marketing from good ML."

5. Geopolitical factors

Increased levels of cyber warfare, cyber political interference, and government demands for backdoor access to software and services have resulted in new geopolitical risks in software and infrastructure buying decisions.

Recent government bans against Russian and Chinese firms are obvious examples of this trend.

"It's vital to account for the geopolitical considerations of partners, suppliers and jurisdictions that are important to your organisation," says Firstbrook.

"Include supply chain source questions in RFIs, RFPs and contracts."

6. Decentralisation efforts

The internet is driving a wave of centralisation, one obvious example of which is cloud computing.

While there are many benefits, a good security team should be accounting for the risks too.

"Evaluate the security implications of centralisation on the availability, confidentiality and resiliency of digital business plans," says Firstbrook.

"Then, if the risks of centralisation could seriously threaten organisational goals, explore an alternative, decentralised architecture."

Is self-service BI living up to the hype?
the explosion of data available to a business and self-service BI tools is transforming how everyone works - but is self-service living up to expectations?
What the people say - Gartner’s November Customers’ Choices
A roundup of the latest Gartner Peer Insight Customers’ Choices from Backup and Recovery to Business Intelligence and Analytics, and more.
BlackBerry buys out cybersecurity AI firm Cylance
“We are eager to leverage BlackBerry’s mobility and security strengths to adapt our advanced AI technology to deliver a single platform.”
Five secrets – Workday’s 2019 winning formulas
We thoroughly investigate why business software vendor Workday believes 2019 will be their best year yet.
Exclusive: Strengths and limitations of the AWS/Cisco partnership
Iguazio CEO Yaron Haviv discusses whether the partnership really is a 'match made in heaven' and what it means for the industry.
Google Cloud CEO stepping down to welcome ex-Oracle exec
Google Cloud has grown significantly under Greene's tenure, but has involved tens of billions of dollars and little gains on AWS and Azure.
Talend and Databricks partner for scalable data solution
The strategic partnership combines unified analytics and data management in the cloud.
Video conferencing in dire need of simplification, study shows
A Forrester study shows that 84% of companies are using two or more cloud-based video conferencing apps.