Investors, markets and analysts are signaling another round in increased security spending in the elusive quest for the security “easy button.” As cyber driven risk and impact to the bottom line grows, the once foreign information security terminology is now becoming a common vernacular amongst C-suite managers. Cybersecurity has arrived and its implications are an integral part of modern-day business decisions.
The impact and potential consequences that the cyber threat landscape poses to business is unlike any operational and strategic business challenge ever faced. Meeting this challenge requires more than just a plan, money and people. Industry and government have been traveling that path for over two decades and have yet to gain a sustainable advantage. There are two primary factors playing into this lack of sustained advantage. First, the cyber threat landscape is practically unbounded. Second, our prior approach to this mitigate and stand up to this practically unbounded threat has been to apply a point solutions, products or technology to every hole in the dike.
The good news, however faint, is that the winds of change are forming. Whether this observation is just optimism or a realization is yet to be determined. Is the evolution of security professionals and organizations driving self-actualization through the Maslow Hierarchy of Corporate Needs?
Organizations are more open to adopt new ways of thinking and have developed a maturity in which they are beginning to understand that change is required. Capital alone and more of the same is not the solution that will ultimately provide a varying degree of equality with the threat landscape and their capabilities. The elusive security “easy button” that industry has been driving vendors to deliver is finally being realized for what it is, a fantasy. Thus the opportunity to evolve the business of cyber operations is finally arriving and has the potential to alter the market going forward.
Every cyber operation is driven by market demand, and therefore the buyer is the only hope in changing an industry that is so focused in point product sales, market leadership and chasing the next threat to emerge. Behind every digital born threat is a human that makes this threat landscape a boundless game of chess. The playing field can expand and contract on a whim with new exploits derived for every new patch deployed and every software version released. Security has always been a system, but industry has only delivered pieces and the market has rewarded industry by investing in and procuring those pieces.
The opportunity in front of us is to get the individual cybersecurity pieces functioning in an orchestrated manner to enable the best logic-processing engine, the human factor, to be engaged and involved in a dynamic, interactive and informed defense. Of course security automation is important where it is best leveraged, but simply offering red, green and yellow alerts without context falls short. Context combining all facets of the business, a dynamically changing risk model, technology, information and interpretation of the threat into an effective and efficient business process is essential for determining and realizing value. It requires an evolution of how we’ve involved cybersecurity in the past and how we think about moving forward.
It’s a time for integration of disparate vendor technology and open interfaces for policy exchange, data enrichment and workflow enhancement. It can’t be just be standardizing information exchange, but how information, process and policy can dynamically alter the security infrastructure. For this to come to fruition vendors will need to be driven by the market, not just the threat landscape and market buyers will need to continue to educate their management and push for budget. Industry must strive for capabilities that make the overall security operation more effective and efficient, and most importantly as dynamic as the threat landscape.
This is a far cry from the next technology set that opposes the next threat. If there’s one thing that we’ve learned over the past decade, it’s that the humans behind the threat are creative, adaptive and more capable than any static defense to a single threat.
