Global analyst firm Gartner has been running a summer season of industry and technology presentations in the UK throughout June which have attracted a lot of interest from industry professionals keen to better understand what is going on around them so as to be able to plan ahead.
At the Excel presentation on June 16, Earl Perkins, research vice president at Gartner told us that today’s security professionals battle threats from outside the organisation as well as those from their own employees and asked, ‘But what about threats that they already know exist?’
Gartner says the next few years will see a variety of attacks as well as progress in the technologies and processes that prevent them. Here are their Top Ten security predictions.
Prediction #1: Through 2020, 99% of vulnerabilities exploited will continue to be ones known by security and IT professionals for at least one year.
Recommended Action: Companies should focus on fixing the vulnerabilities they know exist. While these vulnerabilities are easy to ignore, they’re also easier and more inexpensive to fix than to mitigate.
Prediction #2: By 2020, a third of successful attacks experienced by enterprises will be on their shadow IT resources.
Recommended Action: Business units deal with the reality of the enterprise and will engage with any tool that helps them do the job. Companies should find a way to track shadow IT, and create a culture of acceptance and protection versus detection and punishment.
Prediction #3: By 2018, the need to prevent data breaches from public clouds will drive 20% of organisations to develop data security governance programs.
Recommended Action: Develop an enterprise-wide data security governance (DSG) program. Identify data security policy gaps, develop a roadmap to address the issues and seek cyberinsurance when appropriate.
Prediction #4: By 2020, 40% of enterprises engaged in DevOps will secure developed applications by adopting application security self-testing, self-diagnosing and self-protection technologies.
Recommended Action: Adopt Runtime application self-protection (RASP) for DevOps. Evaluate less mature vendors and providers for potential security options.
Prediction #5: By 2020, 80% of new deals for cloud-based Cloud Access Security Broker (CASB) will be packaged with network firewall, secure web gateway (SWG) and web application firewall (WAF) platforms.
Recommended Action: While concerns exist about customer migration to the cloud and bundling purchases, companies should assess the application deployment roadmap and decide whether investment is justified.
Prediction #6: By 2018, enterprises that leverage native mobile containment rather than third-party options will rise from 20% to 60%.
Recommended Action: Experiment and become familiar with native containment solutions. Keep in mind that enterprises with average security requirements should plan to move gradually to native containment.
Prediction #7: By 2019, 40% of Identity as a Service (IDaaS) implementations will replace on-premises Identity Access Management (IAM) implementations, up from 10% today.
Recommended Action: Enough limitations have disappeared on IDaaS that companies should start experimenting on small-scale projects. While a clash of regulations could derail the increased implementation, companies should work to recognise the current limitations and benefits.
Prediction #8: By 2019, use of passwords and tokens in medium-risk use cases will drop 55%, due to the introduction of recognition technologies.
Recommended Action: Passwords are too entrenched in business practices to disappear completely, but companies should look for products that focus on development of an environment of continuous trust with good user experience. Begin by identifying use cases, and press vendors for biometric and analytic capabilities.
Prediction #9: Through 2018, over 50% of IoT device manufacturers will not be able to address threats from weak authentication practices.
Recommended Action: By changing the enterprise architecture, IoT introduces new threats. Early IoT security failures might force the industry towards authentication standards, but companies should identify authentication risks, establish identity assurance requirements, and employ metrics.
Prediction #10: By 2020, more than 25% of identified enterprise attacks will involve IoT, though IoT will account for only 10% of IT security budgets.
Recommended Action: As IoT continues to grow, vendors will favour usability over security and IT security practitioners remain unsure of the correct amount of acceptable risk. Companies should assign business ownership of IoT security, focus on vulnerable or unpatchable IoT devices, and increase IoT-focused budget.
Ed Says… There is always more we can do to protect our assets and we would like to hear from readers about the voice and data security issues they face so that we can plan our coverage of the market for 2017.