In his presentation ‘2014 Top 10 Technologies for Information Security‘ at the Gartner Security and Risk Management Summit, Neil MacDonald (Vice President, distinguished analyst and Gartner fellow emeritus) gave the coveted top spot to Cloud Access Security Brokers. Given that, I thought it would be useful to reflect on why I believe this particular emerging market segment trumped others with regard to being transformative and impactful.
When I talk to CIOs and CISOs, the topmost concern on their mind is the rapid proliferation of new technologies. Novel buzzwords continuously enter the IT lexicon: cloud, BYOD, Internet of Things, virtualisation, etc. Alongside each new technology trend, one has to determine the security implications of bringing it into the fold.
Based on those implications, organisations must determine whether they can manage the corresponding risks or whether they need to eschew the technology altogether. And among new technologies, nothing is garnering mind share like the cloud and, within that, how SaaS services can be adopted within enterprise settings. In fact, CIOs have been telling me that SaaS adoption is becoming a board-level discussion.
> See also: Keys to the castle: encryption in the cloud
We regularly see traditional (on-premises) enterprise applications being supplanted with their ‘cloudy’ analogues like Workday, Box, Google Drive, Office 365, Salesforce, and so on. The reasons aren’t too surprising: you can get up and running incredibly fast; customers are always getting the latest and greatest in terms of functionality; no infrastructure is needed; and consequently, capital expenditure is traded off for operational expenditure.
What might surprise you, however, is that we see this trend in companies of all sizes. If you had asked me just a year ago, I would have pegged SMBs and the mid-market as the fastest adopters of public cloud technologies. Instead, we are seeing a substantial number of very large enterprises accelerate SaaS adoption.
In some cases, these companies (should they have chosen to do so) literally have the means to run their own data centers more cost effectively than anyone else on the planet. If such sizeable enterprises are pivoting in this direction, it’s a sign that SaaS adoption is not just a niche eddy, but is a full blown current that cannot be resisted by any one entity.
SaaS applications are also ‘cloudy’ for other reasons. In particular, organisations lose visibility into how those applications are being used and so they are unable to exercise fine-grained control over those applications. Ultimately, security is predicated on visibility. You cannot protect if you cannot see; and only once you see it can you control it.
More so, organisations have to ensure that any security functionality protecting traditional enterprise applications (Firewalls / Next-Generation Firewalls, Intrusion Detection and Prevention Systems, Data Loss Prevention, Security Information and Event Management, etc.) must be complemented with analogous functionality for SaaS applications.
Fortunately, this problem space is relatively new and, as such, we have an opportunity to fundamentally rethink how to attack it. It’s clear that as with any enterprise security strategy, there will be four key elements based on Gartner’s Adaptive Security Architectures framework. First, organisations need to establish a baseline, via an audit, where they understand what risks they face.
Next, they need to put protection strategies in place to prevent threats from entering their environment in the first place. Of course, active threats will still present themselves. For that reason, capabilities to detect threats are needed. Even still, the reality today is that despite best intentions and best practices many threats will still get through. Consequently, tools for investigating and responding to threats are needed – for example, by having continuous monitoring that yields the ability to go back and understand incidents together with their ramifications.
As organisations maintain more information, there is a commensurate increase in the importance of cybersecurity. As a result, I know numerous CISOs today who present to their board of directors on a quarterly basis – something that was hitherto unprecedented.
With both SaaS and cybersecurity each becoming board-level issues, it’s no surprise that their confluence is a veritable perfect storm. As such, I hope that Garter’s reason for placing Cloud Access Security Brokers at the apex of this year’s list is no longer cloudy, but instead is crystal clear.
Sourced from Zulfikar Ramzan, CTO of Elastica
