If it makes you feel any better, organizations spent more than $12 billion on firewall, intrusion prevention, endpoint protection and secure Web gateway products last year. That’s just a drop in the tens of billions of dollars enterprises spent overall in the past 12 months to protect their digital assets.
Alas, it’s not nearly enough–as recent data breaches at Target and Neiman Marcus have illustrated.
And the best (that is, worst) is yet to come.
“I really think we are looking at some new aspects” in malware and enterprise vulnerabilities, said Gartner Research Director Eric Ahlm at a McAfee data protection webinar held in mid-January. “There is a change in the threat landscape.”
Among the changes: User-based attacks are becoming easier and targeted attacks have become much more intelligent.
“Being able to prevent is much more of a challenge,” Ahlm said.
At the same time, hackers have a well-oiled ecosystem, whether they are organized state agents or solitary data thieves who can easily tap into a willing market in which to sell their stolen information.
But wait. There’s more: The continued growth of mobile devices is bringing with it some especially sobering security trends, according to Gartner, including the following:
–By 2018, 25% of corporate data (compared with 4% today) will bypass perimeter security and flow directly from mobile devices to the cloud.
–Through 2017, 75% of mobile security breaches will be a result of mobile application misconfigurations.
“If we’ve lost our control plane and lost our visibility plane, it’s going to make [asset protection] much more challenging,” Ahlm said.
That said, not all is gloom and doom. Adaptive, rather than preventive, security will become an important weapon in enterprise security arsenals.
“We need to be able to find compromised systems and know what methods we have to find these systems,” Ahlm said, adding that a security strategy anchored by situational and contextual awareness platforms will be critical.
“Security teams need to hunt and they need to look. Knowing what’s involved and what’s in play will be vital in building programs that succeed.”
–Use network analysis in conjunction with global threat intelligence feeds to determine if a system is under a hacker’s control.
–Correlate internal information such as network logs, network behaviors, host behaviors and user importance. That situational awareness can help organizations prioritize and triage in the wake of a data breach, Ahlm said.