Today’s security professionals battle threats from outside the organisations well as those from their own employees. But what about threats that they already know exist? The next few years will see a variety of attacks as well as progress in the technologies and processes that prevent them. The top strategic planning assumptions for security in the next two to four years.
- Through 2020, 99% of vulnerabilities exploited will continue to be ones known by security and IT professionals for at least one year.
Recommended action
Companies should focus on fixing the vulnerabilities they know exist. While these vulnerabilities are easy to ignore, they are also easier and more inexpensive to fix than to mitigate.
- By 2020, a third of successful attacks experienced by enterprises will be on their shadow IT resources.
Recommended action
Business units deal with the reality of the enterprise and will engage with any tool that helps them do the job. Companies should find a way to track shadow IT, and create a culture of acceptance and protection versus detection and punishment.
- By 2018, the need to prevent data breaches from public clouds will drive 20% of organisations to develop data security governance programmes.
Recommended action
Develop an enterprise-wide data security governance programme. Identify data security policy gaps, develop a roadmap to address the issues and seek cyber insurance when appropriate.
- By 2020, 40% of enterprises engaged in DevOps will secure developed applications by adopting application security self-testing, self-diagnosing and self-protection technologies.
Recommended action
Adopt Runtime application self protection for DevOps. Evaluate less mature vendors and providers for potential security options.
- By 2020, 80% of new deals for cloud-based CASB will be packaged with network firewall, secure web gateway and web application firewall platforms.
Recommended action
While concerns exist about customer migration to the cloud and bundling purchases, companies should assess the application deployment roadmap and decide whether investment is justified.
- By 2018, enterprises that leverage native mobile containment rather than third-party options will rise from 20% to 60%.
Recommended action
Experiment and become familiar with native containment solutions. Keep in mind that enterprises with average security requirements should plan to move gradually to native containment.
- By 2019, 40% of Identity as a service IDaaS implementations will replace on-premises IAM implementations, up from 10% today.
Recommended action
Enough limitations have disappeared on IDaas that companies should start experimenting on small-scale projects. While a clash of regulations could derail the increased implementation, companies should work to recognise the current limitations and benefits.
- By 2019, use of passwords and tokens in medium-risk use cases will drop 55%, due to the introduction of recognition technologies.
Recommended action
Passwords are too entrenched in business practices to disappear completely, but companies should look for products that focus on development of an environment of continuous trust with good user experience. Begin by identifying use cases, and press vendors for biometric and analytic capabilities.
- Through 2018, over 50% of IoT device manufacturers will not be able to address threats from weak authentication practices.
Recommended action
By changing the enterprise architecture, IoT introduces new threats. Early IoT security failures might force the industry towards authentication standards, but companies should identify authentication risks, establish identity assurance requirements, and employ metrics.
- By 2020, more than 25% of identified enterprise attacks will involve IoT, though IoT will account for only 10% of IT security budgets.
Recommended action
As IoT continues to grow, vendors will favour usability over security and IT security practitioners remain unsure of the correct amount of acceptable risk. Companies should assign business ownership of IoT security, focus on vulnerable or unpatchable IoT devices, and increase IoT-focused budget.
Earl Perkins, Research Vice President at Gartner.