In business, there’s always been friction between the need to protect information and the desire to push technology forward and innovate. Today, perhaps, that friction is hotter than ever, as end users want to bring their own devices and applications to work. While some organizations try to block everything that isn’t approved — employees can use only corporate-approved-devices and software — others are trying to accommodate the trends by opening the floodgates.

Neither is the ideal approach.

The first is too draconian and won’t work because users will sidestep overbearing rules. Tell them they can’t tweet from work? They’ll tweet from their personal iPhone. Tell them they can’t use tablets for work? They’ll do it anyway from their 3/4G-enabled tablet and on their personal network connection. All of this happens outside corporate IT’s view because IT doesn’t control the devices, the networks or even the data that employees use outside the office. Counterintuitively, controlling the user too much in this way actually decreases security; out of sight is not out of mind — when user actions are pushed out of view, IT and security teams don’t know what’s going on.

The second approach — a laissez-faire environment — doesn’t work either, as it sets up the organization for data breaches in the making, especially from mobile devices accessing corporate data. Reaching a balance: to protect systems and data while enabling the business to push forward with innovative initiatives, was the subject CA Technologies Director of Research, Carrie Gates, and Mike Denning, General Manager, Security Business, tackled at the recent RSA 2012 security conference. The pair told security officers to move from “No” to “Know” — that is, security teams should no longer say no to new initiatives such as cloud and mobile, and instead should arm themselves with the “KNOW”-ledge which can help IT to let employees use the devices of their choice at work.

Finding Alternatives

So, rather than tell employees that they can’t use online file-sharing services, provide business managers with an alternative. Perhaps that could be turning to a competing service that caters to the enterprise, or maybe building private cloud storage where the appropriate access controls and monitoring can be put into place. Whenever there is friction between what users need for their jobs and the organization’s need to protect its data, look for a viable alternative and detail the costs versus the business risk and reward for all alternatives. 

To gain this knowledge, listen to user needs. If the HR department is having a hard time attracting talent because the company doesn't allow tablets at work, IT should see an opportunity to enable the business to be competitive in the marketplace for talent.

Access vs. Risk

As Gates and Denning described in the talk, that can include looking for ways to manage device access to corporate applications, such as single sign-on authentication; by backing up work files to corporate storage in the cloud; or by segmenting the users’ personal workspaces from their work data and applications. None of this is especially easy to do today, but the tools are maturing, and it’s time to start taking a close look at how to make it happen. Each organization has to weigh its own business needs against its own level of tolerance for risk.

For instance, ask whether data can appropriately be stored in an on-demand software service. Can security controls be put into place, such as proper authentication and access monitoring, to satisfy security policy and that data level’s classification? If not, maybe that data isn’t suitable for that service, and an internally managed option would be the way to go.

The ability to innovate, and perhaps even drive increased revenue, doesn’t require esoteric technology. You just need to keep an eye on what can be done, and how to secure it with the available technologies. When this is done right, you’ll be rewarded with the ability to effectively — and securely — move forward with innovative initiatives in mobile, cloud, or new services and applications in your industry.

Numerous start-up cloud vendors are busy hyping their "Security-as-a-Service" wares, with requisite promises of turnkey "Security in a Box" and the like. But enterprise CIOs have tough questions about the validity and reliability of such firms and their services — as well they should. Securing a global IT infrastructure is paramount — with millions of dollars and customers at stake, not to mention a company's tarnished reputation if a major security breach occurs. It’s wise to ask whether such a mission-critical task can be entrusted to a third-party host.

That’s why Matthew Clark, Senior Director of IT at telecom provider Qualcomm in San Diego, is taking a cautious approach to cloud services. "Trust and security in cloud computing are big deals to companies,” he says, and too often cloud providers are more concerned with protecting their own business than the customer’s. As a result, “We are very, very cautious about what we allow to be put out into external clouds," Clark says.

Lina Liberti, VP of the Security business at CA Technologies, understands the concerns. She told me recently that, "Some of these new-to-the-market Security-as-a-Service providers are great for small to midsize business, as smaller firms are more likely to take risks in order to realize the benefits from a cloud deployment." But, she warns, outsourcing large enterprise security to a new, immature vendor is a risky consideration.

That doesn’t mean a large or growing enterprise can’t take advantage of the cost and resource savings cloud security offers; they just need to partner with companies that have hardened enterprise-grade security tools delivered as a service.

Peter Hinssen, one of Europe's leading tech gurus, noted that "CA [Technologies] realized that cloud was going to happen faster than anyone else anticipated, and the company has taken a leading role in this market. Hinssen believes that CA Technologies also is out front with its Identity Management-as-a-Service as well.

The company recently released several cloud solutions aimed at the identity and access management (IAM) security market. The CA CloudMinder portfolio, for example, is morphing the firm's long-established IAM solutions into hosted, subscription-based security services for customers. With the new services, CIOs no longer need to purchase, install and maintain their IAM tools via old-school methods (as applications on CDs, for instance). Now, they're available in the cloud as services customers can procure or buy or license from CA Technologies.

Besides its experience with enterprise data centers, CA Technologies provides trained support 24x7x365 — critical to most global online enterprises. These “comfort factors” may boost Security-as-a-Service among skeptical CIOs — even those like financial and healthcare CIOs, who need to meet stringent requirements and regulations with their cloud deployment.

To me, that's hope, not just hype.

Larry Lange is a freelance writer on the business of technology and a contributor to Smart Enterprise magazine.

What do the royal newlyweds and IT have in common? Both need a large number of qualified security professionals to guard the castle--and enterprises are falling behind.

At the recent royal wedding, the world watched, and thousands of Britons and tourists turned out to witness the live event, which was very well secured. News reports indicated that more than 5,000 police were in attendance to ensure the security of the royal family, global dignitaries and spectators.

Now imagine for a moment that instead of 5,000 professional police, the security force was comprised of 5,000 people who worked in security in addition to their primary job. Say, for example, that the royal family and world dignitaries were defended by factory workers, doctors, accountants, lawyers or other professionals. Seems silly, doesn’t it? And yet, many organizations treat IT security as a second job for their staff or they put staff in charge of operations without sufficient training. This results in added risk for the enterprise, employees, information and clients.

As security threats heighten, it’s clearly time for staffing to keep pace and for the gap between needs and skills to be addressed. Organizations must elevate the role of information security professionals and put sufficient support and resources at their royal gates.

The Changing Threat Landscape

I have been the lead analyst for the (ISC)2 Global Information Security Workforce Study (GISWS) since 2007 and have seen many changes both in technology and the threats to organizations during that time. In 2007, the primary threat to organizations consisted of viruses and worms. This year, more than 10,000 information security professionals from more than 120 countries responded to our survey and reported new vectors that criminals were using to attack.

Information Security Professionals’ Top Concerns, 2011

As shown in the bar chart above, application vulnerabilities, mobile devices, and traditional virus and worm attacks keep information security professionals up at night.

The Skills Gap

Information security professionals are on the front lines when it comes to data protection. They are tasked with securing the organization’s systems even as end users bring in new devices and applications and move corporate data into the cloud. And yet, our research indicates that in the next several years there is likely to be a severe gap in skill sets industrywide. Information security professionals are stretched thin, and like a series of small leaks in a dam, the current workforce may show signs of strain.

For example, nearly 75 percent of respondents indicated that new skills were needed to meet the demand for cloud computing. Of that group, an overwhelming 92 percent indicated that a more detailed understanding of cloud computing was necessary by security professionals. In another question, mobile devices were ranked as the second highest threat for the organization despite the fact that more than 60 percent of respondents said they had controls in place to defend the mobile workforce.

Ironically, these challenges are creating healthy growth in the sector. Frost & Sullivan estimates that the number of information security professionals worldwide in 2010 was approximately 2.28 million. This figure is expected to increase to almost 4.24 million by 2015, displaying a compound annual growth rate (CAGR) of 13.2 percent from 2010 to 2015.

The chart below reflects these findings, based on our observations of staffing behavior during the past 12 months and from our primary research on organizations’ intentions to increase their information security budgets, including staffing.

2010-2015 Forecast for Information Security Professionals

The 2011 GISWS clearly illustrates the concerns held by information security professionals in a variety of areas. As I noted above, it is well known that many organizations expect IT professionals to also wear the security practitioner hat. This is a corporate mindset that cannot change overnight; budgets and spending will have to open up and a change in corporate culture has to occur.

What can an organization do in the meantime?

Organizations can take three key steps to foster a culture of security and eventually build the role of information security professional.

1. Enlist upper-management support. Without support from the top, security initiatives are doomed to fail.
   
2. By raising the awareness of end users, organizations can begin to solve the problem from the inside out.
   
3. Create a specialization and an interest in security for the existing staff. By assigning security tasks to interested professionals, an organization can organically build its dedicated information security workforce from within.

Given the challenging economic times, organizations are hesitant to spend money on new positions unless absolutely necessary. However, as cyber-risks increase, it is imperative that information security be given top priority. Organizations willing to take even small steps toward training and building a strong information security workforce will see the benefits in the form of lowered risk to their data and to their customers’ information.

Robert Ayoub, CISSP, is Global Program Director of Network Security and Information & Communication Technologies at Frost & Sullivan. He is a member of Smart Enterprise Exchange and can be reached on the site.

No doubt 2010 will go down as a seminal year for IT security. The adoption of software-as-a-service and cloud computing hit full speed on the adoption runway – as did all of the regulatory compliance and security concerns that go with these new platforms. It was also the year we saw the Operation Aurora attacks that affected Google and a number of other U.S. high tech firms and the alleged theft of 250,000 classified cables by Private First Class Bradley Manning which were reportedly made available to the document leaking site Wikileaks.

If your organization has data it needs to protect, there are clear lessons here:

1. Log management. As demonstrated by Operation Aurora, attackers are increasingly skilled. If you want to better protect your organization against sophisticated attackers, you need to be aware of the security event data within your server, application, and security logs. There is a ton of insight within those logs, and they often are the best place to spot attacks that are underway early enough to stop before serious damage is done.

2. Data and system classification. Want any hope of stopping an insider from stealing reams of proprietary data?  It's crucial that your organization know not only what data is vital to protect, but where it is stored and who has access. Which brings us to identity and access management.

3. Identity And Access Management. If your organization hasn't: now is a good idea to take an enterprise-wide assessment of its identity and access credentials. Are they out of date? Are there previous employees and contractors who still have access?  Do employee and partner access rights reflect their current roles? As your enterprise extends its use of virtualization and the cloud – having sound identity management is place is even more critical.

4. Database and access monitoring. It doesn't matter how closely you watch your logs for potentially bad behavior, how well your data is classified, or how tightly controlled access is: bad things are going to happen. That's why it's important to be continuously monitoring databases and files for unusual access patterns.

I'm sure you have plenty of priorities and pressing issues on your agenda. But interviews with dozens of CIOs and CISOs during the past few months have revealed just how far behind many organizations are on the basics.

Now is as good of a time as any to turn that around.