Modern businesses are built on data. This statement should not be confused with the idea that data has long been a necessary byproduct of business activities, something that must be stored and protected. Rather, for today’s businesses, the effective usage of data is fuel that generates revenue, unlocks new opportunities, and creates operational efficiencies.
Insight
-
-
Operationalizing the IT requirements for a remote workforce for many businesses means accelerating digital transformation initiatives, which leverage a range of cloud services. As a result, an organization’s cloud footprint increasingly includes a mix of third-party SaaS applications as well as internally developed cloud-native apps to support critical back, middle, and front office operations. But different organizations are in different stages of cloud adoption from born-in-the-cloud companies fully indexed on the cloud to enterprises who operate in a hybrid, multi-cloud world.
A challenge shared by all companies, however, is unifying security policies across disparate environments. Maintaining consistency across data centers and public cloud environments where cloud-native applications are deployed was cited by 43% of respondents who participated in ESG’s annual Secure DevOps study as the biggest challenge securing those applications. In this second of a two-part video series, Greg Keller, JumpCloud’s CTO, and I discuss how the use cases of a directory-as-a-service (DaaS) offerings meet the needs of businesses at different stages of their cloud journey.
-
With most organizations standardizing on cloud-delivered email in an effort to shift costs from CapEx to OpEx, many have assumed that email service providers would automatically include comprehensive security controls. Many of these same organizations found it necessary to add third-party controls either during their migration or at a later date. Many have suffered from phishing-related attacks that led to credential theft and BEC, while others faced the loss of sensitive data through both unintentional and intentional actions.
In order to gain insight into these trends, ESG surveyed 403 IT and cybersecurity professionals at organizations in North America (US and Canada) responsible for evaluating, purchasing, and managing email security products, processes, and services.
-
The application security market is in a state of transition as legacy approaches to web application firewall, API protection, bot mitigation, and DDoS prevention have struggled to meet the needs of modern applications. The decentralization of application development and shift to agile methodologies, significant shortage of security skills with regards to applications, and evolution towards sophisticated, multi-vector attacks have forced organizations to rethink their approaches to application security. The evolution towards WAAP, or web application and API protection has been a direct result but remains a work in progress, with many providers just starting to loosely couple the required pieces. -
Kaseya is hosting its Connect IT 2020 conference online this year, as could be expected, and just unveiled a number of new capabilities and integrations following an acquisition announcement yesterday of email security and phishing defense platform Graphus. -
The IT implications of the pandemic-induced surge in remote work are headlined by an increased reliance on cloud applications and services. Supporting and securing direct-to-cloud access has necessitated a focus on identity and access management (IAM) initiatives including:
- Extending single sign-on (SSO) to additional SaaS applications
- Implementing MFA (finally!) to secure access to an organization’s most critical and sensitive apps and data
- Rethinking privilege access management (PAM) in a cloud context
- Monitoring user activity to detect both insider threats and stolen credentials
- And, because new devices are being used by remote employees, extending trust-based authentication to device profiles
Updating these aspects and others of an IAM program to secure a remote workforce starts with a focus on policies. However, developing and adjusting policies to support the increase in the work-from-home population is the top security challenge associated with remote work as reported by a third of the respondents in a recent ESG study. In this first of a two-part video series, Greg Keller, JumpCloud’s CTO, and I discuss the challenges and solves for the strategic imperative to secure the identity perimeter expanded by remote work. Click here to watch Part 2 »
-
Zero-trust has seen an explosion in interest over the last few years. As the perimeter has become increasingly porous due to cloud usage and distributed network architectures, a fresh look at some of the foundational cybersecurity concepts was sorely needed. This has only been exacerbated by the pandemic, with many organizations not only supporting a primarily remote workforce, but also trying to complete their digital transformation journey in a matter of months, rather than the years they originally planned.
Despite the clear applicability, there remains some confusion in the market regarding exactly what implementing zero-trust entails, where to start, and how to ensure the initiative is successful. The recent finalization of the NIST guidelines on zero-trust architectures may help provide some clarity, but much work remains.
With all that in mind, Mark Peters posed several questions to me on the topic of zero-trust as a part of Enterprise Strategy Group’s recent virtual breakfast at Black Hat 2020. In the following video, Mark and I touch upon:
- Zero-trust interest and adoption. By now, nearly everyone even tangentially involved with cybersecurity has some awareness of zero-trust. In fact, Enterprise Strategy Group research has found that 88% of respondents are very or somewhat familiar with the concept. However, when we consider adoption, the data simply doesn’t match up with real-world scenarios, pointing to the aforementioned confusion.
- Data security as a component of zero-trust. The short answer is that it is a part of a complete zero-trust strategy. However, it should not be the starting point.
- How to incorporate zero-trust. We don’t provide an exhaustive list, but do touch on some of the high-level keys to success with these projects, including starting small while maintaining a long-term vision and how to think about vendor partnerships.
-
ESG conducted a comprehensive online survey of IT professionals from private- and public-sector organizations in North America (United States and Canada) between March 20, 2020 and March 28, 2020. To qualify for this survey, respondents were required to be IT professionals responsible for data protection technology decisions, including those in place to ensure application SLAs are met.
This Master Survey Results presentation focuses on real-world SLAs and availability requirements, including tolerance for downtime, downtime metrics, and real-world SLAs in the context of actual data loss against the backdrop of availability technologies and methods.
-
This Master Survey Results presentation focuses on how alternative device choices, employee requirements and preferences, and a drive to improve businesses’ security posture are all challenging how traditional desktops are delivered to, maintained for, and consumed by end-user employees, including the increased usage of virtual desktop infrastructure (VDI) and desktop-as-a-service (DaaS) technology.
-
ESG conducted a comprehensive online survey of IT and cybersecurity professionals from private- and public-sector organizations in North America (United States and Canada) between June 25, 2019 and July 8, 2019. To qualify for this survey, respondents were required to be IT and information security professionals responsible for the policies, processes, or technical safeguards used for incident readiness and response at their organization.
This Master Survey Results presentation focuses on incident readiness services, including understanding the trigger points influencing service investments for breach preparation and proactive exercises, as well as how decision makers are prioritizing and timing purchase decisions.
-
In this new edition of Data Protection Conversations, I speak to Molly Presley, Founder of the Active Archive Alliance.
-
ESG’s Master Survey Results provide the complete output of syndicated research surveys in graphical format. In addition to the data, these documents provide background information on the survey, including respondent profiles at an individual and organizational level. It is important to note that these documents do not contain analysis of the data.
This master survey results set offers new data concerning:
- Organizational dynamics, buying behavior, and the future of email security.
- Email attacks and threat detection and response.
- Issues with sensitive data in email.
- Bolstering email security with complementary technologies and services.
The application security market is in a state of transition as legacy approaches to web application firewall, API protection, bot mitigation, and DDoS prevention have struggled to meet the needs of modern applications. The decentralization of application development and shift to agile methodologies, significant shortage of security skills with regards to applications, and evolution towards sophisticated, multi-vector attacks have forced organizations to rethink their approaches to application security. The evolution towards WAAP, or web application and API protection has been a direct result but remains a work in progress, with many providers just starting to loosely couple the required pieces.
Kaseya