The use of public cloud services (SaaS and IaaS/PaaS) has been increasing over the past several years. Subsequently, organizations have migrated more data assets to cloud stores. As organizations find that the amount of cloud-resident sensitive data is increasing, the challenge to sufficiently secure this data, especially when distributed across multiple clouds, becomes greater. In light of the disparate and native controls and policies provided by individual cloud service providers (CSPs), organizations need to craft a comprehensive, defense-in-depth strategy to adequately address the data security challenge.
Cybersecurity & Networking
-
-
While a substantial percentage of organizations are aware of the loss of cloud-resident sensitive data, some organizations suspect they have lost data but do not definitively know. This lack of awareness indicates that organizations lack the tools or experience to confidently identify every data loss incident. As a result, organizations fail to learn from, respond to, and address the multiple causes of data loss, resulting in more incidents and greater monetary, regulatory, reputational, and existential risk.
-
While the need to secure public cloud-resident data is critical, organizations’ confidence in the tools and controls provided by cloud service providers (CSPs) is lukewarm. To alleviate these concerns, organizations are using a combination of CSP-native and third-party controls to secure cloud-resident sensitive data. This defense-in-depth strategy provides a multi-layered approach to address multiple dimensions of data security.
-
The role of the cloud security architect (CSA) has emerged to lead the charge in securing cloud-resident sensitive data. Yet, data security remains a responsibility shared by multiple groups including IT operations, security, and DevOps. The establishment of CSAs shows that securing cloud-resident data is of strategic importance, especially to cybersecurity, as the role now reports to the C-level, most often the CISO.
-
Organizations are increasing investments in cyber-threat intelligence programs to get ahead of threat actors and cyber-attacks. Beyond traditional threat intelligence, firms are adopting digital risk protection (DRP) programs and/or services to safeguard the growing volume of digital assets. DRP encompasses a mix of traditional and emerging areas like mobile application protection, brand protection, executive protection, and deep/dark web monitoring.
-
Most enterprise organizations have threat intelligence programs in place, and CISOs try to anchor them with the right staffing, processes, and oversight. While organizations strive to follow best practices, threat intelligence programs can be challenging, leading to suboptimal results. To succeed, programs should follow a threat intelligence lifecycle over six phases.
-
About
Principal Analyst John Grady uses his nearly 20 years of IT vendor and analyst experience to help clients identify and understand key market trends, refine their messaging, and be more successful in the marketplace.
Prior to joining Enterprise Strategy Group, John spent four years at Symantec, where he was responsible for market insights and analytics supporting product, go-to-market, and executive stakeholders.
Previously, John worked as an analyst at IDC covering network, web, and email protection and leading initial research initiatives on then-emerging areas such as advanced threat prevention and DDoS protection. As an analyst, he has also focused on infrastructure channels, advising clients on indirect go-to-market strategies.
John has written for Dark Reading and has been quoted in Network World, CSO, eWeek, CRN, Silicon Angle, ITPro, SDX, HelpNet Security, and TechTarget, among others. He holds a BA in History from Providence College in Providence, Rhode Island.
For all the talk of the perimeter being dead, network security remains a fundamental aspect of IT security. That said, the distributed nature of the modern enterprise creates new challenges that must be addressed. So, the pace of change and innovation in this space has quickened.”
John Grady
Principal Analyst, Network Security & Web Application Security
Survey Results
Securing SaaS Ecosystems Survey
This Complete Survey Results presentation focuses on the top use cases for SaaS security, the benefits realized or expected by organizations implementing different SaaS security practices, and the key stakeholders across the SaaS security buyer’s journey. Already an Enterprise Strategy Group client? Log in to read the full report. If you are not yet a Subscription […]
John Has Appeared In
Latest Insights from John
Research Brief | April 30, 2025
Convergence and Collaboration Efforts in Application Security
Research Brief | April 30, 2025
Reaching a Tipping Point With API Security
Infographic | April 11, 2025
Balancing Requirements for Application Protection
Research Report | April 11, 2025
Balancing Requirements for Application Protection: Teams Desire Consolidation but Need Specialized Protection
See John’s Content on TechTarget
-
About
Principal Analyst Dave Gruber helps product marketing and management leaders develop winning strategies in highly competitive markets.
Prior to joining Enterprise Strategy Group, Dave held executive leadership roles at successful endpoint and application security companies. Most recently, he was the VP of Product Marketing at Carbon Black through its IPO, and previously he was VP of Products at Black Duck Software (acquired by Synopsys) where he led product marketing and product management.
In his current analyst role, Dave researches CISOs’ and security teams’ most pressing needs, working together with security vendors to develop successful product and go-to-market strategies, positioning, and messaging. Building on a strong technical background with early roles in enterprise application development, Dave became interested in figuring out why some products were more successful than others, which eventually led him to senior roles in software product management and product marketing.
Dave has appeared in Cybersecurity News, SC, InfoSecurity, TechRepublic, Dark Reading, RSAC, and ITPro Today, among others. He holds a BS in Computer Science from the University of Maine in Orono.
Converging disparate tools into a smaller number of mini platforms is helping reduce complexity while increasing efficacy through more tightly integrated security controls and operational workflows.”
Dave Gruber
Principal Analyst, Ransomware, SecOps & Services
Research Report
The Triad of Security Operations Infrastructure: XDR, SIEM, and MDR
Security operations grow more difficult each year due to issues such as the persistent threat landscape, a growing attack surface, and the volume and complexity of security alerts. Additionally, many SOC teams remain understaffed and lack advanced security operations skills. To address these challenges, CISOs are open to evaluating new technologies in areas like advanced […]
Dave Has Appeared In
Latest Insights from Dave
Research Brief | May 21, 2025
Strategic Use of Managed Services in Security Operations
Research Brief | May 21, 2025
Large SOCs Take a Multifaceted Approach to Optimizing Security Operations
Infographic | April 11, 2025
The Future of SecOps in an AI-driven World
Research Report | April 11, 2025
The Future of SecOps in an AI-driven World
See Dave’s Content on TechTarget
