Virtualization and Cloud executives share their predictions for 2016. Read them in this 8th Annual VMblog.com series exclusive.
Contributed by Joan Pepin, CISO, Sumo Logic
Five Information Security Trends to Expect in 2016
2015 was marked by high-profile data breaches at a number of large institutions and brand-name companies — among them Anthem, CVS, and the OPM — leaving security executives everywhere fearing for their jobs.
As hackers become increasingly sophisticated in engineering these attacks, CISOs face a daunting year ahead. The market for security tools is expanding rapidly: Gartner predicts cyber security spending will reach nearly $80 billion by the end of 2015, an increase of about five percent over 2014. While it’s clear that investing in cyber security will remain a top priority in 2016, the tough choices CISOs will have to make in the year ahead extends beyond which solutions to buy.
Here are the five trends shaping the security landscape that organizations should consider as they’re building security plans for 2016:
1. The competition for top security talent heats up. The biggest issue CISOs currently face is the hiring gap. The current job market has more than 300,000 open information security jobs, and companies are struggling to keep pace. To convince a candidate to accept an offer, companies need to prove that security is well-positioned within the organization and is championed by a strong leader who has authority to get things done and impact change.
2. Security teams will invest more in the basics. CISOs are starting to realize that it’s better to invest in security fundamentals than spend budget on new, untested technologies. User behavior analytics (UBA), for example, was hyped to be the hottest emerging technology, yet it still faces adoption challenges. In 2016, CISOs will invest more time and money in security basics. For example, do employees know the password policy? Does IT adequately train users? Are we practicing defense in depth? These foundational elements of security infrastructure need to be addressed first in order for new tools to be effective.
3. CISOs will need to factor international tensions into big decisions. The intense cyber cold war between the U.S., China, and Russia is heating up. China now demands that vendors backdoor their software and technology, leaving CISOs to debate whether to follow the new protocol to sell into one of the world’s biggest markets, or to walk away from the opportunity at the risk of China gaining access to their intellectual property. This has created a sharp divide between companies willing to comply and companies that resist. In 2016, the issue will challenge more executives to take a stance on what it means to be a global company, while still keeping security top of mind.
4. Data breaches will drive security team changes. According to an IID and Ponemon Institute survey, 47 percent of public and private organizations were breached in the past two years. Companies are starting to realize hackers are becoming more sophisticated, increasing the likelihood of being breached, which has sparked a discussion on who should take the blame in the event of a breach. Expect more talk about how CISOs can restructure security teams to avoid placing the responsibility of an entire organization’s security on one or two individuals.
5. Companies will invest more in intelligence. For years, companies have understood the value of using big data to gain actionable insights for business decisions. Now, through advancements in technology, including machine learning, data analytics are providing the most granular insights businesses have been able to capture. For security teams, analytics are giving rise to new, faster intelligence around system and user anomalies, threat detection and breach alerts that will change the way we think about and improve on security for years to come.
##
About the Author
Joan Pepin,VP of security and CISO, Sumo Logic. Joan brings over 17 years of experience to her role as Sumo Logic’s VP of Security and CISO. Her career has spanned a wide variety of industries such as healthcare, manufacturing, defense, ISPs and MSSPs. Her experience includes technical, operational, and management aspects of security, allowing her to bring highly technical research expertise to her current interests in security policy management, marketing, strategy and thought leadership. Prior to Sumo Logic, Joan spent nine years with the Guardent/ Verisign/ Secureworks organization where she invented several core technologies and established key initiatives around policy management, security metrics and incident response. She holds a patent for developing methodology to assess whether a communication contains an attack.
