Ruvi Kitov, CEO of Tufin, says automation can help prevent unwanted or unnecessary mistakes bound to arise by human mishaps or misconfigurations.  And automation is influencing the rising interest of network security policy management (NSPM) solutions.  I learned a great deal more after speaking with Kitov.

VMblog:  What's contributing to the rising demand of network security policy management (NSPM) tools?

Ruvi Kitov:  Demand from the business to change at an ever-increasing pace to stay ahead of the competition and stay relevant with their customers has put enormous pressure on IT and security teams to accommodate these requests while maintaining secure and reliable connectivity for key applications and services. 

Adoption of cloud technologies exacerbates the issue by contributing to an already complex array of vendors and technologies.

With this increased complexity and a proliferation of applications, it has become harder for IT teams to keep up with the influx of change requests. Traditional change management approaches fall short as they are heavily labor intensive, managed independently, and are not consistent with a centralized approach.  Chief Information Security Officers (CISOs) are also facing additional pressures due to the limited cybersecurity staff they have to control and implement security policies. This added weight on the CISO and other security professionals, coupled with the continued adoption of cloud environments, has encouraged many companies to consider a new approach, network security policy management (NSPM). By relying on a centralized network security policy to determine firewall and network device configurations, compliance with industry and internal regulations is made easier and can now be automated to streamline security policy management.

VMblog:  As networks grow in complexity, what hidden challenges should IT pros be aware of?

Kitov:  Lack of visibility and control over security policies are major issues for IT pros, particularly when it comes to compliance. 

Both regulatory standards (PCI DSS, HIPAA, GDPR) and internal policy compliance require all network connectivity be justified and documented, and every network security change must be auditable and accountable. To make matters worse, most companies aren't aware of how their current rules and policies are set, or which ones are redundant and outdated. In other words, internal policies now have the potential to interfere with meeting external compliance requirements.

To overcome these challenges, the change management process must rely on a central command center to ensure visibility, control, and compliance.

VMblog:  How can automation redefine traditional network security policy management?

Kitov:  Automation takes over some of the more labor-intensive tasks of the network security team, which helps to ease the ongoing IT security workforce shortage. By automating the management of security policies, organizations can implement changes in minutes instead of days.

VMblog:  What best practices should organizations adopt as they look to the cloud?

Kitov:  Visibility and control in cloud computing is essential, but is often overlooked by organizations adopting cloud platforms. Having the ability to centrally manage the security policies of such a dynamic network infrastructure is a game-changer in terms of increasing business agility, securing the network, and saving time and budget.

VMblog:  Finally, how is the cybersecurity skills shortage impacting IT teams?

Kitov:  CISOs and other security professionals are concerned now more than ever about the practical realities around ways they can extend their existing cybersecurity skills, processes, and controls to enforce security policies. These concerns are illustrated through the difficulties cybersecurity professionals have coordinating security operations consistently across all departments.  

In fact, the shortage of cybersecurity professionals is now expected to grow to more than 1.8 million workers globally by 2022, according to the Global Information Security Workforce Study. As a result, CISOs and their teams are relying on intelligent technologies to take some of the risk management and remediation burden off their plate and free up their staffs' time to focus more on incident response and prevention. Organizations should learn how to do more with existing resources to help combat the skills shortage and network security challenges.

##

Ruvi Kitov is CEO and Co-Founder of Tufin, the leading provider of Security Policy Orchestration solutions. Since Tufin's founding in 2005, Ruvi has led the company through successful growth and product development, quickly gaining more than 1,700 customers among the world's largest enterprises; Tufin is recognized as a market leader with consistent revenue growth, resulting in top rankings in the Deloitte Technology Fast 50 and other awards.