Story image

Gartner’s top security and risk management trends

07 Mar 2019

Gartner has identified seven emerging security and risk management trends that will impact security, privacy and risk leaders in the longer term.

Gartner defines “top” trends as ongoing strategic shifts in the security ecosystem that are not yet widely recognised, but are expected to have broad industry impact and significant potential for disruption.

Gartner research vice president Peter Firstbrook says, “External factors and security-specific threats are converging to influence the overall security and risk landscape, so leaders in the space must properly prepare to improve resilience and support business objectives.”

The top security and risk management trends for 2019 and beyond are:

Risk appetite statements are becoming linked to business outcomes

As IT strategies become more closely aligned with business goals, the ability for security and risk management (SRM) leaders to effectively present security matters to key business decision makers gains importance.

“To avoid exclusively focusing on issues related to IT-decision making, create simple, practical and pragmatic risk appetite statements that are linked to business goals and relevant to board-level decisions,” says Firstbrook.

“This leaves no room for business leaders to be confused as to why security leaders were even present at strategic meetings.”

Security operations centres are being implemented with a focus on threat detection and response

The shift in security investments from threat prevention to threat detection requires an investment in security operations centres (SOCs) as the complexity and frequency of security alerts grow.

According to Gartner, by 2022, 50% of all SOCs will transform into modern SOCs with integrated incident response, threat intelligence and threat-hunting capabilities, up from less than 10% in 2015.

“The need for SRM leaders to build or outsource a SOC that integrates threat intelligence, consolidates security alerts and automates response cannot be overstated,” says Firstbrook.

Data security governance frameworks will prioritise data security investments

Data security is a complex issue that cannot be solved without a strong understanding of the data itself, the context in which the data is created and used, and how it is subject to regulation. Rather than acquiring data protection products and trying to adapt them to suit the business need, leading organisations are starting to address data security through a data security governance framework (DSGF).

“DSGF provides a data-centric blueprint that identifies and classifies data assets and defines data security policies. This then is used to select technologies to minimise risk,” says Firstbrook. “The key in addressing data security is to start from the business risk it addresses, rather than from acquiring technology first, as too many companies do.”

Passwordless authentication is achieving market traction

Passwordless authentication, such as Touch ID on smartphones, is starting to achieve real market traction.

The technology is being increasingly deployed in enterprise applications for consumers and employees, as there is ample supply and demand for it.

“In an effort to combat hackers who target passwords to access cloud-based applications, passwordless methods that associate users to their devices offer increased security and usability, which is a rare win/win for security,” says Firstbrook.

Security product vendors are increasingly offering premium skills and training services

The number of unfilled cybersecurity roles is expected to grow from 1 million in 2018 to 1.5 million by the end of 2020, according to Gartner.

While advancements in artificial intelligence and automation certainly reduce the need for humans to analyse standard security alerts, sensitive and complex alerts require the human eye.

“We are starting to see vendors offer solutions that are a fusion of products and operational services to accelerate product adoption. Services range from full management to partial support aimed at improving administrators’ skill levels and reducing the daily workload,” says Firstbrook.

Investments being made in cloud security competencies as a mainstream computing platform

The shift to cloud means stretching security teams thin, as talent may be unavailable and organisations are simply not prepared for it.

Gartner estimates that the majority of cloud security failures will be the fault of the customers through 2023.

“Public cloud is a secure and viable option for many organisations, but keeping it secure is a shared responsibility,” says Firstbrook.

“Organisations must invest in security skills and governance tools that build the necessary knowledge base to keep up with the rapid pace of cloud development and innovation.”

Trend Micro introduces cloud and container workload security offering
Container security capabilities added to Trend Micro Deep Security have elevated protection across the DevOps lifecycle and runtime stack.
Veeam joins the ranks of $1bil-revenue software companies
It’s also marked a milestone of 350,000 customers and outlined how it will begin the next stage of its growth.
Veeam enables secondary storage solutions with technology partner program
Veeam has worked with its strategic technology alliance partners to provide flexible deployment options for customers that have continually led to tighter levels of integration.
Veeam Availability Orchestrator update aims to democratise DR
The ability to automatically test, document and reliably recover entire sites, as well as individual workloads from backups in a completely orchestrated way lowers the total cost of ownership (TCO) of DR.
Why flash should be considered the storage king
Not only is flash storage being used for recovery, it has found a role in R&D environments and in the cloud with big players including AWS, Azure and Google opting for block flash storage options.
NVIDIA's data center business slumps 10% in one year
The company recently released its Q1 financial results for fiscal 2020, which puts the company’s revenue at US$2.22 billion – a slight raise from $2.21 billion in the previous quarter.
Limelight Networks celebrates 100th point-of-presence launch
The company has increased its global network capacity by 40% in just five months, bringing its total egress capacity to 42Tbps.
Salesforce continues to stumble after critical outage
“To all of our Salesforce customers, please be aware that we are experiencing a major issue with our service and apologise for the impact it is having on you."