Collectively, security practices—including data steward assignments, data monitoring, policy-based data classification and security requirements records—should provide the metrics that calculate and reflect the security protections for a particular repository. These metrics can then be used in formulating "trust indexes" that can guide decisions about the use of a data repository. A data repository with a high trust index association can be used for high-risk decisions; conversely, a repository with a low trust index association should be used only for low-risk activities. These repositories can be reused across the enterprise and applied to incoming information from a variety of sources, especially as mash-ups continue to be a driving force of innovation.

Application Security

In 2008, a new type of threat known as Search Engine Optimization (SEO) code injection or poisoning impacted around 1.2 million websites, including some very high-profile sites. As the dust settled from this exceptionally destructive threat, it became clear that applications had become ground zero for hacker attacks.

Part of the vulnerability lies in the evolution from monolithic applications to composite applications, both in SOA-style process choreography and through Web 2.0-style widgets and mash-ups. These composite applications can include application code from a wide variety of sources in a true mix-and-match fashion. Though it has tremendously improved programmer efficiency and enabled many non-programmers to compose sophisticated applications with little training, it can leave applications vulnerable.

Perhaps the most challenging aspect of composable applications is the inability of the application to fully understand the composition, and therefore the security posture, until the application is deployed. Only then—when it's too late—are all the contributing elements exposed, including malware and vulnerabilities. Security development expertise is now being embedded into the tools and development platforms so that security checks can be performed at each stage of development.

These security trends can also offer a wealth of opportunities for forward-acting companies. It's how the risk is managed that will determine how an organization thrives—or fails—in the face of emerging technologies.

Kris Lovejoy is director of IBM's security, governance, and risk management division.