The Future of Information Security: 2008 and Beyond

Looking into 2008, the information security agenda for executives continues to evolve. Long gone are the days where a firewall and an intrusion detection system can constitute the arsenal of information security defense. The complexities of what to protect and when, overlaid with requirements of regulation and compliance, create the need for a new type of information security executive—one with business savvy, sound risk fundamentals and holistic technical understanding. These skills, coupled with a strong strategy, will be necessary for organizations to achieve their 2008 information security goals.

MORE Predictions

10 Virtualization Vendors to Watch in 2008

Five Key Technology Trends for 2008

Six Enterprise Application Trends to Watch in 2008

In looking to build that type of strategy and structure, the items most likely to top the list are data protection and governance, compliance and the effective integration of information security practices into key business and risk management efforts. Executives must choose carefully; how the 2008 strategy addresses these three critical items may determine the program’s ultimate success in protecting the business.

Where did the data go?

Data has gone rogue, and it didn’t make any headlines in the process. Perhaps it should have. An event this important warrants some attention, but because it didn’t happen with a big bang, no one seemed to notice. Inanimate as it is, data is causing problems because it’s growing at an uncontrollable rate and it’s hiding seemingly everywhere—both in the trusted confines of the data center and on the move through laptops, PDAs and e-mail. It’s being disclosed (both on purpose and inadvertently) at an alarming rate and it’s all but openly defying the letter of our corporate policies and standards.

The number one item on the 2008 information security agenda is data protection. The practice of protecting the confidentiality, integrity and availability of data is not new—passwords, encryption and data classification structures have been around for years. What has changed is the type of data that’s now considered valuable. From the external attacker perspective, intellectual property and insider information were once the most sought-after data asset. Now, the data currency of choice is identity—e-mail addresses, social security numbers and credit card information. Corporate espionage is still a significant threat, but the new underground deals in volume, where success is being measured in thousands and millions of identities.

Internally, data protection is equally challenging. Executives demand that data be available to aid in decision support, albeit limited to only those team members with a “need to know.” Whether through e-mail, jump drives or mobile devices, sensitive information seems to be leaving companies in droves. Add in the complexities of outsourcing and offshoring, and the data protection strategy needs to stretch beyond once-trusted walls and around the world.

Ultimately, the challenge starts with something very fundamental—knowing where critical data lives—then leads to a myriad of additional questions and potential obstacles. How should the data be protected? What’s the risk to the business if it’s lost, stolen or disclosed? What are the regulatory implications of a breach? Who controls the most recent version of the data? How are business partners protecting the data?

This is the world of data governance. In its simplest form, data governance is an umbrella term referring to the various views in a data protection strategy. Under this umbrella are a number of different facets: data inventory and data classification—where critical data live and what expectations there are with respect to how and by whom data can be accessed, handled, stored, transmitted, processed and disposed; vendor risk management—how data is shared and subsequently protected by business partners; and data leakage—what data is leaving the organization by unforeseen or inappropriate ways. There is also the question of authoritativeness, that is, where the copies or replicas of data may exist within the environment, where the most recent version resides, who controls it and how changes are propagated throughout the organization to aid in decision support. Additionally, there are the issues of privacy and compliance—whether privacy expectations and regulatory requirements around both are being met across the enterprise and with outside third parties. Last but not least, there is e-discovery and litigation support, particularly with respect to the accessibility of tools and processes for responding to ad hoc enterprisewide demands and legal or regulatory substantiation.

Does better information security lead to better compliance? Is the reverse true?

While data protection may be the most difficult challenge for the information security organization in 2008, achieving internal and external compliance goals will be the most measured part of the program. According to the 10th Annual Ernst & Young Global Information Security Survey, 60 percent of respondents cited their compliance efforts as the most important activities to their organization, with over half stating that a majority of their team’s time is being spent on compliance activities. Roughly 80 percent of respondents noted that tying compliance goals to their information security initiatives helped them justify and obtain resources and budgets for those initiatives. They also said that by having to address regulatory and compliance requirements, they’ve improved their organization’s information security posture.

Whether it’s a question of complying with Sarbanes-Oxley or with the regulatory requirements of the payment card (PCI) or healthcare (HIPAA) industries, compliance initiatives will continue to be a significant driver for and component of the 2008 information security agenda.

Protecting business from the inside out

While data protection provides the challenge, and compliance will consume a majority of the time, the most relevant trend for 2008 is information security’s emergence as a strategic business-level issue that plays an increasing role in achieving business objectives. For years, the term IT security has been very appropriate, since activities were focused around antivirus, firewall rules, intrusion detection and the like, with the need for specialized skills to implement and manage specific security technologies. These technologies will continue to flourish and improve, but the mysticism associated with managing them has all but gone away. The operational roles to support these tools are being integrated into the organization’s infrastructure team, which is where the roles belong. Antivirus software should be a standard part of a desktop operating system build and supported by the desktop management team; firewall management should be included as part of the network management team, etc.

The role of information security in 2008 and beyond is to help a company understand the risks to, and effect on, business operations stemming from the current environment. That means incorporating risks associated with data, privacy, business resiliency and continuity, technology, third parties and, with the help of corporate counsel, even potential legal risks to enable executives to make better business decisions. Moving forward, information security concerns will begin to be integrated at a fundamental level with business initiatives as they are being developed and will become a relevant component of a company’s enterprise risk picture.

The information security journey through 2008

The role of information security in 2008 will be more of a journey than a destination. The ever-changing landscape of risks, regulations and threats will provide multiple diversions and distractions from the security program. However, focusing on data protection and governance, achieving compliance goals and integrating information security into the key business initiatives will lead to a more successful program for 2008 and in the journey beyond.

Kevin Richards, CISSP, is a member of the Risk Advisory Services practice of Ernst & Young LLP. He also is the International Vice President of the ISSA (Information Systems Security Association) International Board.

The views expressed herein are those of the author and do not necessarily reflect the views of Ernst & Young LLP.