Cisco Subnet An independent Cisco community View more

Enterprise security monitoring weaknesses telegraph lots of future cybersecurity opportunities

broken link breaching weakest link connection vulnerability 000004213740
Credit: iStockphoto

In a recent ESG research survey of 257 security professionals working at enterprise organizations (i.e. more than 1,000 employees), respondents were asked to identify where their organizations were weakest with regard to security monitoring. This graphic displays the results:

060414 chart

A few observations:

  1. User behavior activity monitoring equates cryptic network and log data to actual users and systems. This monitoring is especially useful to monitor for insider attacks or to detect when user systems are compromised. This type of monitoring resides in the domain of firms like Centrify, Courion, CyberArk, SailPoint, and Securonix.
  2. Alternative endpoint monitoring weaknesses can be related to limited visibility around mobile devices, but think about mobile device use in the context of other devices for each user and it gets to be a pretty complex monitoring challenge. This is where vendors like Bradford Networks, Cisco, ForeScout, and Great Bay Software are adding value.
  3. There is good threat intelligence available for free and almost every security device ships with “cloud-based Intelligence” as an add-on feature. In spite of this, 24% of enterprise still consider threat intelligence monitoring as one of their organization’s biggest weaknesses. Clearly, threat intelligence has to become easier to understand, easier to integrate, and easier to act upon. This is why companies like BitSight, Norse, and Vorstack look so promising, and why Symantec is doubling down on its DeepSight portfolio.
  4. While just 23% claim that monitoring sensitive data access and activity is weakest at their organization, my gut tells me that 100% of firms would admit that they have problems here. This problem is big, complex, and may be the next highly profitable frontier for security VCs and vendors. Symantec’s DLP business continues to grow (albeit quietly from a Symantec PR perspective). Varonis rode this demand to a successful IPO, and visionary but stealthy Atlanta-based startup Ionic will soon announce some further innovation in this space.
Join the Network World communities on Facebook and LinkedIn to comment on topics that are top of mind.
Related:
Must read: Hidden Cause of Slow Internet and how to fix it
Notice to our Readers
We're now using social media to take your comments and feedback. Learn more about this here.