DISRUPT SECURITY - Forbes · 2018-02-06 · conducted by Forbes Insights and Juniper Networks. In...

16
DISRUPT SECURITY: Business Innovation Will Falter Without a Modern Security Strategy IN ASSOCIATION WITH:

Transcript of DISRUPT SECURITY - Forbes · 2018-02-06 · conducted by Forbes Insights and Juniper Networks. In...

Page 1: DISRUPT SECURITY - Forbes · 2018-02-06 · conducted by Forbes Insights and Juniper Networks. In fact, nearly half of the survey participants strongly believe that a reputation for

DISRUPT SECURITY: Business Innovation Will Falter Without a Modern Security Strategy

IN ASSOCIATION WITH:

Page 2: DISRUPT SECURITY - Forbes · 2018-02-06 · conducted by Forbes Insights and Juniper Networks. In fact, nearly half of the survey participants strongly believe that a reputation for

2 | DISRUPT SECURITY: BUSINESS INNOVATION WILL FALTER WITHOUT A MODERN SECURITY STRATEGY

TABLE OF CONTENTS

3 INTRODUCTION

4 KEY TAKEAWAYS

4 RESEARCH METHODOLOGY

5 BUSINESS SUCCESS IS TIED TO SECURITY

9 BEYOND TECHNOLOGY

13 AN IMPERATIVE TO ACT

15 ACKNOWLEDGMENTS

Page 3: DISRUPT SECURITY - Forbes · 2018-02-06 · conducted by Forbes Insights and Juniper Networks. In fact, nearly half of the survey participants strongly believe that a reputation for

COPYRIGHT © 2017 FORBES INSIGHTS | 3

T raditional enterprises learned the lessons of the world’s Ubers and Airbnbs long ago—talk of self-disruption is as common in boardrooms today as discussions about financial results and shareholder engagement. But now, transformation strategies are looking beyond the activities of market insurgents to address new threats—the

growing sophistication and volume of cyberattacks and the realization that enterprises can’t simply fine-tune cybersecurity strategies as they modernize business processes and services. They must fundamentally reengineer security capabilities and integrate them more tightly with larger business plans.

Unfortunately, many enterprises are still searching for answers in this new phase of business transformation, according to a new survey of more than 500 senior business and IT executives conducted by Forbes Insights and Juniper Networks. In fact, nearly half of the survey participants strongly believe that a reputation for industry-leading cybersecurity is a competitive differentiator in their markets—41% say customers favor companies with strong security reputations. However, only a fraction—just 5%—consider their security efforts to be ahead of competitors in this area. This perception runs deep in the thinking of senior executives. Only 37% feel completely prepared for new business initiatives and technologies in terms of cybersecurity. All of which raises the question: In the age of business transformation, what should large enterprises be doing to create organizations that are both innovative and secure?

A select group of enterprises offers answers. These leaders—organizations that are planning or undertaking enterprise-wide digital transformation and who rate their security capabilities as market leading—differentiate themselves in many important ways. The research found that they are moving much faster than followers to invest in advanced security technologies, such as enterprise-wide security management tools, software-defined networks (SDN), machine learning, and automation of breach detection and remediation processes.

What’s more, efforts like these are paying off. A large percentage of leaders saw profit margins grow by 7% or more in the last year, while their risk profiles also improved—two areas where followers lagged significantly.

The message is clear: To gain and keep a competitive advantage in today’s marketplace, enterprises need a well-orchestrated combination of innovation and security, where one complements the other. The benefits of such a strategy go beyond just staying out of the headlines as the latest organization to suffer a security breach. The right technologies, policies and organizational changes can help companies gain a competitive edge using security, while also providing new levels of automation that reduce the time-consuming burdens of caring for day-to-day security requirements.

INTRODUCTION

Page 4: DISRUPT SECURITY - Forbes · 2018-02-06 · conducted by Forbes Insights and Juniper Networks. In fact, nearly half of the survey participants strongly believe that a reputation for

4 | DISRUPT SECURITY: BUSINESS INNOVATION WILL FALTER WITHOUT A MODERN SECURITY STRATEGY

KEY TAKEAWAYS

A third of senior leaders say new business initiatives and emerging technology will require fundamental

changes in their overall security strategy

47% of senior executives strongly believe that a reputation for industry-leading cybersecurity is a competitive

differentiator in their markets

But only 5% of enterprises consider their security efforts to be a competitive advantage

30% of executives identify mobile applications while 27% name hybrid clouds as having the biggest impact

on security today

51% of innovation/security leaders will adopt or expand their use of software-defined networks to enhance

security in the months ahead

40% expect the volume and sophistication of cyberattacks will increase over the next two to three years

RESEARCH METHODOLOGY This report is based on a survey of 503 global executives. Thirty-two percent are from North American companies, 29%

from Europe, 29% from Asia-Pacific, 10% from Latin America. The executives work in a variety of sectors, including

energy, healthcare, technology and education. All are senior executives, including CIOs, CISOs, vice presidents and

directors.

Respondents that were designated as innovation/security leaders are those who said their organizations are planning

or undertaking digital transformation across the enterprise and who rated their security capabilities as market leading.

Page 5: DISRUPT SECURITY - Forbes · 2018-02-06 · conducted by Forbes Insights and Juniper Networks. In fact, nearly half of the survey participants strongly believe that a reputation for

COPYRIGHT © 2017 FORBES INSIGHTS | 5

BUSINESS SUCCESS IS TIED TO SECURITY Digital transformation is important to all the executives in the survey, with nearly half (49%) either planning or already undergoing enterprise-wide digital transformation initiatives.

But executives understand that innovation alone won’t ensure market success going forward—executives across the maturity curve see the close link between security and competitiveness. For example, 41% say customers are more likely to do business with a company that has a reputation for staying secure.

Vonage, a provider of cloud-based communications systems, clearly understands the correlation between business success and modern cybersecurity. “By fully securing new products and services, companies develop better offerings that can help them enter new markets they otherwise couldn’t enter,” says Johan Hybinette, global CISO.

Traditionally a consumer-oriented business, Vonage has transformed its business model to also capitalize on business-to-business markets, including healthcare and financial services. “We’re targeting industries with stringent compliance needs that require high levels of security,” Hybinette says. “To do that, we’ve made security part of our product life cycle development.”

For example, the company is currently working for certification by the HiTrust Alliance, a consortium of public and private healthcare entities that created a security-assurance framework for the industry. “HiTrust is an elite certification that we plan to use to leverage ourselves against the competition,” Hybinette explains.

Unfortunately, many enterprises worry that they’re not doing enough to secure their organizations. As previously noted, only 5% of the respondents consider their overall security capabilities to be market leading.

Figure 2. What are the most important reasons for maintaining a strong cybersecurity posture?

42%

32%

25%

41%

26%

32%

Avoiding financial losses associated with security breaches

Maintaining a strong brand/institutional reputation

Partners are more willing to integrate business systems with a secure provider

Customers are more likely to do business with a company that has a reputation for staying secure

Avoiding downtime in business-critical systems

Protecting intellectual property

Figure 1. Please describe the current state of your digital transformation

27%

18%

4%

22%

12%

17%

We are planning a digital transformation across the whole enterprise

We are digitally transforming specific departments or lines of business

We are not undergoing a digital transformation

We are undergoing digital transformation across the whole enterprise

We are planning a limited digital transformation

We have a digital transformation strategy for the enterprise but have not fully implemented across the business

Page 6: DISRUPT SECURITY - Forbes · 2018-02-06 · conducted by Forbes Insights and Juniper Networks. In fact, nearly half of the survey participants strongly believe that a reputation for

6 | DISRUPT SECURITY: BUSINESS INNOVATION WILL FALTER WITHOUT A MODERN SECURITY STRATEGY

The rest see themselves as no better—and sometimes worse—off than their direct competitors as they look at the volume of breach attempts and successful incursions everyone is facing. Whether or not executives are giving themselves enough credit for their security prowess, in this case perception is reality: These organizations aren’t sufficiently confident in their capabilities to promote them as reasons that customers should partner with them rather than their competitors.

Further attempts at digital transformation threaten to widen the security gap. In fact, a third of the executives say new business initiatives and emerging technology will require fundamental changes in their overall security strategy in the months ahead. The ever-expanding enterprise perimeter is one reason why. For example, mobile applications and hybrid clouds are part of larger enterprise ecosystems that stretch beyond corporate perimeters and make it harder for security teams to protect data.

The survey found that organizations feel challenged by new security threats brought about by mobile applications and hybrid cloud environments.

“Companies increasingly rely on complex digital ecosystems to connect in new ways with clients, customers and third parties, which introduces new vulnerabilities in supply chains and sales pipelines,” says Cameron Brown, a data-privacy lawyer, digital forensic investigator, and a project manager for the risk advisory practice at a global management consulting firm in Frankfurt, Germany.

As a result, while traditional security measures, such as anti-malware applications, employee training and intrusion detection/prevention systems, remain important, enterprises must do more. This means measures to better protect data outside the corporate perimeter and to provide for central, enterprise-wide oversight of the security environment. “The way most organizations think about security is not very innovative, while criminals have been extremely innovative when coming up with new attack methods,” says Rasmus Theede, director of technology at DigitalEurope, a consortium that represents the IT industry in the European Union. “Aside from some new technology advancements, the way

By fully securing new products and services, companies develop better offerings that can help them enter new markets they otherwise couldn’t enter.”

JOHAN HYBINETTEGLOBAL CISO, VONAGE

Figure 3. How would you rate your organization’s current cybersecurity capabilities?

5%

34%

6%

35%

19%

We are market leading

We are generally at parity with competitors

We are well behind our competitors

We are ahead in most areas

We are behind in some areas

Page 7: DISRUPT SECURITY - Forbes · 2018-02-06 · conducted by Forbes Insights and Juniper Networks. In fact, nearly half of the survey participants strongly believe that a reputation for

COPYRIGHT © 2017 FORBES INSIGHTS | 7

we’ve been thinking about security hasn’t fundamentally changed for years.”

How can enterprise leaders modernize their security posture? First, they must invest in new types of technology, such as SDN, which creates software-programmable networks designed to be more adaptable than traditional architectures. “SDN for security is getting more traction because it creates a greater level of visibility over what is happening across corporate networks,” says Carolyn Brown, who spent 12 years as a senior IT executive at a London-based global private equity company and recently became chief technology officer at the National Housing Federation, which represents nearly 1,000 housing organizations in England. “The old bricks-and-mortar approach to networks, with legacy switches and routers, made it harder for security staff to see whether there were any issues either with hardware or intrusion. By contrast, SDN is quite attractive thanks to the ability to configure settings according to what you’re seeing at any point in time in your networking environment.”

Also noteworthy in this context is the need for centralized visibility into today’s far-flung security operations. Twenty-seven percent of the survey’s respondents say security problems in modern IT environments are exacerbated by a lack of central visibility into all aspects of security operations, including mobile endpoints and partner networks. In addition, 22% say the inability to centrally enforce security policies across the enterprise has an extreme impact on their operations.

For their part, leaders—executives from organizations that are planning or undertaking enterprise-wide digital transformation and who rate their security capabilities as market leading—are ahead of these trends. In the coming year, a majority of them plan to expand their investments in resources for developing a centralized view into security vulnerability data, priorities and remediation actions, while 51% will adopt or expand their use of software-defined networks to enhance security. Fifty-three percent of leaders also say they added tools for gathering and analyzing security intelligence, well ahead of the next closest group of followers at 37%.

“We definitely see a gap between companies that are looking further down the road and moving ahead with things like centralized policy management, software-defined and cloud-based security, and automation compared to some companies that are just trying to manage the rise in security threats by adding more firewalls,” says Kevin Walker, security chief technology and strategy officer for Juniper Networks. “And we see a link between those companies who are more advanced and their improved financial performance.”

Figure 4. Please rate the following security challenges in terms of their level of impact on your enterprise today.

30%

22%

22%

26%

27%

27%

27%

27%

27%

25%

New security risks created by mobile business application

Lack of centralized enforcement of security policies across the enterprise

Shadow IT (technology used without the IT department’s oversight)

Applying security policies consistently in hybrid clouds (a blend of on-premise and public-cloud data center resources)

New and not completely understood threats created by Internet of Things (IoT) devices and other connected devices

Leaking of sensitive information via social media for business and personal interactions

Inability to consistently manage disparate products in a multivendor IT environment

Lack of direct control and oversight when data resides in public clouds and software-as-a-service applications

Lack of central visibility into all aspects of security operations, including mobile endpoints and partner networks

Deficiencies in our partners’ security policies

Page 8: DISRUPT SECURITY - Forbes · 2018-02-06 · conducted by Forbes Insights and Juniper Networks. In fact, nearly half of the survey participants strongly believe that a reputation for

8 | DISRUPT SECURITY: BUSINESS INNOVATION WILL FALTER WITHOUT A MODERN SECURITY STRATEGY

The lesson: If an enterprise isn’t already making intelligent investments in a new class of security capabilities, it’s time to catch up. That’s because leaders aren’t the only ones that will be taking action. In the overall survey sample, 51% of all organizations say they will expand security automation in the next year, while 45% will focus on enhancing predictive analytics, and 47% will capitalize more on threat intelligence. Software-defined networks and centralized management will also be important investment areas.

“With advanced analytics, enterprises can combine user profiles and insights into behavior to determine whether the people who are

“We definitely see a gap between companies that are looking further down the road and moving ahead with things like centralized policy management, software-defined and cloud-based security, and automation compared to some companies that are just trying to manage the rise in security threats by adding more firewalls.”

KEVIN WALKERSECURITY CHIEF TECHNOLOGY AND STRATEGY OFFICER, JUNIPER NETWORKS

Figure 5. Which of the following technology actions do you plan to take in the next year to better align security and business transformation? (Select all that apply)

Leaders Followers Developing LaggardsAutomate the application and enforcement of security policies for servers, networks, clouds and databases 58% 50% 54% 44%

Capitalize more on threat intelligence available from industry and global alliances to stay ahead of emerging threats 55% 48% 47% 35%

Use security solutions and/or services for predictive analytics 52% 45% 43% 40%Develop a centralized view into security vulnerability data, priorities and remediation actions 52% 46% 46% 34%

Adopt/expand our use of software-defined networks to enhance security 51% 41% 42% 34%

Investigate/implement security tools that use artificial intelligence and machine learning 43% 48% 47% 35%

Figure 6. Which of the following technology actions do you plan to take in the next year to better align security and business transformation? (Select all that apply)

51%

43%

45%

41%

Automate the application and enforcement of security policies for servers, networks, clouds and databases

Develop a centralized view into security vulnerability data, priorities and remediation actions

Use security solutions and/or services for predictive analytics

Adopt/expand our use of software-defined networks to enhance security

Page 9: DISRUPT SECURITY - Forbes · 2018-02-06 · conducted by Forbes Insights and Juniper Networks. In fact, nearly half of the survey participants strongly believe that a reputation for

COPYRIGHT © 2017 FORBES INSIGHTS | 9

engaging with them are in fact the people they purport to be,” says Paul Lewis, chief technology officer at Hitachi Vantara, a provider of technology and services for data analytics and Internet of Things platforms. “The fact that business is taking place in a much more distributed world means capabilities like these are critical.”

To predict and automatically detect cybersecurity attacks, a growing number of advanced analytics applications are incorporating machine learning. “It’s very hard for humans to protect IT systems 24/7,” says Sanjeev Kapoor, senior program manager for advanced technologies for digital transformation at a Big Three U.S. automaker. “Machine learning models enable organizations to use automated systems more effectively because they can proactively take action rather than waiting for anomalous behavior to become apparent. The security models are trained with historical data, and then based on that, they can keep an eye on what’s happening across the environment better than humans alone.”

But security experts warn that to ensure that new security investments will work effectively, organizations must also rigorously classify corporate data according to its criticality to the enterprise. This ensures that the proper levels of security resources can be applied to each piece of information. “The data classification process is critical for determining appropriate levels of control needed to preserve the confidentiality and integrity of information,” Cameron Brown says.

BEYOND TECHNOLOGY But successful coordination of innovation and security takes more than technology; closer collaboration between business and IT is also critical. “Ultimately, collaboration benefits enterprises by encouraging innovation, joint problem solving, rigorous testing and hardening of defensive systems, as well as the decentralization of knowledge,” EY’s Brown says. “When security teams and business units collaborate on projects, the enterprise realizes economic benefits associated with development and procurement of systems that are secure and meet business needs.”

High stakes make improvement essen-tial. For example, innovation creates new security risks and opens up organizations to financial harm, while 38% of the survey respondents say this breakdown makes companies less competitive.

But conflicting responsibilities and priorities drive a wedge between business and tech-nology stakeholders, according to more than a third of the respondents.

One way that leading companies are get-ting these two groups in sync is to include security checkpoints at each of the key development milestones for new business projects. “This ensures that the project won’t move to the next level unless the

Figure 7. What are the biggest barriers keeping the security and business teams from collaborating more closely? (Select the top two)

38%

27%

28%

28%

23%

17%

Business executives’ lack of sufficient security expertise

Lack of incentives to work more closely together

Business executives have outdated attitudes about the role of the security staff

Security teams’ lack of business expertise

Security leaders have outdated attitudes about their role in the organization

No clear mandate from CEO/board

Page 10: DISRUPT SECURITY - Forbes · 2018-02-06 · conducted by Forbes Insights and Juniper Networks. In fact, nearly half of the survey participants strongly believe that a reputation for

10 | DISRUPT SECURITY: BUSINESS INNOVATION WILL FALTER WITHOUT A MODERN SECURITY STRATEGY

security checks are met, so that security is embedded in the project before it’s fully deployed,” Kapoor says.

This offers a way of addressing business concerns that security bogs down transformation progress—business and security must work together to move their work forward.

Also pivotal to the success of collaborative initiatives between security and business units is the development of in-house subject matter experts to direct technical inquiries and respond to business needs. Vonage’s Hybinette did this by creating a new position within the IT department—a security liaison engineer. This individual becomes part of development teams and is charged with ensuring that security becomes embedded in new projects from the start. “The liaison works with the teams to learn what their technology and project needs are to find the best way to apply security,” he explains. “This collaboration is not only more productive from a development perspective, it breaks down the organizational silos that exist between teams, so the benefits are larger than just improving security.”

Others are taking similar approaches to changing how the security staff interacts with other departments. “Our CISO says he doesn’t want his group to be seen as the department of no,” says Anne Margulies, CIO at Harvard University. “Instead, our information security officers strive to be trusted advisors. So they work with our community of faculty, staff, and students to make clear why security is important and then find ways to make it easy for them to be as secure as possible.”

She says that’s a necessity since technology now underpins every core activity at Harvard, from teaching and learning to residential life and the university’s extensive research programs. “We have to earn the trust of our community, and work with them to have the right controls, privacy policies, and best practices in place to help protect their data and the individuals to whom the information belongs.”

To help do that, Harvard formed a faculty advisory council that meets each semester to discuss emerging security trends and solicit advice about how to better balance security and educational needs. “This is helping us to better understand what’s going to enable their work versus what’s going to be a barrier.”

Transformation veterans also note that conflicts between technology and business staffs aren’t the only cultural chal-lenges to overcome. Friction may also arise within the IT department. IT operations people and security staffs may clash as each department attempts to fulfill its core mission—maintain high levels of business continuity and uptime versus blocking a growing onslaught of breach attempts. “IT Ops will balk if a chief of security says a core system has to go offline for a couple hours for testing—how do you maintain 99.9% availability if you’re taking systems down?” says Theede. “On the other hand, software patches that would have stopped the WannaCry outbreak weren’t applied because systems weren’t taken offline for upgrades.”

To bring IT and operations staffs closer together, some organizations are organizing specialized training sessions. Classes are designed to help IT operations staff better understand security vulnerabilities, while also asking security people to prioritize security projects to reduce scheduled downtime as much as possible. “Many security people

“Our CISO says he doesn’t want his group to be seen as the department of no. Instead, our information security officers strive to be trusted advisors.”

ANNE MARGULIESCIO AT HARVARD UNIVERSITY

Page 11: DISRUPT SECURITY - Forbes · 2018-02-06 · conducted by Forbes Insights and Juniper Networks. In fact, nearly half of the survey participants strongly believe that a reputation for

COPYRIGHT © 2017 FORBES INSIGHTS | 11

overcomplicate matters by asking the IT operations staff to do a large number of things rather than focusing on the three most important upgrades to make in the immediate future,” Theede explains. “Organizations should focus on the one action they can take tomorrow to improve security, get it implemented, and then move on to the next area.”

To break down other organizational barri-ers, develop policies for engendering closer collaboration between IT/security and business/financial managers. When appro-priate, that also means involving CISOs in more C-suite and business discussions, something that’s already happening in many enterprises. The Forbes Insights/Juniper Networks survey found that 61% of enterprises will encourage CISOs to collaborate more closely with CFOs as new business initiatives are born.

Figure 8. Which of the following personnel/ organizational steps do you plan to take in the next year to more closely align security with business innovation? (Select all that apply)

61%

45%

48%

3%

CISOs and the security staff will work more closely with CFOs to secure new business initiatives

CISOs will become more involved with the C-suite and business decisions

The security team will become a strategic advisor for helping the business capitalize on the latest technology

We don’t plan to take any new steps

REGIONAL DIFFERENCES

While the overall survey results identified security as a source of competitive differentiation among enterprises today, regional breakdowns show differences in how executives view this area.

For example, enterprises in the Americas see the most direct link between security and market leadership, with nearly two-thirds of Latin American firms feeling most adamant about this area.

This helps explain why half of the Latin American executives plan to fundamentally change their security strategies in the months ahead.

To what extent do you agree with the following statements? – A reputation for industry-leading cybersecurity is a competitive differentiator in our market

North America Europe Asia-Pacific Latin

America

Completely disagree 1% 1% 1% 0%2 1% 4% 2% 2%3 12% 11% 16% 6%4 35% 40% 43% 29%Completely agree 50% 43% 38% 63%

Page 12: DISRUPT SECURITY - Forbes · 2018-02-06 · conducted by Forbes Insights and Juniper Networks. In fact, nearly half of the survey participants strongly believe that a reputation for

12 | DISRUPT SECURITY: BUSINESS INNOVATION WILL FALTER WITHOUT A MODERN SECURITY STRATEGY

Vonage’s Hybinette is part of this trend. “As CISO, I go on many sales calls and partici-pate in marketing events to spread the security message,” he says. “The job of CISO today is going beyond just being the security person.”

What measures will these and other executives be taking? To varying degrees, executives in each region are mirroring the investment plans of the leaders highlighted in the main report, although with some regional differences. The cross-section of firms will focus most heavily on automating the application and enforcement of security policies for servers, networks, clouds and databases. Capitalizing more on threat intelligence is another high priority. In addition, enterprises in Asia-Pacific will also target software-defined networking, while Latin American companies will investigate or implement security tools that use artificial intelligence and machine learning.

To what extent do you agree with the following statements? – Because of new business initiatives and emerging technology, we must fundamentally change our enterprise’s overall security strategy in the months ahead

North America Europe Asia-Pacific Latin

America

Completely disagree 1% 2% 1% 2%2 6% 8% 4% 4%3 17% 18% 18% 21%4 44% 41% 47% 23%Completely agree 31% 31% 30% 50%

Which of the following technology actions do you plan to take in the next year to better align security and innovation?

North America Europe Asia-Pacific Latin

AmericaCapitalize more on threat intelligence available from industry and global alliances to stay ahead of emerging threats

48% 45% 45% 56%

Investigate/implement security tools that use artificial intelligence and machine learning 45% 39% 39% 52%

Use security solutions and/or services for predictive analytics 47% 41% 47% 40%

Automate the application and enforcement of security policies for servers, networks, clouds and databases

57% 45% 45% 67%

Adopt/expand our use of software-defined networks to enhance security 36% 38% 50% 40%

Develop a centralized view into security vulnerability data, priorities and remediation actions

44% 39% 47% 42%

Page 13: DISRUPT SECURITY - Forbes · 2018-02-06 · conducted by Forbes Insights and Juniper Networks. In fact, nearly half of the survey participants strongly believe that a reputation for

COPYRIGHT © 2017 FORBES INSIGHTS | 13

As the security staff tries to make the business case for new investments, survey respon-dents acknowledge they’ll have to wrestle with a venerable problem: estimating the return on investment for proposed spending. Just 15% say ROI is highly quantifiable.

But this shows another advantage to becoming a leader in the innovation/security arena—34% of leaders consider ROI to be highly quantifiable. One way to demonstrate the payoff of investments is through uniform reporting mechanisms that use electronic dashboards to show results tailored for executive, managerial and oper-ational audiences. “These metrics should highlight how business needs are being met, how the threat landscape is being addressed with dynamic countermea-sures, and why certain security initiatives are being prioritised over others using key risk indicators,” Cameron Brown says. “Metrics like these will help show leaders the value the enterprise is deriving from security investments.”

Figure 9. How clearly can you assess the return on investment (ROI) for cybersecurity? (Select one)

6%

23%

56%

15%

We’re unable to accurately assess ROI

ROI is more anecdotal than quantifiable

We see a mix of quantifiable and anecdotal results

ROI is highly quantifiable

AN IMPERATIVE TO ACT In the months ahead, enterprises throughout the world will feel more pressure than ever to balance security and innovation, and do so with cross-disciplinary staffs that find the best ways to collaborate effectively. In addition to business imperatives, a growing number of regulations will push enterprises in this direction. For example, European Union organizations are now preparing for next year’s dead-line to comply with the sweeping General Data Protection Regulation (GDPR). “Dis-cussions about data and transformation projects will inevitably include questions about readiness for GDPR,” the National Housing Federation’s Carolyn Brown says. “The regulation has such punitive mea-sures behind it that boards are making this part of their agendas. That legitimizes the broader business role of security people.”

Another incentive: Failing to modernize security strategies with new technology, policies and staffing initiatives will leave organizations vulnerable to market insur-gents and hackers alike. Reasons include the fact that nearly half of executives

Figure 10. Looking ahead at the next two to three years, to what extent do you agree with the following statements?

41%

39%

39%

34%

32%

The volume and sophistication of cyberattacks will increase

The pace of business innovation will accelerate

Enterprises will embed security in innovation

Enterprises will increasingly see centralized man-agement as a critical component in cybersecurity

Mixed cloud IT environments, mobile applications and other evolving technologies will make it harder to manage cybersecurity

Page 14: DISRUPT SECURITY - Forbes · 2018-02-06 · conducted by Forbes Insights and Juniper Networks. In fact, nearly half of the survey participants strongly believe that a reputation for

14 | DISRUPT SECURITY: BUSINESS INNOVATION WILL FALTER WITHOUT A MODERN SECURITY STRATEGY

are bracing to see the volume and sophistication of cyberattacks increase, to which successful enterprises will respond by embedding security into their innovation endeavors.

The bottom line: Enterprises must take a fresh look at cybersecurity in an era of business transformation and make smart investments in technology, people and organizational structures to keep from falling behind aggressive competitors. To prioritize their actions, executives should look to a select group of leaders who have already taken steps to address the areas where new security gaps are most likely to arise:

• In the ever-expanding corporate perimeters, brought about by mobile applications and hybrid clouds, which loosen direct control over sensitive data

• In the shortfalls of traditional security technologies in modern IT environments

• In the lack of tools for central, enterprise-wide oversight of security status

How are leaders responding to these threats? They’re investing in new types of technology, such as SDN, and developing a centralized view into security vulnerability data, priorities and remediation actions. They’re also facilitating closer collaboration between business and IT teams and encouraging CISOs to collaborate more closely with CFOs at the start of new business projects.

In the process, these leaders are teaching perhaps the most valuable lesson of all: By closely coordinating inno-vation and security, enterprises can fuel profits, lower risk and optimize their investment returns.

Page 15: DISRUPT SECURITY - Forbes · 2018-02-06 · conducted by Forbes Insights and Juniper Networks. In fact, nearly half of the survey participants strongly believe that a reputation for

COPYRIGHT © 2017 FORBES INSIGHTS | 15

Forbes Insights and Juniper Networks would like to thank the following individuals for their time and expertise:

• Cameron Brown, Data-Privacy Lawyer, Digital Forensic Investigator, and Project Manager for the risk advisory

practice at a global management consulting firm in Frankfurt, Germany

• Carolyn Brown, CTO, National Housing Federation, London

• Johan Hybinette, Global CISO, Vonage

• Sanjeev Kapoor, Senior Program Manager for Advanced Technologies

for Digital Transformation at a Big Three U.S. automaker

• Paul Lewis, Chief Technology Officer, Hitachi Vantara

• Anne Margulies, CIO, Harvard University

• Rasmus Theede, Director of Technology, DigitalEurope

• Kevin Walker, Security Chief Technology and Strategy Officer, Juniper Networks

ACKNOWLEDGMENTS

Page 16: DISRUPT SECURITY - Forbes · 2018-02-06 · conducted by Forbes Insights and Juniper Networks. In fact, nearly half of the survey participants strongly believe that a reputation for

16 | DISRUPT SECURITY: BUSINESS INNOVATION WILL FALTER WITHOUT A MODERN SECURITY STRATEGY

ABOUT FORBES INSIGHTS

Forbes Insights is the strategic research and thought leadership practice of Forbes Media, a global media, branding and technology company whose combined platforms reach nearly 94 million business decision makers worldwide on a monthly basis. By leveraging proprietary databases of senior-level executives in the Forbes community, Forbes Insights conducts research on a wide range of topics to position brands as thought leaders and drive stakeholder engagement. Research findings are delivered through a variety of digital, print and live executions, and amplified across Forbes’ social and media platforms.

499 Washington Blvd. Jersey City, NJ 07310 | 212.367.2662 | www.forbes.com/forbesinsights

FORBES INSIGHTS

Bruce Rogers CHIEF INSIGHTS OFFICER

Casey Zonfrilli DIRECTOR, ACCOUNT MANAGEMENT

Tori Kreher PROJECT MANAGER

Todd Della Rocca PROJECT MANAGER

EDITORIAL

Erika Maguire EXECUTIVE DIRECTOR

Kasia Wandycz Moreno DIRECTOR

Hugo S. Moreno DIRECTOR

Alan Joch REPORT AUTHOR

Zehava Pasternak DESIGNER

RESEARCH

Ross Gagnon DIRECTOR

Scott McGrath RESEARCH ANALYST

SALES

North America Brian McLeod EXECUTIVE DIRECTOR

[email protected]

Matthew Muszala DIRECTOR

[email protected]

William Thompson MANAGER

[email protected]

Kimberly Kurata SALES EXECUTIVE

[email protected]

EMEA Tibor Fuchsel MANAGER

[email protected]

APAC Serene Lee EXECUTIVE DIRECTOR

[email protected]