IANS Research Team: Personalizing Enterprise Assets - The Limits

All of a sudden this month the security implications of the “power to the people” revolution are coming into focus. More and more Ask an Expert research queries from client security teams are centering on securing one of three new security vectors:

1. Unsanctioned, personal wireless devices (e.g  smartphones) accessing network assets of all types. POPing email is the most common; sensitive asset access the most concerning.
2. Workers using social networking resources on company time, for what they deem appropriate job-related reasons
3. Rogue cloud computing applications that are being requisitioned by well-intentioned business unit managers “because it’s so easy and cheap.”

 The IANS research team is working on a Point of View (POV) report that will explore the technical, policy, and privacy issues this movement is continuing to raise.

We recently completed the one-day gathering of members participating in our Security Maturity Benchmarking study, and it was quite the eye-opener. 

 A few of the highlights:

1. Benchmarking your team’s maturity against relevant peers is viewed by CISOs as the best way to make the resource/budget case with senior management
2. High-performing IT security teams have adopted a “service delivery” model internally to accurately reflect to business units the value of security
3. The optimal organization structure chosen by high-performing IT security teams is a small centralized operation (SOC) with dotted-line reports out in the operating divisions.  These agents live inside the business, but enforce the standards set by central command.

Finally, we’re seeing a stronger and stronger interest in the GRC (Governance, Risk & Compliance) space as more CISOs are seeking a true risk management measurement tool to centralize the view of organizational risk.

We’ll host an Interactive Phone Conference on the topic on August 6.