Content Security For The Next Decade

Content security for the next decade The security service and products opportunity for resellers

Bob Tarzey, Service Director Quocirca Ltd

Partner conference – Nov 7th 2008

Agenda     

The need for content security The resellers dilemma The risk landscape Security policy for the business Technology - problem and solution

© 2008 Quocirca Ltd

2

Agenda     

The need for content security The resellers dilemma The risk landscape Security policy for the business Technology - problem and solution

© 2008 Quocirca Ltd

3

The IP revolution

“For small business and office departments Windows 95 will support about 20 PCs working together”

Not a new problem 1980s

Corporate IT Firewall

Print and fax

2008

FTP Email Web

IM Blogs, wikis, RSS Social networks/ virtual worlds

Number of employees

Use of laptops

Percentage of laptops 1,200 European and US small and mid-sized businesses, 2006

Number of employees

Use of mobile devices

Employee use of mobiles to access IT 1,200 European and US small and mid-sized businesses, 2006 © 2008 Quocirca Ltd

7

Data, information or content Content generators

Create data and information © 2008 Quocirca Ltd

8

Agenda     

The need for content security The resellers dilemma The risk landscape Security policy for the business Technology - problem and solution

© 2008 Quocirca Ltd

9

The resellers dilemma

Italy Spain France Germany USA UK Canada 0%

20%

40%

General IT

60%

80%

100%

Security specialist

Research by Quocirca 2006 – types of reseller 600 reseller managers (400 Europe, 200 US/Canada) With security products in their portfolio © 2008 Quocirca Ltd

10

Revenue from IT security products and services?

10% 30% 50% 70% 90% Don't know

20% 40% 60% 80% All

Research by Quocirca 2006 – types of reseller 600 reseller managers (400 Europe, 200 US/Canada) With security products in their portfolio © 2008 Quocirca Ltd

11

Primary reseller target markets

Enterprise Mid-market SMB Small business Public sector SOHO Consumers

Research by Quocirca 2006 – types of reseller 600 reseller managers (400 Europe, 200 US/Canada) With security products in their portfolio © 2008 Quocirca Ltd

12

How strongly do you agree with the following statements?

0%

20%

40%

60%

80%

100%

Security specialists will always be needed Points solutions are best for new threats

Infrastructure vendors do not have skills IT security will become embedded 5 – Strongly agree

4

3

2

1 – Completely disagree

Research by Quocirca 2006 – types of reseller 600 reseller managers (400 Europe, 200 US/Canada) With security products in their portfolio © 2008 Quocirca Ltd

13

Impact of Microsoft entering IT security market Which statement most closely matches your view? Will continue to source IT security products from current partners Will make use of Microsoft security capabilities where we can Will continue to buy from existing suppliers when Microsoft capability is inadequate We consider that Microsoft can now cover most of our customers’ IT security requirements

0%

10%

20%

30%

40%

Research by Quocirca 2006 – types of reseller 600 reseller managers (400 Europe, 200 US/Canada) With security products in their portfolio © 2008 Quocirca Ltd

14

Where do resellers sell?

Local

National

International 0%

20%

40%

60%

80%

100%

Local expertise is a critical value add Local language Local applications Local culture © 2008 Quocirca Ltd

15

Agenda     

The need for content security The resellers dilemma The risk landscape Security policy for the business Technology - problem and solution

© 2008 Quocirca Ltd

16

Nationwide – just a laptop theft?

FSA fine: £980K

© 2008 Quocirca Ltd

17

Cost of data breach

Direct

Indirect

Theft Fines

Reputation Customer loss Share price

© 2008 Quocirca Ltd

18

Indirect costs – bad publicity

Scientist takes secret designs to competition

© 2008 Quocirca Ltd

19

Compliance and disclosure Government and EU regulations

US and other non-EU regulations

Industry regulations

Miscellaneous Non-Disclosure Agreement Software Licence Agreement

© 2008 Quocirca Ltd

20

The main sources of data leaks

Internal - Employee carelessness/stupidity and/or poor policy

Internal – Employee malice © 2008 Quocirca Ltd

External – Malware – spyware, phishing, Pharming etc.

External – Hackers

21

Causes of leaks – mostly internal

Employee oversight Poor business process Manager approved Malicious Other

Source, Symantec, Risk Assessment Findings, 2008 © 2008 Quocirca Ltd

22

Do employees implement back door solutions for IM, VoIP, web conferencing etc. 0%

10%

20%

30%

40%

Definitely Probably Possibly

No Don't know

Source, Superhighway at the Crossroads –Quocirca, September 2008 © 2008 Quocirca Ltd

23

Use of Web 2.0 technologies in businesses

Heavily Moderately Sparingly Not at all

© 2008 Quocirca Ltd

Source, Quocirca, Why Application Security is Crucial, March 2008

24

Policies and technologies for Limiting or blocking use

Yes

Working on creating them No

Source, Quocirca, Why Application Security is Crucial, March 2008 © 2008 Quocirca Ltd

25

Ignoring the insider threat

Desire to trust

Provide access

Weak policy Deny

© 2008 Quocirca Ltd

Avoid bad press

26

Malice Money Coercion Ideology

Oct 2005 © 2008 Quocirca Ltd

27

Number of organisations worldwide targeted by phishing attacks by month (March 2006 to June 2008)

Source, MarkMonitor – October 2008 © 2008 Quocirca Ltd

28

Hacking

© 2008 Quocirca Ltd

29

Agenda     

The need for content security The resellers dilemma The risk landscape Security policy for the business Technology - problem and solution

© 2008 Quocirca Ltd

30

The need for policy

Policy should: 1. Aim to prevent breaches 2. Detail how breaches are handled 3. Be reviewed date in light off • New technology • New legislation • New business processes

Services opportunity • • © 2008 Quocirca Ltd

Precede technology Justifies technology investment 31

Aim of policy

To define how people

Handle content

© 2008 Quocirca Ltd

32

Percentage saying external users are provided access to internal systems 0%

20%

40%

60%

80%

Finance Utility

Telecomms and Media Public Sector

Retail Industrial

Healthcare Contractors

Partners

Suppliers

Customers

Source, Quocirca, The Distributed Business Index, March 2008 © 2008 Quocirca Ltd

33

Standard starting points

ISO 27001

© 2008 Quocirca Ltd

34

Agenda     

The need for content security The resellers dilemma Security policy for the business The risk landscape Technology - problem and solution

© 2008 Quocirca Ltd

35

Consequences for IT security

Security

People Content

Servers and end points

Network Time © 2008 Quocirca Ltd

36

A world of risk – the need for content-filtering

Insider Corporate boundary

Outsider

© 2008 Quocirca Ltd

37

The encryption conundrum The right data needs to easy to share, with the right people and at the right time

© 2008 Quocirca Ltd

38

Managing end-points User access devices

© 2008 Quocirca Ltd

USB Mania

39

End of life

© 2008 Quocirca Ltd

40

DLP – data leak prevention

Print USB

SMTP

Policy

FTP

Web 2.0 Web Mail

© 2008 Quocirca Ltd

Blogs

HTTP

41

Conclusion Back to the resellers dilemma The content security opportunity Businesses feel a threat

They need help to understand the threat and policies to mitigate They need advice on the best technology to achieve this

© 2008 Quocirca Ltd

42

Conclusions

Thanks, this presentation will be available on www.quocirca.com

Thank you Bob Tarzey Quocirca www.quocirca.com

© 2008 Quocirca Ltd

43