1. 1.18.2017 | Data Connectors: Atlanta, GA
Mind the Gaps: Leveraging “Security as a Service” to Gain Cyber Advantage
| Data Connectors: Atlanta, GA
Alex Knight, Director of Security Product Strategy |

2. An expanding perimeter with more points of vulnerability,
Technology Continues to
Open Up New Frontiers
“Internet of Things” connected sensors and monitors
Cloud storage and infrastructure
Mobile access
“Shadow IT” implementation of SaaS business applications
More points of vulnerability, more surface area for attacks, global accessibility
An expanding perimeter with more points of vulnerability,
more surface area for attacks, offering global accessibility
© ControlScan 2017

3. These gaps are further manifested in survey after survey…
We’re Creating Gaps in
Our Ability to Protect Data
Technology adoption is outpacing security and compliance
Attackers are evolving and innovating as fast or faster
We struggle to keep up with the basics
Gaps are forming between what’s truly required to maintain security and…
What is typically in place
What can realistically be maintained
These gaps are further manifested in survey after survey…
© ControlScan 2017

4. Security Threat Management”
“The Current State of
Security Threat Management”
Lack of internal resources and insufficient budget are preventing IT teams from creating a strong security posture for their organizations
What does this mean?
52%
1/3
62%
of in-house IT teams do not include an information security professional
have the same security budget this year that they had in 2015 – and 2014
feel their organization's security-related investments are not sufficient for their business's level of risk
“Just not enough technology or knowledge.”
52%
29%
48%
are attempting to monitor security logs in-house (without in-house security expertise)
aren’t monitoring their logs at all
are trying to conduct their own security risk assessments
© ControlScan 2017

5. Spotting the Gaps Before
You’re Tripped by Them 1
Eyes on Security : incorporating security into “business as usual” 2
Access to Expertise : on-the-spot experience and knowledge 3
Best Practices, Proven Processes : consistent, predictable execution 4
Defense in Depth : belts and suspenders for your infrastructure security 5
Adaptability : rapid response in the face of new threats and internal changes 6
Financial Flexibility : flexibility in executing a security & compliance strategy
© ControlScan 2017

6. The Results of Gap Inaction and Indecision
Breaches of sensitive data
Disruption/distraction within operational areas
Unbudgeted costs to remediate/recover
Fines levied for contractual/compliance violations
Complex efforts to recover
Ongoing, closer scrutiny
Erosion of brand name and customer confidence
© ControlScan 2017

7. Leveraging Security As A Service
© ControlScan 2017

8. Eyes on Security 1 2 3 Continuous security monitoring
Time for discovery and response 3
Leveraged insight across multiple environments
© ControlScan 2017

9. Access to Expertise 1 2 3 Security hiring challenges continue to grow
Opportunities for experts-on-demand 3
Requirements for ongoing training & development
© ControlScan 2017

10. Best Practices; Proven Processes
Best practices surfaced from industries and frameworks
Predictable deployments
Consistent operations
SLA-backed reporting
© ControlScan 2017

11. SIEM Defense in Depth Directory Services Data Management Security
MSSP Sec Ops
Directory
Services
Data
Management
Security
Network
Physical
Multi-layered defenses
More challenging for the attacker; contingency when a layer fails
Layers as “services” often easier to add or shift
Firewall
Active Directory
Routers
Data Loss
Spam
Alarms
IPS
Data in Motion
Malware
Switches
Users
Malware
Surveillance
WAF
Access Control
Wireless
Groups
Data at Rest
Phishing
End Point
© ControlScan 2017

12. Adaptability Leveraging best-of-breed solutions
Expansion & refinement of in-place solutions
Taking advantage of latest features/functions in solution upgrades
Overall elasticity of solution to manage environmental growth and change
© ControlScan 2017

13. Financial Flexibility
Procured Internally
Year 1
Year 2
Year 3
Total
Hardware purchase
$1,995
Software license
$1,333
$3,999
Annual maintenance
Staff ($120k, 2%)
$2,400
$7,200
Training
$300
$900
Total:
$14,094
MSSP
Year 1
Year 2
Year 3
Total
Installation & setup
$250
Service subscription fee
$2,400
$7,200
Total:
$7,450
© ControlScan 2017

14. So What’s the Downside? Cost perceptions
Trust issues (parallels with cloud computing)
Loss of control
Potential loss of internal SME/competency over time
Hard to bring back in house
MSSP understanding of internal culture/dynamics
More limited choices in technology
© ControlScan 2017

15. Consider This When Selecting a Partner1
Competence in Security + Compliance : They should be considered in tandem 2
Certifications : Proof points for ongoing investment in education & development 3
Flexibility : Willingness to adapt solutions to your business vs. one size fits all 4
Holistic : Lifecycle support from “Identify” to “Recover” 5
Balanced : Solutions supporting both “Protect” and “Detect”
© ControlScan 2017

16. Thank You Alex Knight Visit Us At:
Director of Security Product Strategy P:
11475 Great Oaks Way
Suite 300
Alpharetta, GA 30022
controlscan.com
Visit Us At:
Be Social With Us!
© ControlScan 2017