- Email: [email protected]
Symantec CEO Enrique Salem calls for automated information security
RSA
Recession hits small infosec companies hard say experts Despite the need for security being exaggerated in an economic downturn, smaller IT security companies will suffer, says Dave Hansen, Corporate SVP &GM Security Business Unit at CA, speaking to Infosecurity at the RSA conference in San Francisco. The larger and more dominating industry vendors, says Hansen, will “not be hurt by the recession”. Having previously implied only six or seven ‘super players’ in the industry - in which Hansen included CA - this leaves hundreds of vendors vulnerable to the recession. “The current economic downturn is not killing us”, says Hansen. “The small companies though, have a big problem, and many will be making their last stand at this year’s RSA conference. The smaller companies are wandering around the show looking to be acquired by bigger players, like CA. It’s kind of sad” said CA’s Hansen. “While there is VC money available, there is currently a decline in start-ups” said Hansen. “People are more risk adverse during a
recession. Customers are more wary of who they are buying from – less inclined to take a risk with smaller, lesser-known companies”. Rick Caccia of ArcSight told Infosecurity that he too feared for the smaller companies in the information security industry. “It’s a tough time” he said. “The problem is, private companies can claim big profits and large growth, but you can’t be sure how much truth there is in it. ArcSight however, are a public company. Everyone can see that we’re growing healthily”. While vendors exhibiting at the show were all keen to share their success and growth with show attendees, the exhibition hall was notably quieter than previous years. Despite the economic downturn, CA’s Hansen shared results from CA’s research report which indicates that 42% of respondents said they would spend more on security in 2009, and 50% suggested they would spend the same.
Symantec CEO Enrique Salem calls for automated information security In his keynote at RSA, Symantec CEO Enrique Salem called for a significant shift in the way vendors and end-users approach information security. Change, said Salem, is needed to fight the current targeted threat landscape. Salem’s primary message to his audience was that of automation and risk-based, information-centric security. “The current security model isn’t working - it’s time for us to operationalise security, it puts you in control” said Salem. “Information protection is the most important lesson for organisations”, he continued. “Security practitioners are tired of working with different point products – they want to be able to respond and remediate threats very quickly through automation, which many don’t have today” said Salem. “We have to bridge the gap between security and everyday IT operations. Security needs to be more pro-active and more measurable”. Symantec’s Salem spoke about the ‘cat and mouse’ game that the vendors are playing with the hackers. “In 2008 we saw 1.6 million new signatures being created. This pales in comparison to the amount of
Enrique Salem, speaking in San Francisco in April
threats we’re seeing every day...Attackers are shifting their attacks – using micro-distribution to target individuals to steal their information”. “Protecting information becomes harder as the environment becomes more complex. Employees are also starting to bring their own devices into their work environment. How can you virtualise the environment while driving security?” continued Salem. Salem said that IT teams must apply a risk-based, informationDFOUSJD SFTQPOTJWFBOEXPSLĄPXESJWFOBQQSPBDIUPTFDVSJUZ FWFO more essential considering that many computing environments are moving to the cloud. “Measuring risk before automatically applying the appropriate policies and processes to deal with them will save companies money, and thus become more effective”, advised Symantec’s Salem. “Companies shouldn’t have to choose between productivity or security – it shouldn’t be an either/or situation” said Salem. Salem suggested that Symantec and other vendors should work together to develop standards and share best practices surrounding risk management. This echoed head of RSA, Art Coviello’s sentiments as expressed in his opening keynote. Symantec’s CEO also suggested that government adhere to this change. “We need our new administration to operationalise security at the federal level. We need a cybersecurity person in charge of cyber security reporting in to the president”. “You can absolutely operationalise security – you need to create a culture of confidence and allow your business to grow and thrive. Put the right policies in place to work for you and be in control. We have to operationalise security”, Salem concluded. Salem took over for former Symantec chief executive John Thompson on April 4. For more show coverage – from both RSA and Infosecurity Europe – visit www.infosecurity-magazine.com.
MAY/JUNE 2009
15
Recession hits small infosec companies hard say experts Despite the need for security being exaggerated in an economic downturn, smaller IT security companies will suffer, says Dave Hansen, Corporate SVP &GM Security Business Unit at CA, speaking to Infosecurity at the RSA conference in San Francisco. The larger and more dominating industry vendors, says Hansen, will “not be hurt by the recession”. Having previously implied only six or seven ‘super players’ in the industry - in which Hansen included CA - this leaves hundreds of vendors vulnerable to the recession. “The current economic downturn is not killing us”, says Hansen. “The small companies though, have a big problem, and many will be making their last stand at this year’s RSA conference. The smaller companies are wandering around the show looking to be acquired by bigger players, like CA. It’s kind of sad” said CA’s Hansen. “While there is VC money available, there is currently a decline in start-ups” said Hansen. “People are more risk adverse during a
recession. Customers are more wary of who they are buying from – less inclined to take a risk with smaller, lesser-known companies”. Rick Caccia of ArcSight told Infosecurity that he too feared for the smaller companies in the information security industry. “It’s a tough time” he said. “The problem is, private companies can claim big profits and large growth, but you can’t be sure how much truth there is in it. ArcSight however, are a public company. Everyone can see that we’re growing healthily”. While vendors exhibiting at the show were all keen to share their success and growth with show attendees, the exhibition hall was notably quieter than previous years. Despite the economic downturn, CA’s Hansen shared results from CA’s research report which indicates that 42% of respondents said they would spend more on security in 2009, and 50% suggested they would spend the same.
Symantec CEO Enrique Salem calls for automated information security In his keynote at RSA, Symantec CEO Enrique Salem called for a significant shift in the way vendors and end-users approach information security. Change, said Salem, is needed to fight the current targeted threat landscape. Salem’s primary message to his audience was that of automation and risk-based, information-centric security. “The current security model isn’t working - it’s time for us to operationalise security, it puts you in control” said Salem. “Information protection is the most important lesson for organisations”, he continued. “Security practitioners are tired of working with different point products – they want to be able to respond and remediate threats very quickly through automation, which many don’t have today” said Salem. “We have to bridge the gap between security and everyday IT operations. Security needs to be more pro-active and more measurable”. Symantec’s Salem spoke about the ‘cat and mouse’ game that the vendors are playing with the hackers. “In 2008 we saw 1.6 million new signatures being created. This pales in comparison to the amount of
Enrique Salem, speaking in San Francisco in April
threats we’re seeing every day...Attackers are shifting their attacks – using micro-distribution to target individuals to steal their information”. “Protecting information becomes harder as the environment becomes more complex. Employees are also starting to bring their own devices into their work environment. How can you virtualise the environment while driving security?” continued Salem. Salem said that IT teams must apply a risk-based, informationDFOUSJD SFTQPOTJWFBOEXPSLĄPXESJWFOBQQSPBDIUPTFDVSJUZ FWFO more essential considering that many computing environments are moving to the cloud. “Measuring risk before automatically applying the appropriate policies and processes to deal with them will save companies money, and thus become more effective”, advised Symantec’s Salem. “Companies shouldn’t have to choose between productivity or security – it shouldn’t be an either/or situation” said Salem. Salem suggested that Symantec and other vendors should work together to develop standards and share best practices surrounding risk management. This echoed head of RSA, Art Coviello’s sentiments as expressed in his opening keynote. Symantec’s CEO also suggested that government adhere to this change. “We need our new administration to operationalise security at the federal level. We need a cybersecurity person in charge of cyber security reporting in to the president”. “You can absolutely operationalise security – you need to create a culture of confidence and allow your business to grow and thrive. Put the right policies in place to work for you and be in control. We have to operationalise security”, Salem concluded. Salem took over for former Symantec chief executive John Thompson on April 4. For more show coverage – from both RSA and Infosecurity Europe – visit www.infosecurity-magazine.com.
MAY/JUNE 2009
15