Introduction
At Infosec Europe, the security market converged. Many new and advanced security solutions and products were showcased, we spent time with top security professionals and organisaitons and discussed the heading of computer security. In this article we will cover some of the predictions and discuss the predicted from last years Infosec.
Last year we visited Infosec and my view was that the market would consolidate, that passwords are obsolete and that endpoint encryption, Data leakage Prevention and application layer firewalls would be the future.
This year, without exception, all of the above elements have come to fruition. Passwords are now considered obsolete and many organisations are realising that two factor authentication is a must. Tokens both physical and logical have become prolific. Soft tokens seem to be making a break from the hard tokens, the soft tokens seem to be easier to deploy, cheaper, logistically easier to integrate and remotely install and distribute to the whole estate compared to hard tokens. Hard tokens have the benefit of being something the user physically has.
The multitude of token vendors seems to have consolidated and been incorporated into the larger security vendors. The smaller token vendors have mostly moved on and have not survived the stiff market, whereas the traditional tokens have just become stronger brands and trimmed on price in an effort to adapt to the market conditions.
Data Leakage Prevention (DLP) and Data Protection have come a long way in a year, again these applications have also been part of the security industries consolidation process and most security vendors now have a solution. In the UK device encryption is being driven by compliance, in turn global companies based in the UK and US have started encrypting the endpoint deploying DLP at mass, this has developed the market in this space and vendors have become more competitive.
Encrypted USB devices
Last year you would struggle to find a good solution to encrypt a USB device, this year at the show there were many companies selling encrypted USB devices, some companies had good solutions and others did not. One thing stood out, the price of the technology was expensive. It was in most cases 10 times the price of an ordinary drive. Soon Hard drive manufactures will realise this and embed the technology into the chipset and most of the sprouting vendors we saw will disappear.
The economic downturn
Because of the economic downturn, most of the companies attending had one thing in mind. Find a technology that will save me money. This was evident in many areas as the displays this year were fractions of what they were previously. Giant vendors did not splash out on freeware and most of the stands had little marketing material. It was almost like the vendors knew that customers were not spending and they were just at the show to have a presence.
Cloud computing was a focus of the show as many vendors showcased their solutions around this technology. Some of the top security professionals were making the point that cloud technology was not new and that the whole cycle is where we were a few years ago with mainframe, now the web is larger and more geographically disperse. The fact is that there are two forms of cloud, public and private and many organisations are choosing the between the offerings, or a hybrid of both.
The reduced security budgets, summoned the usual suspects. Antivirus vendors were there at mass, and were trying hard to differentiate themselves between each other by throwing in extra features or extra products. It really seemed like security was being commoditised. We all know this is difficult to do as the solutions have many variants and often end up being heavily customised, and this requires skill.
The customer is king again and now are faced with many choices as security vendors are mostly finding it difficult to extract extra spend from the already restricted budgets.
Areas of spend
The multitude of customers I spoke with identified a few areas of spend that they were not cutting back.
Outsourcing seemed to have come back into most organisations vocabulary, the one organisation had let go over 60 people, the IT department being reduced to a handful of people to service thousands of users. This drastic reduction was noticed by the CSO and he was at the show to find solutions to his problem.
Other customers were looking for unified threat management, that would cut costs by means of easy management, quick deployment and that met the compliance criteria that PCI DSS had imposed.
Some customers were focusing on cloud solutions and content filtering that could help them reduce bandwidth costs and increase productivity. I spoke with these customers and got involved in some discussions with vendors to gauge the solution against the requirement. A good number of the solutions met the requirements but I recognised the reluctance to spend on the controls prescribed.
Two factor authentications seemed to be a strong theme as the multitude of token vendors paraded their wares. The theme this year seemed to be cheaper, simpler more deployable solutions so soft tokens seemed to be gaining the traction.
Pen testing and remote scanning seemed to be doing its rounds at the show as the larger vendors made statements of how the sky was falling. I smiled as I walked past the large PCI DSS scanning vendor and read the remarks of how insecure everyone that did not buy their product was. I remember thinking to myself desperate times leads to desperate statements.
Data Protection seemed to be the biggest area of spend this year with many customers buying into the device control, data leakage prevention and the encryption control market. Customers seemed to gravitate towards the larger vendors and I noticed some niche players trying really hard to keep in the game. Healthy competition is always a good thing as it helps the customer and keeps the pricing sane.
Mobile device protection seemed to be a consistent theme emerging and many customers were asking for solutions that could help them with the management of mobile devices other than laptops. Mobile phones, USB and removable media and other like technologies were high on the list.
The positives
The good thing that I observed were that vendors were more than happy to help and the customer seemed to be getting a better deal for their money.
The impressive thing about the show was how the focused vendors were still around and how the others looked like they were falling to pieces. All the main brands that we know and trust seem to be doing ok and I can bet that customers are now thanking their lucky stars that they went with these brands rather than backing dying horse. I think that this is a positive thing as it keeps the market healthy.
It looked to me like companies were only aiming to keep the security solutions operational and were trying hard to avoid spend. I did however notice that most CSOs at the event were becoming enthused by the dropping prices and the consolidated approach that the larger vendors were offering.
Lookout for computers that can update themselves even when they are remote and unattended, new remote control technologies are evolving and making this possible and will be built into the chipset shortly.
Summary
The global recession has begun to sink its teeth into the security sector in Europe, it is evident that only the strongest of companies will survive this storm. Most security roles are still required and certainly the controls are now even more required as people become more desperate. It seems like the security industry will go through even more consolidation and the result will be even stronger products and a lesser cost. This market correction can mean only one thing, what goes down will one day go up…
