Survey Reveals Growing Awareness of Need for De-Perimeterization Solutions
Jericho Forum, the international IT security thought-leadership group, recently released a survey of its chief information security officer (CISO) members, nearly 60 percent of whom responded, on the encroaching problem of de-perimeterization.
Collectively responsible for global revenue from Fortune 1000 companies exceeding $875 billion, 90 percent of the survey respondents were from global companies and 73 percent from companies with more than 10,000 employees; one-third of the respondents were American; two-thirds were European.
The objective of the survey was to understand what would be needed to battle against the perimeter erosion (de-perimeterization) that impacts companies conducting business in an open network environment. Half of those polled are currently implementing solutions to de-perimeterization. Respondents cited the combination of safe and timely collaboration with partners, vendors and others as the key reason to implement de-perimeterization strategies, and 75 percent agreed that implementing strategies to de-perimeterization would enhance a company's ability to meet its business objectives.
Top Survey Findings
• 82 percent of those polled said that the top hints for successfully implementing strategies for de-perimeterization included top management support and a strategy for security that maps to business objectives.
• While the survey results suggest that the CISOs believe numerous technology approaches are necessary for safe collaboration and successful commerce in Internet-based environments, it was evident that technologies like identity and access management, including authorization, are critical.
•Key challenges in implementing solutions for de-perimeterization include budget limitations, lack of security products built to interoperable universal standards driven by business demand, and lack of incentives and design drivers for tackling the new, Internet-driven environment.
Respondents said that they presently focus their security strategy on the following:
•Data security — 25 percent
•Application security — 15 percent
•Network boundaries — 10 percent
•Firewalls — 2 percent
•All of the above — 42 percent
•Other — 6 percent
"Like it or not, de-perimeterization is happening," said Paul Simmonds, global information security director for chemical giant ICI. "The choice is to do nothing, in which case we'll end up with costly, fragmented, Band-Aid type fixes; or to collectively define what needs to happen to address the issue, and end up where we need to be. There's no one solution, no single pill •that's why Jericho Forum is bringing together CISOs from global companies to create a strategies blueprint to help IT security teams choose the right long-term solutions for their individual company's business objectives."
Based on its research to date, Jericho Forum has developed a solution set blueprint titled "Collaboration Oriented Architecture" that focuses on the business advantages that companies can derive from being able to securely share data in a de-perimeterized environment. This blueprint is a work in progress.
"De-perimeterization strategies will allow us to be far more responsive to the realities of the rapidly changing requirements of the highly networked business. They will allow us to adapt security mechanisms to the way business works rather than throw up too many barriers. As a side effect they will allow us to strip out some of the heavier traditional security infrastructure and support costs usually associated with the large enterprise, redistributing the spend to better effect. We will be better able to define cost-effective and enforceable security policies that are appropriate for the risk appetite of the relevant areas of the business, as opposed to the historic 'one size fits all' approach," said John Meakin, group head of information security, Standard Chartered Bank. "I think the biggest benefit of de-perimeterization is that it brings the practice of risk management into sharp focus by removing the false sense of security provided by the traditional enterprise 'safety blanket,' ultimately resulting in the right level of security for a given business situation."
According to Simmonds, while Europe is already moving into implementing solutions to de-perimeterization, the U.S., which drives the computer technology industry, is also now looking at solutions that take them beyond the "hardened" perimeter approach that is counterproductive to collaboration. But, with customer companies such as Proctor & Gamble, Johnson & Johnson, Boeing, and Eli Lilly members of Jericho Forum, vendor companies like Motorola, HP and IBM have also joined the think-tank team to jointly investigate de-perimeterization and its solutions in an open environment.
Although Jericho Forum is dedicated to making the group's output "open source," the aim is that vendor companies will exploit the findings to create and evolve their own products.