Enterprise Security
In enterprise security investment, more emphasis has been put on post breach detection and incident response for this passing year. We will see this trend continue in 2017. Technologies in the area of breach detection, data leak protection, remediation, and so forth, are focusing on the full cyber kill chain rather than an isolated attack stage. This is turning the traditional perimeter defense into a defense in depth architecture. This is especially important in today’s IT infrastructure dealing with blurred network boundaries and increased mobility. In the same vein, existing technologies are also maturing. For example, behavior analysis and sandbox technologies are becoming more mainstream and integrated with existing solutions. Another continuation of trends from the past year is data-centric security. Since data loss is one of the most serious consequences of security breaches, and data security is high on the list for regulatory compliance, enterprises will continue to put more investment in this area to secure critical data through its lifetime.
Security for IoT
IoT security moved from talking point to reality in 2016 and we will see more of it in 2017. The recent DDoS attack on Dyn involves a botnet that included a large number of IoT devices such as webcams, routers and streaming media devices. These devices are perfect bots for several reasons: First, many of these devices are designed for consumers, and ease-of-use is the top priority and in many cases, little or no security is implemented. Secondly, users of these devices are more diverse and many are not sophisticated in information security. Last but not least, once compromised, the breach is hard to detect because of the limited user interaction (so called screen-less devices). As the quantities and variety of IoT devices will drastically increase and surpass computers and mobile phones, we will see growing impact from these devices in security incidents. We will also see more ways for hackers to turn the unique capabilities of these devices into financial gain.
Security for Cloud
In 2016, we see continuous build-up of hybrid cloud deployments by enterprises and this trend will continue in 2017. This is driven by familiarity and economics of public cloud, while at the same time a persistence of perception that there is a lack of comparable security in the cloud with that of on-premises implementations. In 2017, we will see more adoption of tools that help enterprises manage security across hybrid cloud. Also for this passing year, enterprises have seen increased numbers of cloud related incidents and were using their cloud security investments to address these problems. Visibility is continuing to be critical in understanding security gaps in the cloud. In addition, we will also use tools that ease management problems across heterogeneous cloud deployments, with policy enforcement, identity and access, monitoring and behavior analysis as some of the foci. On another front, enterprises are in different stages of exploring container technology. While we are seeing companies implement security in development and deployment processes, implementing sophisticated security in operations will still not be a top priority for some time.
Security for Mobile Payment Systems
Mobile payment system is gaining popularity and Gartner predicts that 50 percent of consumers in mature markets will use mobile payment by 2018. Most mobile payment systems require linking a personal bank account or credit card for direct charges. Today, the level of security of mobile devices are not on par with computers and they are easier to hack and, therefore, breaches are harder to detect. A compromised mobile terminal may leak confidential information related to these accounts or allow unauthorized charges to these accounts. Today, financial institutions are relying on limiting transaction sizes and transaction fraud detection for security purposes. Over time, we will see hackers coming up with new ways to defraud the system.
