Security is the top IT priority for CIOs : Shrikant Shitole, Symantec

What is the current state of enterprise security in India in key sectors such as financial services, transportation, communications, mining, electricity, and oil & gas? What is the cost of security threat to an organization?

According to Symantec’s Internet Security Threat Report (ISTR. 20), despite stepping up their information security measures, businesses in India continue to be an attractive target for cybercriminals. In 2014, 60% of targeted attacks were aimed at large enterprises in India. Amongst these enterprises, key sectors such as financial services (17.1%; up from 11.1% in 2013) have continued to receive targeted attacks, however emerging industries like non-traditional services (40.5%; up from 39.92% in 2013) along with transport and communications (4.4%; up from 0.8% in 2013) have also seen a quantified increase in targeted attacks. Globally, five out of six big businesses had been targeted for attack, a 40% increase over the previous year.

Data breaches of a large scale and nature send companies back into the pre-computer era, trickling down too many aspects of the business. Employee productivity declines, customers are lost, operations can be severely hindered and the cost of restoring systems is high. That is just internal impact—companies also deal with lawsuits and non-monetized factors, like brand reputation. Depending on the severity of the attack, it can cost a company anywhere from tens of thousands, to tens of millions. With security pros facing a rapidly changing threat environment, one thing is clear: Today’s solutions aren’t cutting it. Advanced attacks are on the rise and security professionals using a myriad of individual point products to stop them are at a disadvantage. To address this, Symantec, the global leader in cyber security, recently introduced Symantec Advanced Threat Protection (ATP), the first solution that will allow enterprises to uncover, prioritize and remediate advanced threats and zero day attacks fast, all without adding any new endpoint agents to thwart these threats.

Which are the major factors influencing enterprise security budget allocation?

The information security space in India in the past couple of decades has seen a significant change as cyber attacks have got more complex and sophisticated. At the same time businesses too have realized the importance of cyber security. Securing critical assets like data, intellectual property and customer credentials is one of the biggest responsibilities for any enterprise—more importantly due to the growing number of high-profile security breaches. Cyber attack is among World Economic Forum's top global risks indicating that it is no longer an issue that concerns only IT and security professionals, but is also an important topic for boardroom discussions. Therefore, CIOs have started focusing on Security as a top IT priority. In fact, security spending (hardware, software, and services) in India is expected to grow to $1.23 bn in 2016, up from $1.11 bn in 2015, according to Gartner.

Data breaches cause reputational harm and business interruptions, but most of all—they’re expensive. Many organisations are now turning to cyber insurance as another layer of protection. Cyber insurance offers organizations protection to limit their risk, however, organizations should consider all coverage options carefully. It’s not about checking off a box; it’s about finding a policy that protects the organization’s brand, reputation, and operations if they are faced with a breach. Therefore, depending on factors such as the vertical, their business and their compliance requirements etc., the security solutions and IT budgets allocated across companies will vary.

Please share some suggestions on how the key sectors such as financial services, transportation, etc, at large should handle security threats in the future.

The IT infrastructure has become more complex and information is now dispersed across devices, apps, and locations: physical, virtual, and cloud. In a world where the perimeter is disappearing, it’s not enough to simply defend against exploits and threats. Assuming this aggressive, offensive posture entails companies need to ensure that they are:Keeping adversaries out; protecting the valuable information that’s inside the organization; continuously gathering and applying intelligence to gain an advantage; and providing comprehensive incident response and forensic support if a breach does occur.

Additionally, below are a few steps businesses can take to protect themselves:

• Don’t get caught flat-footed: Use advanced threat intelligence solutions to help you find indicators of compromise and respond faster to incidents.
• Employ a strong security posture: Implement multi-layered endpoint security, network security, encryption, strong authentication and reputation-based technologies. Partner with a managed security service provider to extend your IT team.
• Prepare for the worst: Incident management ensures your security framework is optimized, measureable and repeatable, and that lessons learned improve your security posture. Consider adding a retainer with a third-party expert to help manage crises.
• Provide ongoing education and training: Establish guidelines and company policies and procedures for protecting sensitive data on personal and corporate devices. Regularly assess internal investigation teams—and run practice drills—to ensure you have the skills necessary to combat cyber threats.

Looking ahead, what is the greatest worry or concern about the future of the enterprises in terms of security/the security risks to enterprises?

Today’s cybercriminals are skilled enough and sufficiently resourced to have the persistence and patience to carry out highly successful attacks on consumers, businesses, and governments around the world. Their efforts have turned cybercrime into big business with private information being stolen on an epic scale.

In 2015, Symantec saw how much consumer confidence was rocked by the number of mega breaches that exposed the identities of millions of people. The ability for some organizations to recover from a data breach was paralyzing as we saw in the Ashley Maddison data breach and it is almost obvious that 2016 will open up greater opportunities for cybercriminals, posing more threats affecting individual consumers, businesses and governments alike. According to Symantec’s Security intelligence team, below are a few cyber security threats that businesses must watch out for in 2016:

• Risk of Serious Attacks to Critical Infrastructure Will Increase

As discussed, Symantec’s ISTR.20 revealed that in India, businesses dealing with critical infrastructure are on the cybercriminals’ radar. Symantec saw an increase in the number of attacks on key sectors such as financial services (17.1%; up from 11.1% in 2013), transportation and communications (4.4%; up from .8% in 2013). Of these, the transportation, communications, electricity, and gas industry saw a five-time increase in the targeted attacks. Even in 2016 we can expect this to continue to increase like seen in the case of recent attack against the Ukrainian energy sector, which led to power outages in the country. Motivations for critical infrastructure attacks are both political and criminal, with nations and political organizations operating cyber-warfare campaigns, and criminals attacking for profit or ransom.

• Cloud Security: With data exploding everywhere—on the network and in the cloud, it raises concerns about security, privacy, and compliance. This makes it extremely important to safeguard the data from all control points, while making it available within reach of users. Traditional approaches to enterprise security have been based on control—control of devices, of infrastructure, of information—and of processes inside enterprise firewalls. Keeping corporate information safe and compliant has never been easy. This creates a continued demand for solutions like Data Loss Prevention (DLP). DLP helps companies understand where their sensitive corporate information is being stored, how it’s being used and how to protect it

• Mobile Security: Much of what drives us to make mobile such an integral part of our daily lives is the convenience that it offers. Ironically, it’s the same convenience that we rely on and expect from our smartphones that give mobile the potential to put corporate data at risk. Mobility saw the biggest growth in 2015, which will continue to rise with a steep rise in mobile devices purchases as well as 4G adoption. While businesses continue to adopt BYOD; the need for a solution to ensure the security of critical data, corporate apps etc. increases. To address this, Symantec introduced the Mobility Suite 5.4.2 recently. This provides a centralized approach to easily manage DLP across all endpoints, including mobile devices.