RSA: Trust in our Digital World is in Jeopardy
RSA chief warns that risk is a way of life and that the time has come to embrace a Big Data approach to security.
RSA Security kicked off its namesake security conference Tuesday with a keynote presentation outlining how the world has changed in the last 12 months. For RSA, it's a world in which they suffered a serious security breach that left the company exposed.
In his opening keynote, RSA Executive Chairman Art Coviello made the point that risk is a reality of the modern world -- and not just in the IT sphere.
"We can’t guarantee risk-free travel on the highways, or in the air, or even, apparently on a cruise ship off the coast of Italy, any more than we can guarantee risk-free IT infrastructures operating our digital world," Coviello said in his keynote.
That said, Coviello noted that risk can be reduced and that professionals can make prudent decisions to help manage that risk effectively. Though the Internet has risk, Coviello stated that the IT security industry has made the Internet safe enough to transform the world. But that safety itself is increasing coming under fire.
"Trust in our digital world is in jeopardy," Coviello said. "Our adversaries are better coordinated, have developed better intelligence, and easily outflank our traditional perimeter defenses."
He added that modern cybercriminals are taking advantages of gaps in the modern hyperconnected world. While there is a lot to be concerned about, Coviello stressed that though he doesn't sell security on the basis of fear, there are some harsh realities.
"Collectively, people in our line of work have been going through hell in the last 12 months since we last met," Coviello said. "And, yes, because we at RSA were attacked last March, my colleagues and I feel this as personally as anyone else in this room. "
Coviello said that since the breach, his company has been dedicated to regaining and maintaining the confidence of its customers. There is also a sense of urgency to apply the lessons they learned to help deliver insight as well as to drive RSA's strategy, investments, and product roadmaps.
"In the final analysis, we hope that the awareness from the attack on us will strengthen the sense of urgency and resolve of everyone," Coviello said.
Overall, the fact that networks and companies will be attacked is inevitable, but that's not a doomsday predication either.
"Accepting the inevitability of compromise does not mean that we have to accept the inevitability of loss," Coviello said. "We can manage risk to acceptable levels. We won't stop every individual attack, but we can reduce the window of vulnerability from all attacks, and put the balance of control back firmly in the hands of security practitioners."
To minimize the risk window, organizations need to use intelligence to the defenders' advantage. This is a message that Coviello and RSA also stressed in a recent report. In the report and on the RSA conference keynote stage, Coviello emphasized the need to transition away from siloed point products and move to a system that leverages multiple sources of intelligence to understand and manage risk.
To gain that broader visibility of risk, security leaders will need to look far beyond log data from traditional security event management tools. According to Coviello, organizations need to adopt a Big Data model in order to gather the necessary data from multiple sources. With a Big Data paradigm, large volumes of data can be analyzed quickly in an effort to help identify even faint signals of a potential attack.
"Big Data gives you the power to shrink your window of vulnerability," Coviello said.
Coviello noted that his company offers technologies to help organizations gain better visibility into threat information. So do other vendors: Both IBM and HP have recently released their own respective platforms to help collect data in an effort to fully understand and mitigate risk.
While risk is inescapable, in Coviello's view, it's time to fight back against attackers.
"We can give our industry the structures it needs to share intelligence so that we can all be in this fight together, and that knowledge gained by any one of us can become power for all of us," Coviello said.
January 17, 2012
Speaking from recent experience, RSA's Art Coviello says the question now is not whether your defenses will be breached -- it's whether you are equipped to respond when it happens.