Issuu

SPECIAL REPORT

Endpoint Security Solutions for Modern Enterprise IT and Data Protection

Finding the Right Balance Maintaining Security in an Evolving World Knowledge is Power: Why it Pays to Educate Staff The Next Generation of Endpoint Security Products Keeping Your Company Safe into the Future

Published by Global Business Media

ENDPOINT SECURITY SOLUTIONS FOR MODERN ENTERPRISE IT AND DATA PROTECTION

SPECIAL REPORT

Endpoint Security Solutions for Modern Enterprise IT and Data Protection

Contents Foreword 2 Tom Cropper, Editor

Finding the Right Balance

DriveLock SE Finding the Right Balance Maintaining Security in an Evolving World Knowledge is Power: Why it Pays to Educate Staff The Next Generation of Endpoint Security Products Keeping Your Company Safe into the Future

Published by Global Business Media

Published by Global Business Media Global Business Media Limited 62 The Street Ashtead Surrey KT21 1AT United Kingdom Switchboard: +44 (0)1737 850 939 Fax: +44 (0)1737 851 952 Email: info@globalbusinessmedia.org Website: www.globalbusinessmedia.org

IT Security – The Status Quo Risk from Internal Perpetrators Four Reasons for a New Security Approach Next-Generation Security Solutions DriveLock Security Engine Drivelock Security Engine in Practice — How it Works with Ransomware Summary

Maintaining Security in an Evolving World

Tom Cropper, Editor

Publisher Kevin Bell

Growth of Enterprise IT A Tougher Regulatory Environment New Lines of Attack

Editor Tom Cropper

Knowledge is Power: Why it Pays to Educate Staff 9

Business Development Director Marie-Anne Brooks Senior Project Manager Steve Banks Advertising Executives Michael McCarthy Abigail Coombes Production Manager Paul Davies For further information visit: www.globalbusinessmedia.org The opinions and views expressed in the editorial content in this publication are those of the authors alone and do not necessarily represent the views of any organisation with which they may be associated. Material in advertisements and promotional features may be considered to represent the views of the advertisers and promoters. The views and opinions expressed in this publication do not necessarily express the views of the Publishers or the Editor. While every care has been taken in the preparation of this publication, neither the Publishers nor the Editor are responsible for such opinions and views or for any inaccuracies in the articles.

Jo Roth, Staff Writer

Inside Threats Educating Employees The Solution Information is Power

The Next Generation of Endpoint Security Products 11 Jo Roth, Staff Writer

Beyond Existing Security Systems The Rise of Digitization Searching for New Systems A Time of Change

Keeping Your Company Safe into the Future 13 Tom Cropper, Editor

An Evolving Threat Businesses are not Prepared Digitization and Beyond

References 15

© 2017. The entire contents of this publication are protected by copyright. Full details are available from the Publishers. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical photocopying, recording or otherwise, without the prior permission of the copyright owner. WWW.CEOREPORTS.COM | 1

ENDPOINT SECURITY SOLUTIONS FOR MODERN ENTERPRISE IT AND DATA PROTECTION

Foreword T

ODAY’S BUSINESSES must ask themselves

We then look at how the challenges confronting firms

a difficult question: is it possible to get the

are changing. The evolution and growth of enterprise

business they want these days while still keeping

IT, a more sophisticated cyber criminal and a

their data secure? For many, that question is still

stringent regulatory environment create all sorts of

very much up in the air.

problems for the security teams of the future.

Mobile technologies enable businesses to become

Jo Roth will then look at one of the key problems

more agile and mobile. Business systems are

for business – a company’s own staff, which still

migrating onto the cloud reducing infrastructure costs

represents its biggest security vulnerability. He will

and enabling employees to log in and make changes

show why staff training and engagement should be

from anywhere they like. However, the more they do

such high priorities.

this, the more end-points they create which, in turn, increases their vulnerability to data breaches.

James Butler will then look at how the landscape of IT security is changing the nature of end-point security

Equally, despite several high-profile incidents,

systems. Antivirus software is fast becoming obsolete,

employee error still remains a dominant theme in

which means a new generation of systems must

data leaks. Moving into the future, businesses will

take up the challenge. However, adoption of security

have to harness a new generation of end point security

protocols remains patchy among businesses –

systems, while constantly improving their own internal

some are ahead of the curve while others still

processes and training.

struggle. We’ll round off with a look to the future and

Our opening article comes from IT security provider, DriveLock SE. They outline how digitization and

how businesses can safeguard their systems in an increasingly challenging world.

increasingly mobile working is creating new challenges for the end-point security market. They talk about some of the ways in which their systems are providing enhanced security for the internet age.

Tom Cropper Editor

Tom Cropper has produced articles and reports on various aspects of global business over the past 15 years. He has also worked as a copywriter for some of the largest corporations in the world, including ING, KPMG and the World Wildlife Fund.

2 | WWW.CEOREPORTS.COM

ENDPOINT SECURITY SOLUTIONS FOR MODERN ENTERPRISE IT AND DATA PROTECTION

Finding the Right Balance DriveLock SE A modern approach to IT security with DriveLock

RENDS, LIKE digitalization and the Internet of Things, challenge IT security managers to protect company data fully yet cost-effectively. Many solutions are too complex and inefficient, generating unnecessar y costs and hampering productivity. With a security concept tailored to the exact requirements of each company, DriveLock provides extensive protection – from both internal and external threats – without affecting the efficiency of work processes. By doing so, companies align their strategic goals with their security goals and drive their business forward. Developed in Germany, DriveLock is a solution without any back doors that complies with Germany’s stringent data protection regulations and safeguards data and devices with a multi-layer security concept.

IT Security – The Status Quo Attacks on IT cause a huge amount of damage to business today. As security incidents multiply, companies try to block attacks with conventional security approaches, which are mainly based on concepts like firewalls and virus protection. However, the fact that more and more firms are transferring their data to cloud architectures means that their data is no longer hidden away safely in their data center and protected from the outside world. Instead, it is in the cloud to enable staff, business partners and

customers to access it wherever they are. IT security is a challenge across all industries, including finance, healthcare, public authorities and manufacturing. This challenge will become even greater once the EU’s basic regulation for data protection comes into effect in May 2018. It means that international law will also be implemented on a national level and organizations will need to be more stringent about security than before.

Risk from Internal Perpetrators Danger does not always come from outside the company. Although only 38 per cent of security incidents are caused by external threats, more than 60 per cent of companies only protect themselves against these active external threats while neglecting protection against internal security vulnerabilities and the risk of data loss. (Source: Cyber-Security Survey 2015, BSI – Germany’s Federal Office for Information Security) Alongside technical shortcomings, the recklessness of individual employees poses a major security risk. As many as 25 per cent of all IT security attacks are successful (Source: Cyber-Security Survey 2015, BSI – Germany’s Federal Office for Information Security), because employees can be careless – such as by unwittingly giving hackers passwords or installing malware despite warnings. Internal perpetrators who deliberately copy

IT security is a challenge across all industries, including finance, healthcare, public authorities and manufacturing

WWW.CEOREPORTS.COM | 3

INNOVATIONS IN ENDPOINT SECURITY SOLUTIONS FOR MODERN ENTERPRISE IT AND DATA PROTECTION

To ensure that security measures are effective, companies need innovative and comprehensive security concepts that are tailored to the requirements of their data environment

4 | WWW.CEOREPORTS.COM

data or install malware are also a big problem. In these cases, conventional approaches to security soon come up against their limits. But staff carelessness is not the only security risk. The threat landscape has changed and demands new solutions. Many companies simply patch up system security vulnerabilities in a piecemeal way or try a workaround to remove them. To ensure that security measures are effective, companies need innovative and comprehensive security concepts that are tailored to the requirements of their data environment.

Four Reasons for a New Security Approach 1. The cloud – data is no longer hidden safely away in a company’s data center and protected from the outside world. Instead, it flows between the company, its business partners, customers and staff, who can all access it from anywhere in the world. 2. M obile devices – in the internet era, companies of all types are virtually reliant on providing access to relevant data at any time. Employees often work outside the office and access company data while away at a conference or in restaurants. 3. Darknet – in a similar way to companies transferring their services to the cloud, hackers also offer their services on underground marketplaces. 4. Digitalization – networking machines, sensors and various devices also have the effect of digitalizing a company’s core processes. However, 99 per cent of all IT security incidents can be traced back to known vulnerabilities and could therefore be avoided. Some companies do not install patches and updates regularly, so they offer cyber-criminals an easy target. That makes hackers’ methods more predictable. Many organizations have already recognized that they must adapt their security policy to their company goals, risks, dangers and compliance guidelines.

Next-Generation Security Solutions Data security in companies is in danger on various levels. It is no longer sufficient to limit protection to the network or the devices, because the data itself needs to be protected too. A modern solution addresses all aspects of the challenge and permanently closes all gaps in security without compromising business processes. New security approaches are based on two fundamental questions: Where is our data located? – Data Centric Security (DCS) Who has access to our data? – People Centric Security (PCS) Combining DCS and PCS produces a security model that provides a high level of protection, even in a digitalized world. Three factors play an important role here: 1. Policies – companies and their staff can develop policies that are perfectly tailored to their needs and deal with data on an individual basis, depending on its type and purpose. In principle, the possibilities inherent in this approach are endless: for example, a policy could stipulate that a PDF file containing an electronic signature requires better protection than a simple draft in Microsoft Word. Another policy could require that any file with the word “contract” in its name is given the highest level of protection. 2. Persistent encryption – this is the only way to ensure that data stays encrypted in every phase. Many providers promise encryption, but only use it in the cloud, so data remains unprotected when it is stored on a company server. 3. Comprehensive monitoring – companies can always use comprehensive monitoring to check who is accessing which data and when. It has benefits that go beyond security

ENDPOINT SECURITY SOLUTIONS FOR MODERN ENTERPRISE IT AND DATA PROTECTION

and compliance, in that employees are given more responsibility for their data but are also responsible for the consequences of their actions. This makes restrictive security controls and enforced policies superfluous, while increasing productivity.

DriveLock Security Engine Demand for modern, integrated IT security solutions is increasing as a result of the new threat situation that has arisen due to digitalization, growth in the use of mobile devices and huge quantities of data in the cloud. The DriveLock Security Engine is a fully-integrated security solution that protects data on devices and in the cloud with a unique multi-layer security concept. Users can centrally manage all DriveLock functionality with the intuitive DriveLock Management Console (DMC) and add or remove modules as required. The MSSP version of DriveLock is hosted and managed centrally. A flexible and attractive license model is available for end users. Companies can use the DriveLock Security Engine to easily align their strategic goals with their security goals. The appropriate tools from the DriveLock portfolio can be configured individually to adapt them to the relevant situation. This enables a level of protection that cannot be achieved with single applications. 1. PREDICT – the DriveLock Heat Map highlights vulnerabilities in good time and deprives attackers of opportunities to cause damage. 2. PREVENT – vulnerabilities are secured by certified encryption, application checks and Device Control and protected against malicious attacks as well as self-inflicted data losses.

3. DETECT – if an incident does occur despite this protection, the DriveLock Forensics function provides detailed reporting in real time. Together with the Avira Antivirus Engine, it discovers security incidents in record time. 4. RESPOND – once it has been discovered, companies can ring-fence the problem with flexible policy settings to ensure that it cannot spread or be repeated.

DriveLock Security Engine in Practice – How it Works with Ransomware Ransomware is becoming one of the most pressing IT threats in companies. More and more hackers use social engineering to try and attack individual companies in a highly targeted way. Some other attacks are more random. In each case, company staff trigger the encryption process by mistake or even deliberately – with expensive consequences. Ransomware attacks follow a relatively predictable plan. Throughout the kill chain, there are many opportunities to let the attack dissipate on its own. This is where the DriveLock Security Engine starts working. An attack can already be blocked in the exploratory phase (1). The key: well-trained staff who know which contact requests are likely to be malicious. The DriveLock Education Module trains employees effectively so that they learn how to respond confidently to a variety of threats. Once the attackers have obtained an exploit (2) and start delivery (3) of the malware to the target computer, the relevant components from the DriveLock Endpoint Security portfolio get to work. The Antivirus, Web Security (URL filtering) and Device Control modules can

Demand for modern, integrated IT security solutions is increasing as a result of the new threat situation that has arisen due to digitalization, growth in the use of mobile devices and huge quantities of data in the cloud

WWW.CEOREPORTS.COM | 5

ENDPOINT SECURITY SOLUTIONS FOR MODERN ENTERPRISE IT AND DATA PROTECTION

The DriveLock Web Security module acts by stopping communication with the target system

block most ransomware attacks in this phase. Even in the ransomware installation (4) phase, the solution can still implement measures to counter the threat. The application verification function prevents unauthorized software from being installed or executed on users’ devices. Many ransomware programs receive additional instructions (Command & Control, 5) over the internet, such as to trigger the encryption process. The DriveLock Web Security module acts by stopping communication with the target system.

Summary The demands placed on today’s IT security solutions have increased significantly. Against the backdrop of digitalization, companies are placing a much greater focus on data protection and security. In parallel, demand is also growing for software solutions that enable firms to implement new regulations and policies easily and effectively.

6 | WWW.CEOREPORTS.COM

The DriveLock solution helps companies to protect their data while complying with legal requirements. The next-generation endpoint security software includes preventative measures to thwart attacks and stop the system from becoming infected. DriveLock software evolves constantly to guarantee security for sensitive data. DriveLock is a leading global specialist in IT and data security. It has been developing security software exclusively in Germany since 1999 at its locations in Ludwigsburg and Munich. DriveLock solutions provide the best “made in Germany” endpoint security without any back doors.

Contact DriveLock SE Landsbergerstrasse 396 München, DE 81241 Phone: +49 (0)89 54636490 E-Mail: info@drivelock.com

ENDPOINT SECURITY SOLUTIONS FOR MODERN ENTERPRISE IT AND DATA PROTECTION

Maintaining Security in an Evolving World Tom Cropper, Editor

The changing landscape of business creates a host of challenges – can end-point security evolve fast enough to keep up?

ASTER, MORE mobile and more flexible – this is the mantra of businesses today as they seek to make their systems available from multiple locations at any time of the day. Doing so could be revolutionary, but this new age of enterprise business solutions creates a range of challenges for endpoint security systems – many of which, businesses do not fully understand.

Growth of Enterprise IT Enterprise IT is growing. A report from Gartner forecasts global spending to increase to $201bn in 2019 – up from an estimated $149bn in 2015.1 More and more companies are transferring large quantities of data onto the cloud. A study from Cisco Systems suggests that 83% of all data center traffic will be on the cloud within the next three years2. The benefits for companies are clear: lower infrastructure costs and greater flexibility with participants able to log in and view critical information from any location with an internet connection. However, it also presents a host of new challenges for companies when maintaining the security of their data and, as a glance at recent headlines will prove, many are already falling short. It seems a day seldom passes without news of another company which has lost a large chunk of data. Each breach is potentially costly and embarrassing – both for the data processors and the individuals whose details have been lost – few more so than the users of the site, Adult Friend Finder, who were the victims of the largest data hack in history3. In total, the Friend Finder Network lost nearly 500 million profiles and contact details. It was an astonishing blow for a company which relies on its promise of confidentiality to its clients – and an equally devastating blow for the millions of users whose contact details were leaked to the public. This is just the highest profile hack of many. Within recent memory it is possible to point to

breaches at LinkedIn, Ashley Madison, the NHS and many others. According to figures from CFC Underwriting, there were more than 400 claims on cyber breach policies in 2016 – an increase of 78% on 2015. Of these, 90% were from firms with less than £50million in revenue, but there was also a disproportionately high number of claims from UK firms, suggesting that the maturity of data protection strategies in the UK lags behind other major countries such as the US.

The benefits for companies are clear: lower infrastructure costs

A Tougher Regulatory Environment

and greater flexibility

Those organizations would be well advised to improve their security strategies as new regulations will increase the scrutiny on firms of all kinds. In 2018, the EU will bring in new data protection regulation to replace the previous EU Data Protection Directive. The new regulation will strengthen the provisions of the existing directive, including higher fines and harmonized regulation across EU member states. Companies with more than 250 employees will be required to appoint data protection officers. Companies will have to notify customers in plain language about what information they collect and how it is used. Companies will be required to notify authorities of a data breach within 24-hours of it occurring. Also, users will be able to make compensation claims if their information is processed in an illegal way. In addition, users will have a ‘right to be forgotten’ – to request that their old information is erased. Fines for breaches of the regulation could rise to e100million or 5% of global revenue (whichever is higher). This is much higher than the current level under the UK Data Protection Act of £500,0004. The scrutiny on firms, therefore, is becoming higher and, at the same time, other developments have the potential to make it more difficult to safeguard sensitive data. The Draft Communications Bill5, which passed smoothly through parliament, contains much for technology companies to be concerned about.

with participants able to log in and view critical information from any location with an internet connection

WWW.CEOREPORTS.COM | 7

ENDPOINT SECURITY SOLUTIONS FOR MODERN ENTERPRISE IT AND DATA PROTECTION

Within recent memory it is possible to point to breaches at LinkedIn, Ashley Madison, the NHS and many others

It requires internet service providers to hold onto browsing histories for a period of 12 months and to provide access to this information for security services on request.

New Lines of Attack With more and more sensitive information being held online in the cloud, it becomes increasingly difficult for a company to guarantee data security, because some of that security is taken out of their hands. If the internet service provider is hacked, criminals could access a huge amount of information about a business and its clients. In such a situation, it becomes much harder to guarantee the safety of information, which is why some technology companies such as Ind.ie have warned they may quit the UK as a result of this new regulation6. If the regulatory penalties of data loss are growing, so too is the challenge from the hackers themselves. Cyber-crime is fast becoming a multi-billion dollar industry in its own right – attacks are becoming more sophisticated and operating on an industrial scale. From

ransomware used to look businesses out from their IT data systems to more traditional data theft, criminals are adopting increasingly ambitious and wide-ranging attacks. Inevitably, there is always the sense that cybercriminals may be one step ahead of business defense. They develop an attack and then it’s up to businesses to develop a defense. It’s a game of cat and mouse and one which businesses can only win by future-proofing their security systems – this means safeguarding their data, not only for the attacks of the present, but also the future. It requires constant vigilance and a comprehensive, continuous and integrated security strategy. Maintaining the integrity of data, therefore, is becoming more complicated on a number of different fronts. Regulation is stricter and, in some cases, creates new avenues of attack; cyber criminals are smarter and more sophisticated while the evolving approach to business administration is also making them more vulnerable. Maintaining security in this multi-layered world of threats will be a major challenge for IT teams in the future.

With more and more sensitive information being held online in the cloud, it becomes increasingly difficult for a company to guarantee data security, because some of that security is taken out of their hands

8 | WWW.CEOREPORTS.COM

ENDPOINT SECURITY SOLUTIONS FOR MODERN ENTERPRISE IT AND DATA PROTECTION

Knowledge is Power: Why it Pays to Educate Staff Jo Roth, Staff Writer Why staff training and education will always be a key part of any endpoint security system.

HEN BUILDING endpoint security systems for the future, most companies will instinctively look outwards – at attackers and the evolving nature of cybercrime. But the chances are, businesses would do better to turn their gaze inwards – at themselves and their employees because, statistically, that is where a data breach is most likely to occur. This is why staff education and awareness are two of the most important ingredients in any security system.

Inside Threats Repeated surveys over the past few years show that the vast majority of data leaks come from inside an organization. A survey from CompTIA concludes that human error accounts for 52% of data breaches7. A report by Experian found that negligence or a malicious attack from an exemployee account for the majority of data losses8. Another study from Intel Security suggests that 43% of data losses stem from staff. Equally, there was a difference in the type of data most likely to be compromised. External hackers were more likely to go for customer data as this represents the most potentially lucrative line of attack. Internal leaks were more likely to be of employee data. However, if employees are taking data intentionally, they are most likely to compromise intellectual property – an attempt to exact a measure of revenge against the company9. It’s not hard to find high profile examples of how negligence has compromised data. In 2008, HSBC sheepishly announced that it had lost a data disc containing the details of 370,000 customers10. Bank of America did the same thing in 200511 as did the UK Government in 2007 when the personal details of 25 million people went missing in the post12! What these stories have in common is that they come from large organizations which one would expect to be better prepared and they feature massive data loss caused by simple and avoidable errors. They also show that the problem has been with us for many years. But, despite

widespread awareness of the risks, little action is being taken to address the issue. The Experian report mentioned earlier also states that, despite awareness of the problem being high, companies are still not putting in place practices to improve culture and training.

Educating Employees Training and education starts by making employees aware of just how their actions can compromise corporate security. One of the more revealing facts about the recent hack of account details at the adult dating site, Adult Friend Finder, was the number of profiles which used official or work based emails. There were addresses from the army, government and parliament among others. Employees have a tendency to use work based emails for logging into a range of different applications – even, it appears, adult dating. They may also use the same passwords for personal social media sites and work systems, which means that hacking one could give a fraudster access to the entire system of a business. Using social media in the workplace can aid productivity and communication, but it can also expose a company to malicious attacks. Facebook and Twitter fight a continual battle against malware and viruses but often link to sites with lower levels of security. Many people instinctively feel that clicking on a link delivered through Facebook should be relatively harmless, but there is no guarantee that that link will be safe and secure. Even at home, an employee could be a source of vulnerability because of the evolving nature of cyber crime. Hacks such as against the Friend Finder Network and an earlier strike against Ashley Madison – the site where married people can go for an affair – show that fraudsters are after information which can cause embarrassment and shame. The Ashley Madison hack was triggered by an organization which had moral objections to the site – their aim was not financial but to attack the reputation of the business and its subscribers. The capture of illicit or shameful

You should constantly audit existing security protocols and training measures to ensure your staff are up to date with the latest trends and threats

WWW.CEOREPORTS.COM | 9

INNOVATIONS IN ENDPOINT SECURITY SOLUTIONS FOR MODERN ENTERPRISE IT AND DATA PROTECTION

Training and education starts by making employees aware of just how their actions can compromise corporate security

secrets is becoming currency which exposes people and individuals to fraud and blackmail. If your employees have secrets they’d rather the world did not know about, you have to ask yourself what would they do to protect it? That’s exactly the question many fraudsters are looking for.

The Solution To combat such weaknesses, businesses should not start monitoring employees’ online browsing – but they should provide education and show them exactly how their personal browsing could compromise security. Robust guidelines should be instituted, such as ensuring no company details are ever used for logging onto personal sites – and that employees do not re-use personal passwords for workplace systems. Smart employers also maintain an open line of dialogue between themselves and their employees. If one has been compromised they need to be comfortable in sharing that information. Make sure they know that they can come to you

and tell you about a problem, and that information will be treated impartially with no judgement. The more you know about a threat the better placed you are to take action. Employees are less likely to come clean if they feel embarrassed or fear retribution.

Information is Power In more general terms, the more informed an employee is, the better. Companies should focus on extending training and awareness beyond key members of the IT departments to cover every individual. This training should be led by experts and be flexible enough to fit in with each employee’s methods of learning. Moreover, it should be a regular part of corporate life. Security is a moving landscape with threats which are constantly evolving and mutating. Software providers are continually providing updates to improve the security of their packages – in much the same way, you should constantly audit existing security protocols and training measures to ensure your staff are up to date with the latest trends and threats.

External hackers were more likely to go for customer data as this represents the most potentially lucrative line of attack. Internal leaks were more likely to be of employee data

10 | WWW.CEOREPORTS.COM

ENDPOINT SECURITY SOLUTIONS FOR MODERN ENTERPRISE IT AND DATA PROTECTION

The Next Generation of Endpoint Security Products Jo Roth, Staff Writer Threats are evolving and traditional end-point security products are becoming obsolete. Security systems will have to become more agile and sophisticated to cope with a host of new threats.

NTERNET SECURITY software is dead – even its main providers say so. The digitization of the workplace and working life sees the concept of end-point security becoming more complex and demanding. To remain relevant in a world of increasingly sophisticated cyber threats, it must evolve and move forward.

difficult for software to detect. Even then, security software does not necessarily detect 100% of malicious files immediately. It can take days, weeks and even months to pick up a threat – during which time the damage may already have been done.

Beyond Existing Security Systems

While attacks are becoming more sophisticated, other trends are also moving in their favor. Businesses are digitizing their systems and the way in which they work. Increasing amounts of critical business information, including client, staff and supplier details, are being moved onto the cloud. These online-based administration systems offer plenty of advantages such as access to accounts and other key administrative systems from any location with access to the internet. Staff are using their own smartphones, laptops and devices to access the system as well as work-issued mobile devices. As they do so, they greatly increase the amount of endpoints linking into the main system and so create a huge number of additional lines of attack. The complexity of keeping those endpoints safe is one of the biggest challenges for end-point security. However, this doesn’t mean abandoning security. It simply means systems need to evolve. German Company ARZ had been using the same security system for several years. However, in recent times an increase in the number of devices being used by their staff meant they needed security software with more flexibility than their current supplier could provide.

The basic concept of end-point security is to protect every point at which a system is accessed. Developments such as the internet of things and ‘bring your own device to work’, together with the accelerating use by businesses of the cloud, contribute to an increase in the number of devices through which a company’s system might be accessed. A single employee alone, for example, might be responsible for a huge number of different end-points: they might access the system from their office computer, work-issued mobile devices, home lap top, personal iPad and their own smartphone. With more and more administrative systems migrating to the cloud enabling remote working, they may also access it from any offsite computer with an internet connection. Furthermore, companies are able to use the cloud to collaborate more smoothly with freelancers and contractors based in multiple locations around the world. As the number of end-points multiplies, so too does the potential avenue of attacks. The traditional model of end-point security, which relied on little more than the latest antivirus software is no longer up to the task. Even Norton’s information chief says internet security software does not catch the majority of threats. Brian Dye, Senior Vice President for Information Security at Symantec says internet security software in general misses 55% of malware attacks and is now effectively ‘dead’13. Attacks are becoming increasingly sophisticated and varied which makes them much more

The Rise of Digitization

Attacks are becoming increasingly sophisticated and varied which makes them much more difficult for software to detect

Searching for New Systems In their search for a new system, they performed a comprehensive evaluation of the various available products – eventually settling on DriveLock. This is a fully integrated security solution which provides guaranteed protection to data both on the cloud and on mobile devices. WWW.CEOREPORTS.COM | 11

INNOVATIONS IN ENDPOINT SECURITY SOLUTIONS FOR MODERN ENTERPRISE IT AND DATA PROTECTION

Technology is moving forward to keep up with demand, but the real lag may still be with perception and awareness

It already has three million users and can be tailored to all organizations regardless of their data needs. Users can manage all the functions of the DriveLock system from a central console and add or subtract modules as and when they need to. It was this granulation, enabling users to finetune their functionality which appealed to ARZ. It enabled them to optimize the solution for all their clients and to ensure functionality could be adjusted to different situations, including temporary exceptions. Installation was relatively straightforward. One of the other key selling points was that it didn’t need any additional software. It could operate centralized within the Windows Active Directory, which means there was no need for additional administration. It allows changes to be simulated in an offline mode, and provides ongoing stable and reliable internet security without interruption to existing infrastructure. As a side benefit, it can also increase awareness of internet security issues among employees, which has further benefits for the company. “With DriveLock, we are able to efficiently meet the diverse security requirements of our customers,” says Klemens Jager, PC Infrastructure Management. “We offer all involved parties the maximum degree of security and have the greatest possible flexibility at our disposal

regarding the restrictions – and DriveLock would definitely be our choice again14.”

A Time of Change The antivirus market, then, is going through a process of change. Previously it’s been dominated by big players such as Symantec but, as they struggle to remain relevant in a world of sophisticated and evolving threats, opportunities are opening up for other participants offering flexible solutions capable of operating in the more challenging environment businesses find themselves today. That is bringing competition and driving innovation further forward. Technology is moving forward to keep up with demand, but the real lag may still be with perception and awareness. Many businesses are not entirely certain how to build in a fully layered end-point security system to protect their systems. Worse still, many companies push forward, despite not knowing the full extent of their vulnerabilities. While the technology is there, understanding among the end users is extremely patchy, which will continue to leave opportunities for criminals. As a result, there will be plenty of companies and individuals who suffer breaches because of their own internal mistakes and their own lack of education.

The traditional model of end-point security, which relied on little more than the latest antivirus software is no longer up to the task

12 | WWW.CEOREPORTS.COM

ENDPOINT SECURITY SOLUTIONS FOR MODERN ENTERPRISE IT AND DATA PROTECTION

Keeping Your Company Safe into the Future Tom Cropper, Editor How companies can select the right protection to counter future threat

HE DEVELOPMENT of IT security has been like the development of castles. First, leaders constructed large wooden forts. Enemies attacked these with fire so they started building castles made from stone. Opposition forces came back with the cannon, and so walls became circular to deflect the shot. It’s a game of evolution versus adaption. Defenders and attackers constantly vying to be one step ahead of the other. IT security has worked in much the same way with criminals developing new attacks and security teams updating their defenses accordingly. Now though, there is a real question of whether IT security teams can truly adapt enough to ensure safety in the increasingly challenging market of the future.

An Evolving Threat The endpoint security market is growing. A study released by Markets and Markets expects it to grow from USD$11.62bn in 2015 to $17.38bn in 2020 at an estimated CAGR of 8.4%15. The report says growth will be driven by the increasing need to mitigate attacks, the proliferation of mobile devices through trends such as ‘bring your own device to work’, and the increasing frequency of end-point attacks. Those attacks are changing – both in frequency and nature. The threat is evolving from basic viruses to advanced malware which places additional strain on a system’s defenses. As such, simple virus prevention software is no longer sufficient. The nature and make-up of the market is changing. Previously, it was dominated by major players offering a single catch all endpoint solution for all your needs. The proliferation of attacks, however is sparking a surge in new services – often from small companies – offering single purpose endpoint security solutions. Frequently, these will be tasked to counter a particular threat vector and, while a single piece of software can be effective at doing the single job it has been designed to do, it is difficult to incorporate multiple different pieces of software within an entire system. As we

move forward into the era of advanced threat detection and resolution, the big strides can be made by those companies with the ability to offer a single flexible, agile and effective solution incorporating protection against the widest possible range of threats.

Businesses are not Prepared Choosing the best system will be a challenge especially as, despite the publicity surrounding threat detection, many companies remain woefully ill-prepared for the assaults they are likely to face. A recent report from the Ponemon Institute said 66% of the IT professionals they interviewed stated that their company was not prepared to recover from a major cyberattack16. Incident response challenges are hindering cyber resilience. Part of the problem is that companies continue to have a number of basic misconceptions about security. Human error remains a major issue. The Ponemon report found that 74% of respondents said they had experienced problems due to human error. Furthermore, they remain unsure about exactly what end-point security is, with many professionals assuming simple off-theshelf antivirus protection will be enough to safeguard their systems. Other common mistakes include failing to secure all end-points. Any smartphone or mobile device which connects to a corporate network will count as an end-point and must be secured. This even applies if people VPN into the network from remote locations. Any end-points not secured undermine the integrity of the entire system. Employee training is also lacking and companies are not putting enough effort into designing a comprehensive process and strategy. Security must also be fully designed as part of a multi-layered security network. It can’t begin and end at an end-point and it can’t be on an ad hoc basis – it needs to be a continuous and ongoing integrated strategy which includes technology, procedures and training. The task facing IT teams, therefore, is

The threat is evolving from basic viruses to advanced malware which places additional strain on a system’s defenses

WWW.CEOREPORTS.COM | 13

INNOVATIONS IN ENDPOINT SECURITY SOLUTIONS FOR MODERN ENTERPRISE IT AND DATA PROTECTION

The task facing IT teams, therefore, is considerable. They must develop security systems which are flexible, robust and multi-layered

considerable. They must develop security systems which are flexible, robust and multi-layered. They must cope against a threat landscape which continues to evolve and they must do so in a business environment which creates as many new vulnerabilities as opportunities.

Digitization and Beyond One of the most important of these developments will be digitization. It has already had a significant impact on businesses of all sizes. Mobile devices are connecting to central cloud- based administration systems – often from multiple locations around the world. This has understandable implications for end-point security systems if for no other reason than that it greatly increases the number of end-points potentially exposed to threats. However, the future is likely to bring even more complexity, especially if virtual and augmented reality technologies continue their march. These are still in relative early stages and have so far had the most immediate impact on the gaming world through the likes of Oculus Rift and PlayStation VR. However,

this has enormous potential for many different areas, including business. Retailers have made use of VR to create virtual shopping spaces that buyers can move through and make selections. Moving further into the future, professionals may be able to communicate face-to-face in a virtual world, even if they are located many miles apart. One person could be based in the US, another in China, and yet they can still walk side by side in the virtual space. The possibilities are exciting but this will create more complexity, more routes of attack and more challenges for the end-point security market. Developing a secure system for the future will be difficult. Success will depend on the ability to predict the future, foresee new threats and adapt defenses accordingly – all without comprising or interrupting existing systems. To do so, IT managers will need solutions which are flexible and able to fit in around their existing requirements. The market will change to reward those systems capable of offering flexible all-inone systems which meet those requirements. Managers will need to know what’s available and understand the direction of the market.

Choosing the best system will be a challenge especially as, despite the publicity surrounding threat detection, many companies remain woefully ill-prepared for the assaults they are likely to face

14 | WWW.CEOREPORTS.COM

ENDPOINT SECURITY SOLUTIONS FOR MODERN ENTERPRISE IT AND DATA PROTECTION

References: Growth of Enterprise IT: http://www.gartner.com/newsroom/id/3119717

Public Cloud Computing Growing Almost 50% Annually:

http://www.forbes.com/sites/joemckendrick/2016/05/31/public-cloud-computing-growing-almost-50-percent-annually-cisco-says/#201bdfd62273 3

Adult Friend Finder and Penthouse Hacked:

http://bit.ly/2jbT94B 4

EU Data Protection Regulation Fines up to e100 million Proposed:

http://bit.ly/2hXQ0t2 5

Draft Investigatory Powers Bill: What You Need to Know:

http://www.computerworlduk.com/security/draft-investigatory-powers-bill-what-you-need-know-3629116/ 6

Tech Firm Says it is Quitting the UK: https://www.grahamcluley.com/technology-firm-surveillance/

Surveys: Employees at Fault in Majority of Breaches:

http://www.csoonline.com/article/2908475/security-awareness/surveys-employees-at-fault-in-majority-of-breaches.html 8

Managing Insider Risk: http://www.experian.com/assets/data-breach/white-papers/experian-2016-ponemon-insider-risk-report.pdf

Employees Account for 43% of Data Breeches:

https://www.scmagazine.com/external-hackers-and-internal-employees-pose-data-breach-threat/article/533602/ 10

HSBC Loses Customer Data Discs: http://news.bbc.co.uk/1/hi/business/7334249.stm

Bank of America Loses Customer Data:

http://www.nbcnews.com/id/7032779/ns/technology_and_science-security/t/bank-america-loses-customer-data/#.WFkMVfmLTIU 12

Lost in the Post: https://www.theguardian.com/politics/2007/nov/21/immigrationpolicy.economy3

Anti Virus Software is Dead: https://www.theguardian.com/technology/2014/may/06/antivirus-software-fails-catch-attacks-security-expert-symantec

Success Story ARZ: https://www.drivelock.com/customer-success-arz.html

End-point Security Market Worth $17.38bn by 2020: http://www.marketsandmarkets.com/PressReleases/endpoint-security.asp

Two Thirds of Global Organisations Are Not Prepared to Recover from Cyber Attacks:

http://www.canadianunderwriter.ca/insurance/two-thirds-global-organizations-not-prepared-recover-cyberattacks-ibm-ponemon-institute-study-1004103784/

WWW.CEOREPORTS.COM | 15

ENDPOINT SECURITY SOLUTIONS FOR MODERN ENTERPRISE IT AND DATA PROTECTION

Notes:

16 | WWW.CEOREPORTS.COM

CEOs Find Solutions To Their Business Challenges With CEO Reports

For the past decade, CEO Reports has been helping CEOs and their management teams to find new solutions to their commercial, technical and operational challenges. Our Special Reports provide readers with an unparalleled depth of information on specialist subjects, which receive limited coverage in the mainstream business media. Each report is designed to help CEOs to make more effective business decisions, by providing a unique mix of: • Subject specific technical information • Insight and knowledge from internationally recognised key opinion leaders • Independent data and analysis • Unbiased editorial content

subscriptions@globalbusinessmedia.org www.globalbusinessmedia.org