In the the last twelve months we’ve witnessed the highest rates of data theft disclosures since the record setting year of 2008 (including, for the first time in public, Rich’s credit card). So predictably there will be plenty of FUD balloons flying at this year’s conference. From Anonymous to the never-ending Wikileaks fallout and cloud fears, there is no shortage of chatter about data security (or “data governance” for people who prefer to write about protecting stuff instead of actually protecting it).
Guess Mr. Market is deciding what’s really important, and it usually aligns with the headlines of the week. But you know us, we still think Data Security is pretty critial and all this attention is actually starting to drive things in a positive direction, as opposed to the days of thinking data security meant SSL + email filtering.
Here are five areas of interest at the show for data security:
Da Cloud and Virtual Private Storage
The top two issues we hear most organizations cite when they are concerned about moving to cloud computing, especially public cloud, are data security and compliance. While we aren’t lawyers or auditors, we have a good idea how data security is playing out. The question shouldn’t be to move or not to move, but should be how to adopt cloud computing securely. The good news is you can often use your existing encryption and key management infrastructure to encrypt data and then store it in a public cloud. Novel, eh? We call it Virtual Private Storage, just as VPNs use encryption to protect communications over a public resource.
Many enterprises want to take advantage of cheap (maybe) public cloud computing resources, but compliance and security fears still hold them back. Some firms choose instead to build a private cloud using their own gear or request a private cloud from a public cloud provider (even Amazon will sell you dedicated racks… for a price). But the virtual private storage movement seems to be a hit with early adopters, with companies able to enjoy elastic cloud storage goodness, leveraging cloud storage cost economies instead of growing (and throwing money into) their SAN/NAS investment, and avoiding many of the security concerns inherent to multi-tenant environments. Amazon AWS quietly productized a solution for this a few months back, making it even easier to get your data into their cloud, securely. Plus most encryption and key management vendors have basic IaaS support in current products for private and hybrid clouds, with some better public cloud coverage on the way.
Big is the New Big
The machine is hungry – must feed the machine! Smart phones sending app data and geolocation data, discreet marketing spyware and web site tracking tools are generating a mass of consumer data increasingly stored in big data and NoSQL databases for analysis, never mind all the enterprises linking together previously-disparate data for analysis.
There will be lots of noise about about Big Data and security at RSAC, but most of it is hype. Many security vendors don’t even realize Big Data refers to a specific set of technologies and not any large storage repository. Plus, a lot of the people collecting and using Big Data have no real interest in securing that data; only getting more data and pumping into more sophisticated analysis models. And most of the off-the-shelf security technologies won’t work in a Big Data environment or the endpoints where the data is collected.
And let’s also not confuse Big Data from the user standpoint, which as described above, as massive analysis of sensitive business information, with Big Security Data. You’ll also hear a lot about more effectively analyzing the scads of security data collected, but that’s different. We discussed that a bit in our Key Themes section.
Masking
It’s a simple technology that scrambles data. It’s been around for many years and has been used widely to create safe test data from production databases. But the growth in this market over the last two years leads us to believe that masking vendors will have a bigger presence at the RSA show. No, not as big as firewalls, but these are definitely folks you should be looking at. Fueling the growth is the ability to effectively protect large complex data sets in a way that encryption and masking technologies have not. For example, encrypting a Hadoop cluster is usually neither feasible nor desirable. Second, the development of dynamic masking and ‘in place’ masking variants are easier to use than many ETL solutions. Expect to hear about masking from both big and small vendors during the show. We touched on this in the Compliance section as well.
Big Brother and iOS
Data Loss Prevention will still have a big presence this year both in terms of the dedicated tools and the DLP-Lite features being added to everything from your firewall to the Moscone beverage stations. But there are also new technologies keeping an eye on how users work with data- from Database Activity Monitoring (which we now call Database Security Platforms, and Gartner calls Database Audit and Protection), to File Activity Monitoring, to new endpoint and cloud-oriented tools. Also expect a lot of talk about protecting data from those evil iPhones and iPads.
Breaking down the trend what we will see are more tools offering more monitoring in more places. Some of these will be content aware, while others will merely watch access patterns and activities. A key differentiator will be how well their analytics work, and how well they tie to directory servers to identify the real users behind what’s going on. This is more evolution than revolution, and be cautious with products that claim new data protection features but really haven’t added content analysis or other information-centric technology.
As for iOS, Apple’s App Store restrictions are forcing the vendors to get creative. you’ll see a mix of folks doing little more than mobile device management, while others are focusing on really supporting mobility with well-designed portals and sandboxes that still allow the users to work on their devices. To be honest, this one is a tough problem.
Comments