Companies face multiple threats as the security landscape continues to evolve. But how can they get to grips with the cyber risks they face and a record number of data breaches? Taken together, all areas of risk and security are essential in modern businesses: from IT and physical systems to cybersecurity and personal protection. But if they aren’t implemented correctly, they all have the potential to cause problems, and one of them is a source of recurring headlines.
According to the Identity Theft Resource Centre, there were 1,862 data breaches last year, up more than 68 percent from 2020 and breaking the previous record of 1,506, set in 2017. Organizations are continually being compromised, held to ransom or have their data stolen and made available on the dark web to the highest bidder.
If a ransom is paid, for example, the crisis does not end there: Protiviti has seen up to four ransom demands made to the same company, and the fines that some have to pay has been staggering, let alone the damage to reputations and brands.
It is clear these trends are not going to stop anytime soon, so questions need to be asked: Why is this happening? What are organizations doing to address the situation? Why do some think “it won’t happen to me,” simply because they are not a major brand?
What is happening behind the scenes?
Organizations are very quick to talk about tools and products. Security professionals are often addicted to tools to solve their problems. They might say, for example, “we are looking at X product,” rather than “we are defining our IT risk, security and compliance management strategy. We have all these solutions doing a job to keep us safe. They cross over, but we are not using all their functionality, and need certified individuals to manage and maintain them. The integration is substandard in some areas, but, ultimately, we think we have visibility across the enterprise.”
It is also common to hear of security professionals being tired of reacting to incidents, rather than adding value to a business by driving a security strategy forward.
The chief information security officer (CISO) takes ownership of these areas, but things are quickly taken out of their hands if a major breach occurs and publicity hits the market. Suddenly the chief operating officer (COO) is involved – often directed by the chief executive (CEO) and the chief financial officer (CFO) – reviewing processes and working practices.
The chief information officer (CIO) will calm the situation, motivate staff, while potentially watching the sales pipeline evaporate. The CFO will manage the financial implications of a ransom demand and any looming fines, while the CEO will explain to customers, staff and the market what they are doing about it.
Security is not a technology issue; it is a business issue, and if the leadership team is not actively understanding why it matters, they are setting up the organization for failure.
Consolidating security platforms with Microsoft
“Security and risk management leaders continue to be asked to do more with less — facing more demand for service, fast-changing threat landscapes and insufficient technical talent.” according to Gartner®
Gartner® says: “By 2025, 80% of enterprises will have adopted a strategy to unify web, cloud services and private application access from a single vendor’s security service edge platform.” Further it states, “Driven by the need to reduce complexity, leverage commonalities and minimise management overhead, security technology convergence is accelerating across multiple disciplines.”*
Looking at the market, Microsoft is best placed to take advantage of this shift. Yes, the company is a relative newcomer to security, but it has a strong commitment from chief executive, Satya Nadella, to invest $20 billion into security over the next five years.
For organizations who are looking to simplify their environments, strip out complexity, enhance visibility and do more with less – while maximizing the investment they have already made, the Microsoft security platform may be the right choice. It looks as though Microsoft will very quickly become a best-of-breed provider as these cloud-based platforms are innovating fast.
It already has five magic quadrant security products: in access management, endpoint management, cloud access security brokers, information archiving and endpoint protection. The company has also released Microsoft Priva, a new privacy management solution, which will accelerate rapidly.
What should happen now?
The risk and security landscape is broad and deep, but Microsoft is looking to consolidate and commoditize its approach, which will be a relief to most companies. But there is work to do for everyone involved to make this a success.
As Microsoft develops its approach to security, industry partners will help customers deliver their consolidated vision. 95% of organizations have existing systems in place – they are brownfield sites – but software companies like Microsoft usually treat clients like they have a clean sheet, a greenfield site.
Software companies can therefore become frustrated when clients are unable to operate within their time frames; so, partners can develop a roadmap that helps clients commit to software releases each month, for example, for one to two years.
Service partners also need to help clients with their priorities, as they extract themselves from contracts, and find the right skills to run and managed consolidated systems.
It is going to be interesting to see how the race for consolidated security platforms pans out. But Microsoft and its industry partners are well placed to reduce the number of headlines about cybersecurity – and help companies to see the bigger picture.
To learn more about our Microsoft consulting solutions, contact us.
*Gartner “Predicts 2022: Consolidated Security Platforms Are the Future,” Charlie Winckless, et al, December 1, 2021. GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.
