Security Managers

Point of View Security Managers: Your Livelihood Is at Stake Increasing Business Relevance While Improving Security Effectiveness By Chuck Adams, Business Resiliency Practice, and Joanne Bethlahmy, Retail Practice, Cisco IBSG When the economy turns south, so does the professional well-being of security experts—if they aren’t able to reinvent themselves. In these times of economic uncertainty, it is imperative that everyone deliver maximum value against organizational objectives. Security personnel (physical and cyber) are no exception. Even though security spending is expected to remain strong due to evolving threats and anticipated compliance challenges,1 security organizations continue to be viewed solely as protection or loss-prevention mechanisms. Often they are considered a “necessary evil” with little value to the organization beyond security.2 This is especially true when they struggle to keep pace with industry trends and business strategies. These continuing perceptions put security resources at risk. Additionally, leadership seldom consults with the security team for new market opportunities or insights on increasing organizational efficiency. Recent developments in the security realm, however, begin to paint some interesting possibilities. Trends of particular interest are the migration from analog to digital for video surveillance, the innovation explosion in video analytics, and the convergence of traditionally isolated security functions onto a consolidated, connected platform. More interesting than any of these single-dimensional trends, however, is what they represent when converged into a consolidated risk-management function. This possibility is far beyond merely protecting and preserving assets. There are numerous applications for intelligence that can be garnered from the next-generation unified risk-management function. The possibilities are enormous and have the potential to extend throughout the value chain for every business, operation, and industry across the globe. This paper illustrates some of these possibilities. Security Market Is Fragmented and Confusing First, it is important to understand that the security industry has existed as long as “distrust.” Some say the industry had its beginnings in the days of Judas.3 Although the vast majority of people claim to know very little about this industry, those same people employ security mechanisms hundreds of times a day. Everything ranging from seat belts and airbags to bicycle helmets and business contracts are mechanisms that relieve some level of risk. Cisco Internet Business Solutions Group (IBSG) Cisco IBSG Copyright © 2009 Cisco Systems, Inc. All rights reserved. 05/09 Point of View Equally, cyber security was not created when Al Gore “invented the Internet.”4 The Internet and associated technologies are simply another communication medium that must also be secured. Security technologies are simply those that offer advantages of task and control automation for protecting information. It is the use of the information within the systems, however, that is often the cause of security issues. Initially, security will always be valued as supplemental to the information required by core functions. But as security practices become accepted, it is reasonable to expect they will be absorbed into the core functions themselves. By contrast, both cyber and physical security industry organizations continue to be myopic in making security investment decisions. Buying decisions are seemingly made in a disjointed manner with little consideration for interoperation or alignment with overall organizational objectives or risk-management strategies. These decisions tend to be emotional and reactionary, following a process that often is referred to as “management by magazine.”5 This occurs when a CIO or CEO happens to review the claims of the latest security product in an airplane magazine and subsequently gives the article to his security leader. Next thing you know, another disparate product is deployed, more money is spent, and the protections are no more effective at combating the real risks. Even most industry analysts—objective experts at tracking market trends—tend to follow only select segments of the security marketplace. Analysts define cyber and physical security as separate industries, and cover them as such. This is ironic for two reasons: (1) the industries have more similarities than differences, and (2) when combined, these industries represent one of the most interesting investment opportunities, with one of the best growth records.6 In effect, the analysts’ segmented focus continually pits various security and risk- management organizations against one another. They are essentially competing for the same dollars and, in some cases, duplicating resources. These disparities result in even more market fragmentation and confusion about who is doing what to protect the organization. Libraries of methods and best practices to protect and preserve physical and cyber assets already exist. The overall physical security market was estimated at roughly US$170 billion7 in 2007. The same report estimates that services make up about 45 percent of this market. This means the global spend on services such as assessments, patrol guards, viewing of video surveillance monitors, intelligence collection, integration, evidence analysis, and investigations support totals about $75 billion, with products and technologies representing the remaining $95 billion. This spending, however, seems to have had little effect. Global cyber security expenditures have topped US$20 billion8 yearly, yet losses associated with cyber security attacks exceeded US$1 trillion in 2008.9 For a physical security analog, simply look at the September 11th experiences. Although U.S. spending exceeded $329 billion10 for national defense in 2001, the country remained vulnerable to situations that resulted in thousands of casualties and untold economic losses. In addition to causing concerns about professional well-being, economic uncertainty also creates a need for organizations to make timely, high-impact decisions. These decision- making processes are often emotionally charged and seldom based on ideal information. For most technology-enabled organizations, this information probably exists in some form Cisco IBSG Copyright © 2009 Cisco Systems, Inc. All rights reserved. Page 2 Point of View within their technologies. But for some reason, it is not produced in a manner that enables this decision-making process. While much innovation is occurring in the areas of data analytics, the inability to collect and analyze data is the root cause for many of the challenges organizations face today. These dynamics lead to the conclusion that we are doing something fundamentally wrong in security; our investments are of questionable value, and the traditional security framework must change. If it doesn’t, confidence in the security industry will surely wane, placing all security resources in a position of professional vulnerability. Security Organizations Are Skilled in Data Collection and Analysis As described, the security industry is both complex and confusing. There are no magic wands—just a lot of hard work that requires vested leadership, focus, and strong convictions. It is solely up to security leadership to determine the right strategy, define objectives, and choose which products and services are most important to accomplish their objectives. They must also continuously manage inaccurate perceptions between the current security posture and worst-case scenarios, while continuing to justify investments and build credibility for security. Security technologies continue to evolve to fill gaps in the existing “problem-scape.” But the security group’s ability to use them to benefit the business remains the key. When security issues occur and resources are impacted, organizations lose productivity, resource availability, and, potentially, brand value. These issues—physical or logical—have the potential to detrimentally affect the resources on which an organization relies to deliver against its objectives. Therefore, all risks to the organization must be evaluated in a manner that assures a level of resilience aligned with organizational objectives. Mature security organizations thrive when challenged to find the proverbial “needle in a haystack.” Their data collection and analysis methods, when oriented to problems being considered by leadership, can deliver considerable value. Additionally, the digitization and networked ability of next-generation video surveillance technologies create the opportunity to enhance the quality and volume of information available for analysis. This approach also introduces potential enhancements and efficiencies that can be achieved by consolidating security resources across physical and logical functions. With the advent of IP video, physical security can surely benefit from traditional cyber security analysis methods, and vice versa. Organizations must work closely together, share models, and integrate their functionality to complete the overall risk-management picture. But the most significant opportunity for security is somewhat hidden in the implications of these technology trends. Keep in mind the estimated annual size (about US$75 billion) of the services portion of the overall security market as it begins to define the opportunity for thinking a little differently about the security organization. The most interesting and closely related technology trend is the migration

Load more