Analysts Discuss Security Market Trends at Gartner Security & Risk Management Summit 2013, June 10-13 in National Harbor, MD.
As companies continue to expand the technologies they use to improve their overall security, the worldwide security technology and services market is forecast to reach $67.2 billion in 2013, up 8.7 percent from $61.8 billion in 2012, according to Gartner, Inc. The market is expected to grow to more than $86 billion in 2016.
Gartner analysts discussed the outlook for the security market at the Gartner Security & Risk Management Summit, being held here through Thursday.
"With security being one of the top IT concern areas, the prospect of strong continued growth is assured," said Ruggero Contu, research director at Gartner. "The consistent increases in the complexity and volume of targeted attacks, coupled with the necessity of companies to address regulatory or compliance-related issues continue to support healthy security market growth."
Gartner analysts see three main trends shaping the security market moving forward — mobile security, big data and advanced targeted attacks.
Bring your own device (BYOD) is a megatrend that will have a far-reaching influence on the entire security industry. Changes in how security addresses BYOD leaves several opportunities for technology service providers (TSPs). Firstly, with the shift from device security to app/data security there is a chance for some security TSPs to capture endpoint protection budgets. Secondly, since some BYOD projects are centered on the productivity gains of one to two apps, there could be buying centers adding security outside of traditional information technology centers. Finally, being able to understand the device type and how your users are computing today is just as important as who they are. An opportunity exists for those able to determine that context, and provide it for other points of influence, such as the network or applications.
The amount of data required for information security to effectively detect advanced attacks and, at the same time, support new business initiatives, will grow rapidly over the next five years. This growth presents unique challenges when looking for patterns of potential risk across diverse data sources. However, big data, in and of itself, is not the goal. Delivering risk-prioritized actionable insight is.
"To support the growing need for security analytics, changes in information security people, technologies, integration methods and processes will be required, including security data warehousing and analytics capabilities, and an emerging role for security data analysts within leading-edge enterprise information security organizations," said Eric Ahlm, research director at Gartner.
When examining the advanced targeted attack (ATA), and the new methods being used to breach today's security controls, it can be distilled to a basic understanding. Attackers, especially those who have significant financial motivation, have devised effective attack strategies centered on penetrating some of the most commonly deployed security controls (largely signature-based antivirus and signature-based intrusion prevention), most often by using custom or dynamically generated malware for the initial breach and data-gathering phase.
Advanced attackers are now capable of maintaining footholds inside an organization once they successfully breach security controls by actively looking for ways to remain persistent on the target organization's internal network. They do it either through the use of malware or, even if the malware is detected and removed, via postmalware use of user credentials gathered during the period of time the malware was active. They then change their tactics to secondary attack strategies as necessary, looking for other ways around any internal security controls in the event they lose their initial attack foothold.
"Mitigating the threat from ATAs requires a defense-in-depth strategy across multiple security controls," said Lawrence Pingree, research director at Gartner. "Enterprises should employ a defense-in-depth, layered approach model. Organizations must continue to set the security bar higher, reaching beyond many of the existing security and compliance mandates in order to either prevent or detect these newly emergent attacks and persistent penetration strategies. This layered approach is typical of many enterprise organizations and is often managed in independent ways to accomplish stated security goals, namely, detect, prevent, respond and eliminate."
Additional information on the outlook for the security market is available in the Gartner Special Report "The Future of Global Information Security" The special report can be viewed at http://www.gartner.com/technology/research/security-risk-management/ and includes links to reports and commentary that explore the major tectonic forces at play that will change how business use of technology will be dramatically changed by rapid escalations in threat, defense and societal demands.
About the Gartner Security & Risk Management Summit 2013
The Gartner Security & Risk Management Summit 2013 is the premier gathering for senior IT and business executives across IT security and risk management, including privacy, compliance, business continuity management (BCM), IT disaster recovery and business resiliency. The summit offers five role-based programs that delve into the entire spectrum of IT security and risk, including: network and infrastructure security, identity and access management, compliance, privacy, fraud, BCM and resilience.
Gartner Security & Risk Management Summits 2013 will also be taking place August 19-20 in Sydney, Australia and September 18-20 in London, U.K. Details on the Australia event are at http://www.gartner.com/technology/summits/apac/security/. More information on the U.K. event is at http://www.gartner.com/technology/summits/emea/security/.
Information from all Gartner Security & Risk Management Summits 2013 will be shared on Twitter at http://twitter.com/Gartner_inc using #GartnerSEC.
Gartner, Inc. (NYSE: IT), is the world's leading research and advisory company and a member of the S&P 500. We equip business leaders with indispensable insights, advice and tools to achieve their mission-critical priorities and build the successful organizations of tomorrow.
Our unmatched combination of expert-led, practitioner-sourced and data-driven research steers clients toward the right decisions on the issues that matter most. We're trusted as an objective resource and critical partner by more than 15,000 organizations in more than 100 countries—across all major functions, in every industry and enterprise size.
To learn more about how we help decision makers fuel the future of business, visit www.gartner.com.
Comments or opinions expressed on this blog are those of the individual contributors only, and do not necessarily represent the views of Gartner, Inc. or its management. Readers may copy and redistribute blog postings on other blogs, or otherwise for private, non-commercial or journalistic purposes. This content may not be used for any other purposes in any other formats or media. The content on this blog is provided on an "as-is" basis. Gartner shall not be liable for any damages whatsoever arising out of the content or use of this blog.