Trends in Enterprise IT Security

1
Trends in Enterprise IT Security

• Andrew Briney, CISSP
• Editorial Director, Information Security
• October 15, 2003

2
Agenda

• Security Budgets and Spending
• Technologies and Services Hot Not
• What Do You Value Most?
• The Maturing Profession

3
Information Security Polling

• 2003 ISM Annual Survey
• 3,500 IT security professionals
• 2003 ISM Product Survey
• 1,100 IT security professionals
• 2003 SearchSecurity Users Survey
• 372 IT security professionals
• TheInfoPro (TIP), Q3 2003 Survey
• Interviews with 160 senior IT security pros

4
Global IT Security Market
45B
25 CAGR
17B
2001
2006
Source IDC Corp.
5
Budget Changes Since 9/11
51 of organizations have increased spending
Source SearchSecurity
6
Will your IT security budget increase in the next
12 months?
Hosted by

• Yes
• No
• Dont know

Cross-Tab Label
0/0
7
Budget Changes 2002-2003
54 of organizations will increase spending
Source TheInfoPro
8
By how much will your IT security budget increase
in the next 12 months?
Hosted by

• More than 50
• 25 -50
• 10 - 24
• 1 - 9
• No change
• Budget will decrease
• Dont know

Cross-Tab Label
0/0
9
IT vs. Security Budgets
of IT Budgets Devoted to Security
Source Information Security Magazine
10
Hot and Not (1)

• By 2005, AV, FWs and VPNs will be deployed in
  95 of organizations.

• 2001 7 of organizations had BOTH IDS and VA.

• 2005 60 will have both.

Source Information Security Magazine
11
Do you plan to invest in managed security
monitoring services in 2004?
Hosted by

• Yes
• No
• Dont Know/NA

Cross-Tab Label
0 / 500
12
Do you plan to invest in special-purpose security
appliances in 2004?
Hosted by

• Yes
• No
• Dont Know/NA

Cross-Tab Label
0 / 500
13
Hot and Not (2)
In 2003, will you spend more, less or the same
amount on these technology areas?
Source TheInfoPro
14
What do you value most when selecting a security
product?
Hosted by

• Features/functionality
• Fit with current network/data infrastructure
• Its own built-in security
• Price
• Other

Cross-Tab Label
0 / 500
15
Feature Creep
Source Information Security Magazine
16
What do you value most when selecting a security
vendor?
Hosted by

• Technical Support
• Produce leading product
• Financial stability
• Strength of RD
• Breadth of product line
• Other

Cross-Tab Label
0 / 500
17
Vendor Value
Source Information Security Magazine
18
To what extent do regulatory and legal
requirements drive your security actions?
Hosted by

• Never
• Rarely
• Sometimes
• Mostly
• Always
• Dont Know/NA

Cross-Tab Label
0 / 500
19
Regulatory Impact

• To what extent do regulatory and legal
  requirements drive your security actions?

Source Information Security Magazine
20
Proactive Defense

• At what point do you act on an emerging security
  threat?

Source Information Security Magazine
21
Risk Analysis

• What type of risk methodology(ies) do you use?

Source Information Security Magazine
22
Andys Crystal Ball

• 2004 Security Spending Y2K Effect
• Functionality Converges at Perimeter
• Intrusion Defense Gets Smarter
• Profession Continues to Mature

23
Trends in Enterprise IT Security

• Andrew Briney, CISSP
• Editorial Director, Information Security
• October 15, 2003