Gartner Says Organizations Must Prepare For The Security Implications Of The Digital Workplace

Gartner Says Organizations Must Prepare For The Security Implications Of The Digital Workplace

PRESS RELEASE – STAMFORD, Conn., June 9, 2014

Gartner Says Organizations Must Prepare For The Security Implications Of The Digital Workplace

gartner-logo

Analysts to Focus on Top Security Trends at Gartner’s 2014 Security and Risk Management Summits, June 23-26 in National Harbor, MD, August 25-26 in Sydney, September 8-9 in London and September 15-16 in Dubai

Increasing adoption of a more mobile, social, data-driven and consumer-like workplace is causing the breakdown of traditional security models and strategies, according to Gartner, Inc. Gartner predicts that by 2018, 25 percent of large organizations will have an explicit strategy to make their corporate computing environments similar to a consumer computing experience. Security organizations and leaders that fail to alter strategies to accommodate a more consumerized workforce will be sidelined by engaged organizations.

Tom-ScholtzSignificant changes that impact an organization’s approach to security are underway,” said Tom Scholtz, vice president and Gartner Fellow. “Employee digital literacy has led to a growing consumerization movement within most enterprises, with employees using a wide variety of consumer-oriented apps for business purposes. Other workplace trends — such as out-tasking, globalization, networked reporting structures, shadow IT and a desire to foster employee engagement — are all impacting IT strategies. As organizations shift toward a more digital workplace, long-held approaches to security need to be re-examined.

“Implementation of a digital workplace exacerbates the IT department’s loss of control over endpoint devices, servers, the network and applications,” said Mr. Scholtz. “In a fully consumerized workplace, the information layer becomes the primary infrastructure focal point for security control. This reality necessitates a shift toward a more information-focused security strategy.”

The sheer volume of devices and access vectors implied by a digital workplace, coupled with the increase in sophisticated, dynamic attack methods and insider threats, makes the traditional approach of focusing on preventive controls (such as signature-based anti-malware, network and host intrusion prevention systems, pervasive encryption and continuous patching) increasingly ineffective. While the value of and need for preventive controls will never go away, the digital workplace reinforces the need to focus more on detective and reactive controls. In practice, this means increasing investments in context-aware security monitoring for internal and external environments, threat intelligence assessment capabilities and incident response. Pervasive, context-based monitoring and security information analytics will form the core of next-generation security architectures.

Strategies such as the digital workplace implicitly recognize that users will be given more freedom in how they use technology and information. This implies a higher level of trust that users will exhibit appropriate behavior in dealing with enterprises’ information resources. Key elements of a behavior-focused security communication strategy include considering “just in time” security awareness techniques, which remediate or reward user behavior based on the appropriateness of that behavior within the user’s context.

Effective behavior management is not produced by the mere deployment of an education program,” said Mr. Scholtz. “In addition to an education program that is focused on measurable behavioral outcomes, security leaders should develop their ability to collaborate with personnel and line-of-business managers to modify job descriptions and reward mechanisms so that they are aligned with desired security performance.”

Gartner believes that trusting the motives and behavior of individual users is a key enabler for the digital workplace. Conventional approaches to information security tend to treat everyone, including employees, with distrust. By implication, such an attitude will impede the digital workplace. However, a more people-centric approach to security will contribute to the potential success of the initiative. People-centric security (PCS) is a strategic approach to information security that emphasizes individual accountability and trust, and that de-emphasizes restrictive, preventive security controls.

PCS is based on a set of key principles, and on the rights and related responsibilities of individuals. The premise of PCS is that employees have certain rights — but these are linked to specific responsibilities. These rights and responsibilities are based on an understanding that, if an individual does not fulfill his or her responsibilities, or does not behave in a manner that respects the rights of colleagues and the stakeholders of the enterprise, then the individual will be subject to sanction. While a wholesale PCS strategy is certainly inadvisable for many organizations, it is certainly a viable concept that should be considered as part of the digital workplace.

The digital workplace implies new and different security risks,” said Mr. Scholtz. “Hence, it is imperative for the impact of the digital workplace to be properly risk-assessed. Owners of information assets involved in the initiative must be informed of the risks, and the security team must help them assess the potential impact of the risks against the expected business benefits of the digital workplace. Also, the affected information owners must sign off on any additional risk that they are willing to accept in the interest of the digital workplace.

More detailed analysis is available in the report “Prepare for the Security Implications of the Digital Workplace.” The report is available on Gartner’s website at http://www.gartner.com/doc/2720217.

This research is part of the Gartner special report “The Nexus of Forces: Social, Mobile, Cloud and Information.” The report is available on Gartner’s website at http://www.gartner.com/technology/research/nexus-of-forces. It includes links to reports, webinars and video commentary that examine the impact of the Nexus of Forces on enterprises.

About Gartner Security & Risk Management Summit

Gartner analysts will take a deeper look at the outlook for security solutions at the Gartner Security & Risk Management Summits taking place June 23-26 in National Harbor, Maryland, August 25-26 in Sydney, Australia, September 8-9 in London, U.K and September 15-16 in Dubai, UAE. More information on the U.S. event can be found at www.gartner.com/us/securityrisk. Details on the Australia event are at http://www.gartner.com/technology/summits/apac/security/. More information on the U.K. event is at http://www.gartner.com/technology/summits/emea/security. Details on the Dubai Summit are at http://www.gartner.com/technology/summits/emea/security-dubai.

Gartner, Inc. (NYSE: IT) is the world’s leading information technology research and advisory company. Gartner delivers the technology-related insight necessary for its clients to make the right decisions, every day. From CIOs and senior IT leaders in corporations and government agencies, to business leaders in high-tech and telecom enterprises and professional services firms, to technology investors, Gartner is a valuable partner in more than 14,000 distinct organizations. Through the resources of Gartner Research, Gartner Executive Programs, Gartner Consulting and Gartner Events, Gartner works with every client to research, analyze and interpret the business of IT within the context of their individual role. Founded in 1979, Gartner is headquartered in Stamford, Connecticut, USA, and has 6,100 associates, including more than 1,460 research analysts and consultants, and clients in 85 countries. For more information, visit: www.gartner.com.

About CloudTweaks

Established in 2009, CloudTweaks is recognized as one of the leading authorities in connected technology information and services.

We embrace and instill thought leadership insights, relevant and timely news related stories, unbiased benchmark reporting as well as offer green/cleantech learning and consultive services around the world.

Our vision is to create awareness and to help find innovative ways to connect our planet in a positive eco-friendly manner.

In the meantime, you may connect with CloudTweaks by following and sharing our resources.

View All Articles

Sorry, comments are closed for this post.

Why Cloud Compliance Doesn’t Need To Be So Overly Complicated

Why Cloud Compliance Doesn’t Need To Be So Overly Complicated

Cloud Compliance  Regulatory compliance is an issue that has not only weighed heavily on the minds of executives, security and audit teams, but also today, even end users. Public cloud adds more complexity when varying degrees of infrastructure (depending on the cloud model) and data fall out of the hands of the company and into…

Is Your Corporate Data Appearing On Personal Clouds?

Is Your Corporate Data Appearing On Personal Clouds?

Corporate Data Appearing On Personal Clouds Enterprise cloud adoption has led to cloud consumerization, but how safe is any personal cloud? Remember when you’d join a company and they’d issue a desktop computer and corporate-issued cell phone? And remember all the company’s data was stored in a server on-site at the company? It’s fair to…

The Four C’s – Cloud, Culture, Clash, Change

The Four C’s – Cloud, Culture, Clash, Change

The Cloud, Culture, Clash, Change “I told the new CTO that this cloud stuff was BS. He came charging in with this ‘cloud first policy’ and look what happened. Previously rock solid systems that had worked for years slowed down and had outages as we tried to run them on the cloud. I doubt that…

All Enterprises Should Model Themselves After Today’s Startups

All Enterprises Should Model Themselves After Today’s Startups

Startups Leveraging Cloud Services Never in history has it been easier to start a business and fast track growth to dominate a market. Conversely, it has never been possible to transform from market leader to market memory faster than now. New startups are disrupting the market, fast tracking growth and sucker punching the market leaders.…

What Technology Can Displace The Password?

What Technology Can Displace The Password?

The Future Password Many people shout that the password is dead or should be killed dead. The password could be killed, however, only when there is an alternative to the password. Let us think about what technology can displace the password. Some people might say that multi-factor authentications or ID federations will do it. It is not…

New Smartphones From Apple, Samsung and HTC Promise To Light Up 2016

New Smartphones From Apple, Samsung and HTC Promise To Light Up 2016

New Smartphones from Apple, Samsung and HTC (Sponsored post courtesy of Verizon Wireless) The launch of the Galaxy S7 Edge at the Mobile World Congress in Barcelona during February was the first shot in a vintage year for mobile phones. The S7 is an incredible piece of hardware, but launches from HTC and Apple later in the…

Featured Sponsored Articles
How Successful Businesses Ensure Quality Team Communication

How Successful Businesses Ensure Quality Team Communication

Quality Team Communication  (Sponsored post courtesy of Hubgets) Successful team communication and collaboration are as vital to project and overall business success as the quality of products and services an organization develops. We rely on a host of business tools to ensure appropriate customer interactions, sound product manufacturing, and smooth back-end operations. However, the interpersonal relationships…

Featured Sponsored Articles
How To Develop A Business Continuity Plan Using Internet Performance Management

How To Develop A Business Continuity Plan Using Internet Performance Management

Internet Performance Management Planning CDN Performance Series Provided By Dyn In our previous post, we laid out the problems of business continuity and Internet Performance Management in today’s online environment.  In this article, we will take a look at some of the ways you can use traffic steering capabilities to execute business continuity planning and…

Featured Sponsored Articles

CloudTweaks is recognized as one of the leading influencers in cloud computing, infosec, big data and the internet of things (IoT) information. Our goal is to continue to build our growing information portal by providing the best in-depth articles, interviews, event listings, whitepapers, infographics and much more.

Sponsor