Businesses relying on several single-function IT security products are taking a ‘scattergun’ approach to protecting their networks that is outdated and inefficient, a new analyst report has warned.
According to the Butler Group, a European IT research and advisory firm, the security sector is already overpopulated with disconnected, point-based, protection systems – tools that are designed to handle one particular threat. However, this approach leaves vulnerabilities that could be exploited.
The report, entitled Security Management, found there is a need for integrated security services that pull together and control these various products. This comes from several factors: one is the fact that a single unprotected area of an organisation’s network is enough to leave it open to attack. Another is the growing need to comply with regulations.
Organisations must recognise that security solutions and services are necessary to deliver joined-up enterprise security, the report emphasised. However, no single software or security vendor can deal with all the issues that are being raised under the banner of ‘security management’, it added.
Andrew Kellett, a Butler Group senior research analyst and co-author of the study, commented: “It is time for all end-user organisations to demand a better future from the suppliers of mainstream security solutions. Today’s fragmented delivery of IT security services is not good enough and must be replaced with a more integrated and manageable approach. Enterprise security needs to become more of a business enabler and provide protection services that have the flexibility to grow and change alongside the business operations that it is put in place to protect.”
In future, it will no longer be good enough for security vendors to simply sell products, the report concluded. According to the Butler Group’s analysis, the core elements of a security management model are that suppliers must be able to provide integrated solutions that are secure and strong in the levels of protection that they deliver. In addition, the information that these systems provide must be measurable and provable.
The report findings were echoed by John Roese, chief technology officer with Enterasys Networks. Speaking in Dublin last week at a security briefing organised by Hewlett-Packard, he said buying single-purpose products to solve particular problems was no longer the best approach to tackling IT security. “If we continue to buy products for every problem, we’ll quickly run out of budget, time and staff,” he stated.
“There are too many problems out there to solve with point solutions. Don’t use the technology of the day to solve the problem of the day. Find the five or 10 problems you’re dealing with and see which solution will solve most problems rather than one problem. That’s a better solution, long term.”
By Gordon Smith
