Hail Mary passes and walk-off home runs are game-changing plays, but their impact is limited to one game. In these cases, the underlying game changers were the introduction of the forward pass and the lively baseball. Information technology has its own game-changing elements, most recently mobility and cloud computing. However, information security has yet to match these technologies — which limits their effectiveness and diminishes overall security. Maintaining enterprise security requires a similar evolution of security capabilities.

Mobility and cloud computing has decentralized the role of IT and fundamentally changed the way people work, how business is conducted and the value of connectivity.

IT Is Outpacing Security

The proliferation (and user acceptance) of mobile devices and easily accessible cloud-based applications entice lines of business (LoBs) to find their own solutions. The rise of shadow IT allows executives to quickly adjust to a volatile business environment. Scalability, elasticity and cost benefits are the hallmarks of cloud computing that are moving information technology from a supporting function to one that enables the quick delivery of new products and services.

However, IT security is being left behind. It has become extremely difficult for organizations to exercise full control over their data and applications as they proliferate on multiple devices, reside in the cloud and cross into social networks. Existing security controls have difficulty identifying legitimate users since the number of such users has grown. New distributed architectures are hard to secure, so organizations struggle to match identity management, data confidentiality and availability with user needs and expectations.

The Fortress Mentality Is Ineffective

IT security is important to protect the IT infrastructure, information and transactions. There are many standards and regulations, especially those relative to customer privacy, which organizations are required to follow. Historically, security capabilities are designed to build a fortress around systems and data. The proliferation of devices, applications, authorized users and network connections vastly expands attack surfaces. Attackers are also utilizing new technologies, and thus the fortress security model has become untenable with a security infrastructure that is not designed to handle mobility and cloud computing.

Some organizations will resist change, but the old command-and-control approach, which could be enforced within a traditional enterprise, will not survive in the extended enterprise. Organizations instead will need to relinquish old control models and shift to an open and integrated framework that provides the flexibility to securely enable advanced IT tools.

Security for Cloud Applications and Enablement

The forward pass and lively baseball transformed the way their games were played — and the end result of them — but not the underlying foundations of the sports. Any future game-changing security product will be on that same level. They will drastically modify the security fortress mentality by improving the security proposition behind the expanded enterprise.

To be successful in a cloud-centric domain, security must be able to mitigate risk while being able to handle the demands of this evolving IT environment driven by individual productivity. Providing security for cloud enablement needs to include a flexible platform to provide visibility, identity management, policy enforcement and threat mitigation across multiple cloud services.

Innovators Required

The building blocks to construct an efficient and effective cloud security gateway exists in pieces, and it will take an innovator who has all the building blocks and the wherewithal to pull them together to deliver it. The forward pass and lively baseball were game changers, but it took a Pop Warner and a Babe Ruth to recognize them as such, and to use their considerable talents to set the transformations in motion. IBM Security, as a leading provider of identity and access management, mobile security, security intelligence, intrusion prevention and application security, has all of the building blocks, which, when coupled with infrastructure mobility and cloud solutions, is poised to be the innovator that can dramatically change the way mobile and cloud computing security is provided.

Read the IDC white paper: A CISO’s Guide to Enabling a Cloud Security Strategy

More from Cloud Security

The importance of Infrastructure as Code (IaC) when Securing cloud environments

4 min read - According to the 2023 Thales Data Threat Report, 55% of organizations experiencing a data breach have reported “human error” as the primary cause. This is further compounded by organizations now facing attacks from increasingly sophisticated cyber criminals with a wide range of automated tools. As organizations move more of their operations to the cloud, they must also become increasingly aware of the security risks and threats that come with it. It’s not enough anymore to simply have a set of…

How I got started: Cloud security engineer

3 min read - In today’s increasingly cloud-focused business environment, cloud security engineers are pivotal in protecting an organization’s critical data and infrastructure. As experts in cloud security, they leverage their expertise to ensure that the ever-expanding amount of cloud data is safe from emerging threats and vulnerabilities. Cloud security professionals combine their passion for technology with a deep understanding of security principles to design and implement robust cloud security strategies. What experience do these security experts have, and what led them to the…

“Authorized” to break in: Adversaries use valid credentials to compromise cloud environments

4 min read - Overprivileged plaintext credentials left on display in 33% of X-Force adversary simulations Adversaries are constantly seeking to improve their productivity margins, but new data from IBM X-Force suggests they aren’t exclusively leaning on sophistication to do so. Simple yet reliable tactics that offer ease of use and often direct access to privileged environments are still heavily relied upon. Today X-Force released the 2023 Cloud Threat Landscape Report, detailing common trends and top threats observed against cloud environments over the past…

Lessons learned from the Microsoft Cloud breach

3 min read - In early July, the news broke that threat actors in China used a Microsoft security flaw to execute highly targeted and sophisticated espionage against dozens of entities. Victims included the U.S. Commerce Secretary, several U.S. State Department officials and other organizations not yet publicly named. Officials and researchers alike are concerned that Microsoft products were again used to pull off an intelligence coup, such as during the SolarWinds incident. In the wake of the breach, the Department of Homeland Security…