At Cisco, we’ve talked a lot of late about business trends that are creating the need for “Borderless Networks.” Businesses have increasingly mobile and global workforces that need to be able to connect anywhere, at any time, from any device. But these same business trends and the technological innovations working in tandem to support them introduce a dilemma. How do we build seamless networks that are also secure to address new opportunities?
In 2010 and beyond, there are three major on-going developments in both workforce behavior and technology that will present challenges to the security of the network:
1. The workforce today is much more dynamic and distributed than it ever has been. With more employees geographically displaced, telecommuting from home or away from a central network, sensitive data and network infrastructure is more vulnerable to attack. A greater distribution of network entry points and critical resources on the network means a greater number of opportunities for hackers to cause disruptions and more challenges to apply a consistent policy with enforcement. A growing “always on” user expectation means not only 24x7 business resource availability to employees, but also hassle-free and yet secure network access for business partners, vendors, contractors and other visiting guests.
2. More enterprises are using productivity enhancement tools and solutions such as virtualization and cloud computing. More applications and services are delivered via the web, making the adage “HTTP is the new TCP” increasingly true. While these new technologies are going to be vital for networks that break through location and application borders, the movement of information beyond the traditional firewall presents risks to the security of sensitive data. More emphasis will be placed on intelligence, controls and user identity based service delivery.
3. IT consumerization, or the transfer of consumer technologies and applications into the enterprise, is accelerating. According to a Forrester study reported in ComputerWorld, the number of “information workers” in the U.S. is expected to grow to 63 million by 2016 and 11% of that group is already using smartphones at work. However, it is difficult to ensure the compliance of consumer technologies like smartphones to enterprise security policies. It is also difficult for IT departments to manage employee behavior on consumer applications like social networks, where malware disguised as shortened URLs and unfiltered webpages are common.
Rather than shunning these trends, businesses will work toward more efficient solutions to mitigate the risks posed by network innovation. Part of the problem needs to be addressed through education -- don’t click on suspicious links, follow certain procedures in the cloud, etc. But education alone won’t fight the whole battle. Technology needs to evolve to expand the scope of how we enforce consistent security policies across the network, or even when users are away from the corporate network
In 2010, how will you assess devices like iPhones requesting access to your corporate network? If they pose a threat, will you block them from the internal network or deny Internet access altogether? How will you track down and fend off Internet malware before it enters your network and causes damage? How will you protect your mobile workforce and your visiting network users, and in turn, the integrity of your entire network? How will you secure your sales records and customer databases in the cloud? These are all questions that businesses will have to address when establishing comprehensive security architectures.
For more information on security issues in 2010, check out Cisco’s Annual Security Report.