全球网络安全及风险管理发展趋势SteveRiley

TopSecurityandRiskManagementTrendsfor2019andBeyondSteveRileySr.Director,Analyst—CloudSecurity©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.ThispublicationmaynotbereproducedordistributedinanyformwithoutGartner'spriorwrittenpermission.ItconsistsoftheopinionsofGartner'sresearchorganization,whichshouldnotbeconstruedasstatementsoffact.Whiletheinformationcontainedinthispublicationhasbeenobtainedfromsourcesbelievedtobereliable,Gartnerdisclaimsallwarrantiesastotheaccuracy,pletenessoradequacyofsuchinformation.AlthoughGartnerresearchmayaddresslegalandfinancialissues,Gartnerdoesnotprovidelegalorinvestmentadviceanditsresearchshouldnotbeconstruedorusedassuch.YouraccessanduseofthispublicationaregovernedbyGartner’sUsagePolicy.Gartnerpridesitselfonitsreputationforindependenceandobjectivity.Itsresearchisproducedindependentlybyitsresearchorganizationwithoutinputorinfluencefromanythirdparty.Forfurtherinformation,see"GuidingPrinciplesonIndependenceandObjectivity."3.5xIncreaseinorganizationswith50%oftheirdatainthecloud2018-20201

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.93%aredealingwithroguecloudappusage2

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.3***85%Areinterestedinreplacingpasswordswithnewformsofauthentication©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.Morethan80%ofenterprisewebtrafficwillbeencryptedthrough20194

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.TheControlsofSecurityAreRapidlyShiftingandYourFocusNeedstoShifttoNewApproachesExternalMegaTrendsBeyondYourControlSkillsGapRegulationandPrivacyYourOrganizationAttackersCloudApplicationScaleandplexity6

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.InternalMegaTrendsthatSupportSuccessPerfectpreventionandauthenticationisnotpossible—

Plan,Detect,RespondClouddeliveryisonewaytoaddresstheskillsandscalegapNeedtostepupourgameinmunication7

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.2019Trends8

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.Trend19

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.1.5millionUnfilledglobalcybersecurityrolesexpectedby2020Source:“Solving

the

IoTSecurityTalentGap:WhereYouLookMatters,”

(G00347310);“DataScientistJobs:WhereDoestheBigDataTalentGapLie?”

ITPro10

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.Trend1:FusionofProductsandServices11

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.Trend212

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.33%increasinginvestmentincloud35%decreasinginvestmentsindatacenterSource:OracleandKPMGCloudThreatReport201913

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.Trend2:CloudCenterofExcellenceEmerges14

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.FourPrimaryAreasofInvestmentCloudSecurityCloudWorkloadCloudAccessChiefCloudPostureProtectionSecurityBrokersArchitect&ManagementPlatforms(CASB)SecDevOps(CSPM)(CWPPs)InfrastructurePeople&15PlatformSoftwareProcess©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.Trend316

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.49%Expecttostorethemajorityoftheirdatainapubliccloudby2020Source:OracleandKPMGCloudThreatReport201917

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.71%Reportthatthemajorityoftheircloud-residentdataissensitiveSource:OracleandKPMGCloudThreatReport201918

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.Trend3:DataSecurityGovernanceFramework19

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.DSGFrameworkDon’tStartHere!20CryptoDCAPDLPCASBIAMUEBA4ImplementSecurityProductsDBMSBigDataFilesCloudEndpoint5OrchestratePoliciesforAll

Products©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.DSGFrameworkStartHere!21BusinessStakeholders1BalanceBusinessNeedsVersusRisksBusinessGovernanceplianceITStrategyRiskStrategyTolerance2Identify,PrioritizeandPrioritizeDatasetsManageDatasetLifeCyclesDataPeopleAnalytics3DefineDataSecurityPoliciesCryptoDCAPDLPCASBIAMUEBA4ImplementSecurityProductsDBMSBigDataFilesCloudEndpoint5OrchestratePoliciesforAll

Products©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.Trend422

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.83.9%ofphishingattackstargetedcredentialsforfinancial,email,cloud,payment,andSaaSservicesSource:“2019PhishingTrends&IntelligenceReport:TheGrowingSocialEngineeringThreat,”

PhishLabs23

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.Trend4:DawnofPasswordlessAuthentication24

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.35%ofsmartphoneswilladoptmorethanonebiometricauthenticationmethodby2022Source:“2019PhishingTrends&IntelligenceReport:TheGrowingSocialEngineeringThreat,”

PhishLabs25

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.PasswordlessAuthenticationSecurityKeybyYubico26

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.Trend527

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.70%oforganizationsareunabletoprocessmorethan60%oftheirsecurityeventdata.Source:OracleandKPMGCloudThreatReport201928

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.Trend5:SecurityOperationsCenterRevitalization29

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.3050%ofallSOCswilltransformintomodernSOCswithintegratedincidentresponse,threatintelligenceandthreathuntingcapabilitiesby2022©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.BiggestChallengesNewStaffingAdoptingnewtoolsSIEMvs.EDROrOutsourceRenewedIntegratingthreatintelConsolidatingalertsEstablishingplaybooksAutomatingworkflowSOAR31

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.Trend632

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.Trend6:CartaProliferates33

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.ExamplesRiskAppetiteIntrusionsdetectioninsidetheLANPolicyCARTAInternalprotectionRemediateAssessforemail34

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.Trend735

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.3690%oflargeenterprisesCISOsexpectedtopresentsecurityissuestobusinessleaders.©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.Trend7:RiskAppetiteStatementsEmerge37

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.TheSimpleStoryWedothesethingsSoyoucanhelp

Tosupportaplishyourgoals

theseprinciplesSowecanhelpmanagetheserisks38

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.SampleRiskAppetiteStatementNationalRailSystemhasnoappetiteforsafetyriskexposurethatcouldresultininjuryorlossoflifetopublic,passengersandworkforce.Allsafetytargetsaremetandimprovedyearonyear.Inthepursuitofitsgrowthandmodernizationobjectives,theNRSiswillingtoacceptrisksthatmayresultinsomefinancialloss.39

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.▶

ThinkDifferently▶

ExploreNewOptions▶

ChallengeAssumptions40

©2019Gartner,Inc.and/oritsaffiliates.Allrightsd.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.Top