Aberdeen Group / IT Security

Aberdeen’s research finds that companies who pay attention to security for developed applications – if they pay attention at all -- leverage three distinct strategies:

Inspection (“Find and Fix”)
Additional layers of protection (“Defend and Defer”)
Prevention (“Secure at the Source”)

The trends towards a more dynamic user experience and integration with back-end services are powering even more complex web applications – a rise in enterprise mobile applications as well. All of which makes deciding which approach(es) to use for application security is a multifaceted business decision – one part context, one part judgment, and one part philosophy.

Embedding security from the beginning of the software development lifecycle is not for everyone, but Aberdeen’s research confirms that it does yield the best results. This presentation provides insights into the benefits and tradeoffs of addressing security as part of the software development lifecycle.

This panel will tackle the unique challenges faced by businesses in Financial Services as they try to enter the growing mobile app market. We will bring together perspectives from vendors and researchers focusing on the topic and end users implementing the solutions and dealing with the day-to-day challenges.

Moderator: Derek Brink, Research Fellow, Aberdeen Group
Kevin Morgan, CTO, Arxan Technologies;
John Steven, Internal Chief Technology Officer, Cigital
James Lynn, Practice Principal - Fortify on Demand & Mobile Security Services, HP Enterprise Security

In this short video session, Aberdeen analysts Andrew Borg and Derek Brink address questions about their recent research in the area of Bring Your Own Device (BYOD) and IT Security.

BYOD's rapid adoption is widely discussed, but a thorough examination of its actual cost to the organization has been lacking. Expanding mobile access to the greatest number, within the constraints of capital equipment budgets, is one of the undeniable benefits of a well-managed policy. But BYOD also brings significant challenges: the increasing power and complexity of devices adds to the cost of support; cost controls are disaggregated; and new risks regarding security and compliance.

Aberdeen Group describes a best practices approach to address these concerns, derived from its recent study of more than 560 organizations in 45 countries.

"Right to Choose" vs. "Right to Wipe" – which sounds like a polarizing election-year issue – refers to the tension between enterprise end-users wanting to use their own smartphones and tablets to access enterprise resources, and enterprise IT departments wanting to ensure that they can centrally lock / erase / wipe enterprise data if the device is lost or stolen.

This presentation summarizes an Aberdeen Group analysis of more than 430 organizations, which indicates that end-users are actually most productive and most satisfied when they have the freedoms of BYOD, but within certain boundaries and protections.

Infosecurity Webinar

Are your cloud concerns valid? This panel will focus on identifying the major perceived barriers to business adoption of cloud computing from the perspectives of security, compliance, privacy and policy. The goal is to separate founded and unfounded concerns and help IT security professionals and C-level executives make educated cloud decisions for their business.

Panelists:

Derek Brink, Vice President and Research Fellow, IT Security and IT GRC, Aberdeen Group (moderator)
John Howie, COO, Cloud Security Alliance
Pravin Kothari, Founder and CEO, CipherCloud
Adam Swidler, Sr. Product Marketing Manager, Google

In its fifth annual study on best practices in data loss prevention (DLP), Aberdeen analyzed and compared the results from more than 600 organizations which have adopted one of four distinct approaches to the operational use of DLP technologies. The best approach, in terms of balancing enterprise risk and reward, is like the ideal referee in sports: one that makes good calls and enforces the rules regarding safety and fair play, but generally doesn't get in the way of the people playing the game.

Consumerization of IT and BYOD represent an opportunity and a challenge for businesses. At the crux of the issue is the tension between enterprise IT professionals who are tasked with establishing and enforcing policies and end-users who care about mobility and freedom anytime, anywhere. This webinar will explore how establishing the right BYOD policy can help a company embrace the consumerization of IT while keeping their enterprise secure.


Derek Brink, VP, Aberdeen Group; Patrick Wheeler, Sr. Marketing Manager Endpoint Security, Trend Micro: Mary Siero, CEO, Innovative IT LLC; Benjamin Robbins, Principal, Palador

So you've successfully gotten started with your application security initiative -- now what? How do you take securing your applications to the next level?

Characteristics of the companies achieving top performance in application security include:

- Start from a solid foundation of testing
- Start small (e.g., with a proof-of-concept) and then expand by building on your success
- Establish a risk-based approach on what vulnerabilities to address and when
- Partner between the IT Security and Application Development teams to expand your program beyond testing to create a true software assurance program

Research from Aberdeen Group confirms that bringing about a systemic change across the entire software development lifecycle -- i.e., to become "secure at the source" -- yields the best results.

In addition to the use of several enabling tools and technologies -- including application vulnerability scanning, penetration testing, manual source code reviews, static source code analysis and verification, and dynamic source code analysis and verification -- this webinar will review the "people and process" capabilities that most strongly differentiate the top performers.