View
3
Download
0
Category
Preview:
Citation preview
www.thales-esecurity.com
2017 THALES DATA THREAT REPORTTrends in Encryption and Data Security
EUROPEAN EDITION
FOCUS ON GERMANY
2017 THALES DATA THREAT REPORTTRENDS IN ENCRYPTION AND DATA PROTECTION
U.S.
MEXICO
U.K.GERMANY
JAPAN
AUSTRALIABRAZIL
1,100+ SENIOR IT SECURITY EXECUTIVES SURVEYED GLOBALLY | 100 GERMANY| 500 U.S. | 100 U.K., BRAZIL, MEXICO, JAPAN, AUSTRALIA
Copyright 2017 Thales
RESPONDENTS ORGANIZATIONS (GERMANY)100% - € 90M+51% - € 900M+16% - € 1800M+
THE EYE OF THE STORMENTERPRISES AROUND THE WORLD ARE AT THE NEXUS OF AN INCREASING NEED FOR DATA TO POWER GROWTH, REGULATORY REQUIREMENTS, AND ATTACKS AIMED AT THIS OFTEN SENSITIVE INFORMATION – AND GERMANY IS AT THE CENTER OF ALL OF
THESE TRENDS.
ENTERPRISES IN GERMANY SHOWED SUCCESS IN REDUCING DATA BREACH LEVELS THIS YEAR, BUT WITH LOOMING GDPR PENALTIES, HIGH LEVELS OF VULNERABILITY TO DATA THREATS AND INTENSE PRESSURE TO DRIVE GROWTH WITH CLOUD, BIG DATA
AND OTHER ADVANCED TECHNOLOGIES
THERE IS CLEARLY MORE TO DO.
OF GERMAN RESPONDENTS FELT THEIR ORGANIZATIONS WERE VULNERABLE TO DATA THREATS – THE HIGHEST RATE MEASURED WORLDWIDE95%WERE VERY OR EXTREMELY VULNERABLE 45%
VULNERABILITYTO DATA THREATS
GLOBAL
VULNERABLE VERY/EXTREMELY VULNERABLE
VERY OR EXTREMELY
VULNERABLE
SOMEWHAT OR MORE
VULNERABLE
16%
84%
UNITEDSTATES
REGIONAL
UNITEDKINGDOM
20% 31%45%JAPAN MEXICOGERMANY
90%95%84%
23% 19%
77%
49%
91%
BRAZIL AUSTRALIA
29%
90% 83%
88% 30%
E X P E C T T H E I R S P E N D I N G O N D AT A
S E C U R I T Y T O I N C R E AS E
• UP FROM 52% IN 2016 and 44% in 2015
• GLOBAL AVERAGE 73%
80%50%H AVE E X P E R I E N C E D
A D AT A B R E AC H
• 25% IN THE LAST YEAR (DOWN FROM 37% IN 2016)
• 9% MORE THAN ONCE (GLOBAL AVERAGE 12%)
Global73%
2015
2016
2017
58.5%
54%
80%
63%
44%
THE GOOD NEWS ABOUT DATA SECURITY IN GERMANY
SAFEOPERATION
30% – GERMANY33% – GLOBAL*
30% never had a data breach or compliance failure for data security violations
INCREASING SPENDINGTO PROTECT DATA
Germany
73%2017
COMPLIANCE AND BEST PRACTICES – CRITICAL FOR GDPRTOP IT SECURITY SPENDING PRIORITIES
IMPACT ON IT SECURITY SPENDING PRIORITIES (RATES OF TOP 3 SELECTION)
“Compliance requirements – as tough as they are now – will become even stricter with the full implementation of GDPR in 2018”
Garrett Bekker, Principal AnalystInformation Security, 451 Research
38% - 2017 COMPLIANCE REQUIREMENTS47% - 2016
19% - 2017 REPUTATION AND BRAND PROTECTION33% - 2016
24% - 2017 DATA BREACH PENALTIES36% - 2016
43% - 2017 IT SECURITY BEST PRACTICES39% - 2016
28% - 2017EXECUTIVE DIRECTIVE44% - 2016
33% - 2017PARTNER AND PROSPECT REQUIREMENTS47% - 2016
DATA BREACHES AT PARTNERS OR COMPETITORS19% - 201726% - 2016
PREVIOUS DATA BREACH22% - 201735% - 2016
COMPETITIVE/STRATEGIC CONCERNS21% - 201728% - 2016
INCREASED CLOUD USE36% - 2017Not measured
BEST PRACTICES A TOP REQUIREMENT TO COMPLY
WITH GDPR (14 MENTIONS) –COMPLIANCE AND BEST
PRACTICES TOP IT SECURITY SPENDING PRIORITIES AS A
RESULT
Garrett BekkerPrincipal Analyst Information Security, 451 Research
“.. external attackers frequently masquerade as insiders by using stolen or compromised credentials to access all types of valuable data, including PII, PHI, financial data and intellectual property”
36% GERMANY
54% GERMANY
44% GERMANY
34% GERMANY
ORDINARY EMPLOYEES
EXECUTIVEMANAGEMENT
THE MOST DANGEROUS INSIDERSPRIVILEGED
USERS
CONTRACTORS
58% GLOBAL
44% GLOBAL
36% GLOBAL
33% GLOBAL
TOP EXTERNAL THREAT ACTOR SELECTIONS
16%CYBER CRIMINALS
HACKTIVISTSNATIONSTATES
CYBER-TERRORISTS
COMPETITORS
15%11%18%41%
GERMANY
GLOBAL44% 12%
CYBER CRIMINALS
HACKTIVISTSNATION-STATES
CYBER-TERRORISTS
COMPETITORS
11%15%17%
66%OF IT SECURITY PROS IN GERMAN ENTERPRISES SURVEYED
ARE CONCERNED THAT THEY ARE DEPLOYING NEW TECHNOLOGIES IN ADVANCE OF HAVING APPROPRIATE
LEVELS OF DATA SECURITY IN PLACE
96%WILL USE SENSITIVE DATA IN AT
LEAST ONE OF THESE ADVANCED TECHNOLOGY ENVIRONMENTS
48%
4%
34%
40%
19%
35%
50%
45%
BLOCKCHAIN
CONTAINERS
BIG DATA
IOT
PAAS
MOBILE
IAAS
SAASRATES OF SENSITIVE DATA USE BY ENVIRONMENT TYPE
OLD HABITS DIE HARD – INVESTING HEAVILY INNETWORK AND END POINT SECURITY AS IT BECOMES LESS RELEVANT
IT SECURITY DEFENSE SPENDING INCREASESNETWORK
ANALYSIS AND CORRELATIONDATA IN MOTION
END POINT AND MOBILE
52%
41%
51%
58%
42%DATA AT REST
NETWORK
ANALYSIS AND CORRELATIONDATA IN MOTION
END POINT AND MOBILE
79%
80%
77%
72%
73%DATA AT REST
BELIEVE NETWORK SECURITY VERY/ EXTREMELY EFFECTIVE AT PROTECTING DATA
79%-2% FROM 2016
“… spending on securing internal networks from external threats is less and less effective – and relevant – as both the data and the people accessing it are increasingly external.”
RATES OF EFFECTIVENESS FOR PROTECTING DATA
WITH NATIONAL REGULATIONS LIKE GDPR COMING WORDWIDEDATA PRIVACY AND SOVEREIGNTY ARE MAKING WAVES EVERYWHERE
81% - GERMANY72% - GLOBAL
Impacted by Data Privacy and Data Sovereignty
ADDRESSING REQUIREMENTS BY: GERMANY
GLOBAL
TOKENIZING DATA
LOCAL HOSTING & CLOUD
39%68%
12%24%
ENCRYPTING DATA
MIGRATING DATA
TOKENIZING DATA
LOCAL HOSTING & CLOUD
40%64%
26%36%
ENCRYPTING DATA
MIGRATING DATA
JAPAN
U.S.A.
DATA PRIVACY/SOVEREIGNTY BEYOND GDPR
AIPP DATA PROTECTION AND
PRIVACY RULES GO LIVE SEPTEMBER 2017
47 STATE LAWS PLUS FEDERAL REGULATIONS
MEXICO
LFPDPPP PRIVACY LAW WITH FINES UP
TO £ 1.5M
BRAZIL
NEW PRIVACY LEGISLATION PENDING FOR
APPROVAL
COMPLEXITY AND STAFFINGTOP BARRIERS TO DATA SECURITY DEPLOYMENT
LACK OF STAFF TO MANAGE39%
LACK OF ORGANIZATIONAL BUY IN32%
58% COMPLEXITY
32% POTENTIAL PERFORMANCE IMPACTS
16% LACK OF PERCEIVED NEED
PERCEIVED BARRIERS TO ADOPTING DATA SECURITY
“…The lack of skilled security staff has been a consistent theme in 451’s research efforts the past few years, and in conjunction with complexity, makes a strong case for data security functionality delivered as a service”
Garrett Bekker451 Research
PERCEPTION OF COMPLEXITY
UNIVERSALLY THE TOP BARRIER
PERCEIVE COMPLEXITY AS THE TOP BARRIER TO ADOPTION DATA SECURITY SOLUTIONS
58%GLOBAL – 50%
29% LACK OF BUDGET
ENTERPRISE CONCERNS WITH CLOUD/SAAS ENVIRONMENTS
51% – GERMANY SECURITY BREACHES/ ATTACKS AT CSP59% – GLOBAL
56% – GERMANY57% – GLOBAL
SHARED INFRASTRUCTURE VULNERABILITIES
51% – GERMANY LACK OF DATA LOCATION CONTROL55% – GLOBAL
37% – GERMANY LACK OF DATA PRIVACY POLICY / SLA52% – GLOBAL
46% – GERMANY CLOUD PRIVILEGED USER ABUSE/THREATS53% – GLOBAL
37% – GERMANY MEETING COMPLIANCE REQUIREMENTS47% – GLOBAL
39% – GERMANY CUSTODIANSHIP OF ENCRYPTION KEYS51% – GLOBAL
46% – GERMANY LACK OF VISIBILITY INTO SECURITY PRACTICES50% – GLOBAL
CONCERNS WITH SENSITIVE DATA IN CLOUD ENVIRONMENTS
ARE HIGH, WITH NEARLY HALF OF RESPONDENTS LISTING THEM AS ENVIRONMENTS WHERE THEY ARE CONCERNED ABOUT USING SENSITIVE DATA
48% IAAS
42% PAAS
42% SAAS
THREATS - RATES OF VERY OR EXTREMELY CONCERNED
WHAT CAN CSPS AND SAAS PROVIDERS DOTO INCREASE ENTERPRISE CLOUD ADOPTION IN THE GERMANY?
CONSISTENTLY THE FIRST OR SECOND CHOICE THAT WOULD INCREASE ENTERPRISE USE OF CLOUD WORLDWIDE IS ENCRYPTION WITH ENTERPRISE PREMISE KEY CONTROL
DATA ENCRYPTION IN THE CLOUD WITH CSP PREMISES
KEY CONTROL
57%GERMANY
51%GLOBAL
EXPOSURE OF DETAILED MONITORING INFORMATION FOR OUR IMPLEMENTATION
45%GERMANY
41%GLOBAL
DETAILED PHYSICAL AND IT SECURITY IMPLEMENTATION
INFORMATION
47%GERMANY
47%GLOBAL
DATA ENCRYPTION IN THE CLOUD WITH ENTERPRISE KEY
CONTROL
50%GERMANY
61%GLOBAL
66% 64% 62% 61% 49%
U.S. MEXICO U.K. BRAZIL JAPAN
BIG DATA – TOP DATA SECURITY CONCERNS AND STATS
TOP 5 CONCERNS
42% GERMANY44% GLOBAL
SECURITY OF REPORTS THAT MAY INCLUDE
SENSITIVE DATA
48% GERMANY45% GLOBAL
SENSITIVE DATA MAY RESIDE ANYWHERE
41% GERMANY31% GLOBAL
LACK OF EFFECTIVE ACCESS CONTROLS
38% GERMANY36% GLOBAL
PRIVILEGED USER ACCESS TO
PROTECTED DATA
25% GERMANY
35% GLOBAL
PRIVACY VIOLATIONS, DATA ORIGINATING IN MULTIPLE
COUNTRIES
USING ENCRYPTION TO PROTECT DATA
IN BIG DATA ENVIRONMENTS TODAY
36%
VERY CONCERNED ABOUT SENSITIVE
INFORMATION IN BIG DATA WITHOUT DATA SECURITY CONTROLS
USING SENSITIVE INFORMATION IN BIG
DATA ENVIRONMENTS
GERMANY
36% GLOBAL
48% GERMANY
47% GLOBAL
33% GERMANY
44% GLOBAL
ENTERPRISES IN THE GERMANY HAVE HIGH IOT ADOPTIONUSE OF SENSITIVE DATA A CONCERN
TOP 5 DATA SECURITY CONCERNS FOR IOT
25% - PRIVILEGED USER ACCESS TO IOT DEVICES
25% - LACK OF IOT SECURITY FRAMEWORKS
25% - IDENTIFYING SENSITIVE IOT DATA
32% - PROTECTING SENSITIVE DATA GENERATED BY IOT
25% - LOSS OR THEFT OF IOT DEVICES
84%ADOPTING IOT TECHNOLOGIES
14%USING SENSITIVE
DATA IN IOT
34%VERY CONCERNED ABOUT
SENSITIVE DATA IN IOT
TOP 5 CONTROLS NEEDED TO INCREASE IOT ADOPTION
47% - ANTI-MALWARE FOR DEVICES
43% - BEHAVIORAL ANALYTICS / ANOMALY DETECTION
47% - SECURE ID AND AUTHENTICATION
58% - ENCYPTION OF DATA
36% - IOT MANAGEMENT AND APPLICATION ISOLATION
TOP SECURITY CONTROLS NEEDEDTO INCREASE CONTAINER ADOPTION AND USE IN THE GERMANY
SECURITY THE TOP BARRIER TO FURTHER CONTAINER
DEPLOYMENT
49%
35%
ENCRYPTION
39%
33%
56%
54%
VULNERABILITY SCANNING
ANTI-MALWARE
MONITORING
DIGITAL SIGNATURE IMAGE VALIDATION
42%
ENCRYPTION
36%
31%
45%
53%
VULNERABILITY SCANNING
ANTI-MALWARE
MONITORING
DIGITAL SIGNATURE IMAGE VALIDATION
GERMANY
GLOBAL
78%PLAN TO DEPLOY
CONTAINER TECHNOLOGY BY
END OF 2017
ALREADY IN PRODUCTION
35%
ENCRYPTION ENABLES DIGITAL TRANSFORMATIONA KEY TOOL REQUIRED FOR ADVANCED TECHNOLOGY ADOPTION
ENCRYPTION ENABLES FURTHER ADOPTION OF CLOUD
CLOUD DATA ENCRYPTION IN THE CLOUD57% 61%
ENCRYPTION OFFSETS TOP SECURITY CONCERNS
BIG DATALACK OF ACCESS CONTROLS
SECURITY OF REPORTSSENSITIVE DATA EVERYWHERE
41%42%48%
IOT DATA ENCRYPTION58%SECURE DIGITAL IDENTITY
(AN ENCRYPTION TECHNOLOGY)47%
CONTAINERS
GERMANY GLOBAL
ENCRYPTION THE TOP CONTROL NEEDED TO ENABLE GREATER ADOPTION
GLOBAL31%44%45%
THE TOP TECHNOLOGY NEEDED TO EXPAND USAGE56%
55%GLOBAL
GLOBAL53%GERMANY54%
GERMANY
GERMANY
BEST PRACTICE RECOMMENDATIONSGARRETT BEKKER, 451 RESEARCH
Cloud and SaaS break legacy IT Security models – Data security with encryption and access controls across environments is required.Service-based solutions and platforms that include automation are preferred for reduced costs and simplicity.
Get a better handle on the location of sensitive data, particularly for Cloud, Big Data, Containers and IoT
Global and industry regulations can be demanding, but agencies should consider moving beyond compliance to greater use of encryption and BYOK, especially for cloud and other advanced technology environments.
Encryption and access control
Don’t just check off the compliance box
Discover and classify
Re-prioritize your IT security tool set
Encryption needs to move beyond laptops and desktops.Data center: File and application level encryption and access controlsCloud: Encrypt and manage keys locally, BYOK enables safe SaaS, PaaS and IaaSBig Data: Encryption and access control within the environmentContainers: Encrypt and control access to data both within containers and underlying data storage locationsIoT: Use secure device ID and authentication, as well as encryption of data at rest on devices, back end systems and in transit to limit data threats
OUR SPONSORS
ABOUT THALES E-SECURITY
Instilling trust across the data landscapeOur powerful technology platform provides advanced data security for more servers, applications, and environments than any other security alternative
What we doThales e-Security provides companies everything they need to protect and manage their data and scale easily to new environments and requirements—encryption, advanced key management, tokenization, authorization, privileged user control, and HSMs.
Our customersOur customers include 19 of the world’s 20 largest banks, four of the world’s five largest oil companies, 27 NATO country members and 15 of the Fortune 25.
Data Protection Platform
Key Management Encryption
Our solutions protect data while eliminating complexity, inefficiency and cost
DATA PROTECTIONHARDWARE
DATA PROTECTIONSOFTWARE
CustomerRecords
DB/ File Encryption
Secure Analytics
Big Data
PII
ApplicationEncryption
PCI,PHI
TokenizationData Masking
Internet of
Things
Public KeyInfra (PKI)
Use Cases
CloudMigration
Cloud Security
Payment related apps
TransactionSecurity
ScriptDevelopmen
t
Code Signing
www.thales-esecurity.com
EUROPEAN EDITION
FOCUS ON GERMANY
2017 THALES DATA THREAT REPORTTrends in Encryption and Data Security
Recommended