Digital Transformation: Why Security and Privacy Matter

Transcription

1 KuppingerCole Report WHITEPAPER by Martin Kuppinger June 2016 Digital Transformation: Why Security and Privacy Matter Digital Transformation is on its way. Unstoppable, inevitable, with increasing speed. Organizations must adapt to avoid unpredictable risks. Digital Risk Mitigation is a key success factor in digital transformation. by Martin Kuppinger mk@kuppingercole.com June 2016 Commissioned by Dell Software Report No.: 71800

2 Content 1 Introduction Highlights Eight Fundamentals for the Digital Transformation Achieving Agility by Design through Security and Privacy by Design The Dell approach to securing the Digital Transformation Moving from High Risk/Low Agility to Low Risk/High Agility Copyright Table of Figures Fig. 1: Everything and everyone becomes connected Fig. 2: The brave new world of smart manufacturing Related Research Advisory Note: Integrating Security into an Agile DevOps Paradigm Advisory Note: Eight Fundamentals for Digital Risk Mitigation in the Age of Transformation Advisory Note: Industrial Control Systems: Getting a Grip on OT Cyber Security Executive View: Dell One Identity Cloud Access Manager Vendor Report: Dell IAM Leadership Brief: Rethink your organization chart for the Digital Transformation Leadership Brief: Monetizing the Digital Transformation Leadership Brief: Join the Dots: Operational Technology and Informational Technology Report No.: Page 2 of 12

3 1 Introduction Digital Transformation of business is unstoppable. It affects virtually all industries. The IoT (Internet of Things) is just a part of this transformation. Organizations that do not adapt to the transformation are risking their very survival. Furthermore, connecting things with apps and services imposes new challenges, such as product security, liability issues, and how to appropriately handle customer data. This document discusses how IT must transform in general and how Information Security can be a business enabler for Digital Transformation. Digital Transformation is not a one-time makeover of an organization from one set of products, services or business model to another but the opening of an era that will require continuous transition and adaptation in philosophy and technology. Based on rapid innovation, global competition, ever-changing actors and the amalgamation of formerly disparate markets, organizations have to remain agile and reinvent themselves to not only to maintain, but to improve, their competitive positioning. Data collected from devices and customer interactions fuels the new data-driven business models emerging the Digital Transformation. Know Your Customer (KYC) technologies have never been more powerful or more important. However, data is the new fuel or new currency and requires adequate protection. Data leakage and reputation loss, ever-changing regulations and the massive differences in regulations from country to country, and complex partnerships where various parties need access to data are all new challenges arising with Digital Transformation. Understanding the fundamentals for Digital Transformation and knowing how to protect data especially identity-related data will help organizations succeed in this new age. When executed correctly, organizations can move from a high-risk/low-agility stance to enjoy greatly enhanced agility through security by design and privacy by design. 2 Highlights Describes eight fundamentals for Digital Transformation. Lists the seven fundamentals for future-ready Identity and Access Management (IAM), which is the foundation for Security and Privacy by Design. Explains how Security and Privacy by Design foster Agility by Design and enable the move to low risk and high agility. Shows how certain technologies can help organizations master the security and privacy challenges of Digital Transformation. Report No.: Page 3 of 12

4 3 Eight Fundamentals for the Digital Transformation Digital Transformation is the most fundamental change organizations have faced in decades. Business models and partnerships are changing, products are complemented and replaced by services, customer relationships are evolving, and data is increasingly more important. Organizations must understand the fundamentals of that change to adapt to the new economic environment. KuppingerCole has defined eight fundamentals for Digital Transformation, which look at various aspects of that fundamental change organizations are facing. Fundamental #1: The Digital Transformation affects every organization A common misconception is that Digital Transformation is limited to certain industries, such as the ones supplying smart homes or smart cities. This is wrong. In fact, nearly every organization is impacted by Digital Transformation. Prominent examples include the automotive industry being challenged by companies such as Apple or Google; the taxi industry being challenged by Uber and others; the banks being challenged by PayPal. Many businesses, such as music or book publishers, have been in the Digital Transformation for more than a decade now. Most industries, both in manufacturing and in services, are facing challenges from the Digital Transformation of businesses and many of these industries have been facing such challenges for a long time. The Digital Transformation has already started - in several industries it began years ago. Thus, the time for organizations to understand the strategic impact of the digital transformation and identify how to change products, services and business models. Fundamental #2: The Digital Transformation is here to stay Digital Transformation is here to stay. There is no value in ignoring it. The change is inevitable. In consequence, organizations must check every element: Products - move towards connected products Services - add service models to their products, where service revenue might even outperform product revenue Business models - must adapt to survive and succeed, including creating new products that integrate with services Ecosystems - where coopetition is the new normal, and where new relationships with different customers and business partners are fostered Report No.: Page 4 of 12

5 Fundamental #3: Digital Transformation is more than just IoT Many people associate Digital Transformation with connecting things the IoT (Internet of Things) as the quintessence of Digital Transformation. Connected things are part of the transformation, but it is about everything business models, services, connected things, ecosystem, etc. Thus, a broader view is required, as outlined in these more detailed fundamentals: Digital Transformation is already a reality in many industries without any connected things Industry 4.0 (or smart manufacturing) is about connecting manufacturing environments and Operational Technology (OT) Connecting things for the sake of connectivity does not create business it is the change in business models and the services that make the business Most (not all) businesses providing things will create more revenue with services than with the things Notably, when looking at the second bullet point, there are small things involved, such as sensors or RFID chips for identifying goods, but it is also about big things. Fundamental #4: The Digital Transformation mandates organizational change A consequence of Digital Transformation is that information technology becomes ubiquitous. It will be embedded in things, in devices, and in machinery involved in the entire manufacturing process. New and different areas of business will get connected. IT becomes an integral part of business in the Digital Transformation. With that change, IT becomes even more part of the business than it already is. The new-age business is based in digitization where information technology is an essential and integrated element. Thus, IT can no longer be a separate department but must become part of the core business organization. Consequently, that means that the IT organization must evolve from a centralized department to decentralized IT but with centralized guidelines, policies and governance. Without undergoing such change, organizations will likely fail in Digital Transformation, because they will adapt too slowly to ever-changing demands. Innovative organizations that harness the Digital Transformation will create an organization that turns these market demands into advantages. Fundamental #5: Everything and everyone becomes connected Digital Transformation adds billions of connected devices and things to what we already have in place. Therefore, we must learn to manage and thrive with the complex relationships of new organizations and their systems, devices, things and people. Report No.: Page 5 of 12

6 Fig. 1: Everything and everyone becomes connected. It is not only about users accessing a system anymore it is about complex interactions and relationships between multitudes of devices. New trends, such as Identity Relationship Management (IRM) are looking at ways of handling the identities of all humans, services, devices, and things and their complex and ever-changing relationships. Fundamental #6: Security and Safety not a dichotomy When discussing Digital Transformation and its security implications, as it brings up the traditional conflict between security and safety, i.e. between IT and OT people. While IT thinks in security, OT thinks in safety. However, it is not about either safety or security, it is about having both in the changing world of smart manufacturing and the connected everything. Cars that are subject to attacks are a safety risk unless they are sufficiently secure. Attacks on manufacturing environments can cause physical damage. Thus, safety requires security. On the other hand, security must be implemented so that it does not increase safety risks, e.g. by causing technical problems through security updates. Fig. 2: The brave new world of smart manufacturing. The brave new world of smart manufacturing or, as it is called in some European countries, Industry 4.0, is about connecting business processes and physical manufacturing processes. It is about connecting everything from the consumer to the machine used in manufacturing. However, connecting manufacturing implies increasing the attack surface. Thus, security moves to the center of attention. Report No.: Page 6 of 12

7 Fundamental #7: Security is a risk and an opportunity Security, as well as privacy, are commonly seen as risks and inhibitors to the business. For risk, that is true. There are security risks, there are privacy risks. However, both can be opportunities instead of inhibitors if done right. Digital Transformation is characterized by various challenges. Business partnerships and relationships change more rapidly than before. Therefore, it is imperative that organizations learn how to control their customer data. Acting on a global scale means dealing with a variety of contradictory, everchanging regulations. Organizations have to adapt to local regulations. Furthermore, with the everincreasing cyber-attacks, the risk perception is under constant change. Again, organizations need to be flexible. Thus, if solutions are built with security and privacy in mind, based on a flexible architecture and a strong focus on configurability of security and privacy, organizations can achieve a competitive advantage by becoming more flexible in their reaction and adaptation to changing environments. Furthermore, the better a business is at implementing security, the lower the remaining business risk. Fundamental #8: Identity is the glue access control is what you need IAM is changing rapidly. While the traditional focus was on employee access to internal systems, today identity management has to address a far more complex environment. Over the past several years, we have seen a number of drastic changes triggered by cloud computing, mobile computing and social computing. Different deployment models and the management of access to cloud applications, authentication and secure information access of mobile users, and the evertighter integration of business partners and customers has had a massive impact on the way IAM is done. However, these changes are just the tip of the iceberg. Users accessing services through apps, access management for operational IT and IoT are three mega-trends that will further change the role of IAM. It s not only about managing employee identities anymore. It is about millions of customers and billions of things. Traditional concepts of IAM that focus solely on internal IT are no longer sufficient. Of course, we still need some of these, but they represent a fraction of the future scope. Organizations should define a new view of IAM. The following seven fundamentals for future IAM can help organizations shape a strategy and roadmap for IAM. Report No.: Page 7 of 12

8 Fundamental #1: More than humans - It s also about Identities of things, devices, services and apps. Fundamental #2: Multiple identity providers - We will not manage all identities internally anymore and trust will vary. Fundamental #3: Multiple attribute providers - There will no longer be a single source of truth and information on identities anymore. Fundamental #4: Multiple identities - Many users will have multiple identities (or personas) and flexibly switch between them. Fundamental #5: Multiple authenticators - There is no single authenticator that works for all. Fundamental #6: Identity relationships - We must map humans to things, devices, and apps. Fundamental #7: Context - Identity and access risk varies in context. These Eight Fundamentals for Digital Transformation plus the Seven Fundamentals for Future IAM provide the foundation to create an organizational structure that is built for digital transformation success. 4 Achieving Agility by Design through Security and Privacy by Design While security and privacy commonly are considered inhibitors of business agility, the opposite is true. Done right, security and privacy are a business driver of business agility. They protect valuable data and mitigate regulatory risk, and can accelerate your organization s reaction to external influences a key requirement for any business today. A common complaint against Information Security (be it IT security, OT security or IoT security) is that security costs money but doesn t deliver business benefits. However, that complaint is unfounded when security is done right. In a short-term perspective, security incurs cost. Thus, quarterly reporting by organizations and shortterm targets cause security to be an afterthought. However, mid-term and long-term, this changes. It obviously is cheaper to code using simple APIs for security functions than to hard-code security into every application and maintain that code. But application security infrastructures can help to reduce costs. Even more, it can make application development more rapid and agile because security infrastructure can be changed, updated and enhanced without effecting applications. In addition to perception about the cost of security, the lack of security by design and privacy by design can also be an inhibitor for Digital Transformation. An essential element of Digital Transformation is the change of business models, including rapid innovation and changing partnerships. A simple example that illustrates the limitations caused by the lack of security and privacy by design is the automotive black box EDR (Event Data Recorder), the use of which is becoming more widespread and also increasingly mandated by legislation. Both automotive vendors and insurance companies are interested in owning the data held in such devices. It is complex to deal with data-access demands and requirements of various parties, and it is difficult to easily resolve this conflict with technology that relies only on a single key for accessing that data. Modern concepts for security and privacy would minimize such conflicts by allowing various parties to have defined and controlled access to information they are entitled to access. Report No.: Page 8 of 12

9 Security and Privacy by Design done right allow for easy and rapid adaptation of applications and services to new business processes and partnerships. There is the obvious risk of automotive vendors rushing to roll out new features to succeed in Digital Transformation, but by failing to do it right, with security by design and privacy by design, they are struggling with exactly the same transformation. Neither security nor privacy can be an afterthought for succeeding in the Digital Transformation. In general, the ability to provide services in these times of regulations and ever-tighter restrictions depends on the ability to re-configure your services, instead of re-coding them. The good thing, though, is this: once you have prepared your organization for security by design and privacy by design, it becomes more agile. It will be set up for faster development of software or connected things, and for more agile transformation of business models. There are three different groups of arguments for implementing more security and privacy in applications and services: Security and regulatory requirements though they deliver no direct business benefit, they must be met. Competitive differentiation an opportunity, by e.g. providing a better mix of products and associated services than others Increased Agility - Security and privacy as a means of responding to business requirements. Software and services that can be as secure as they need to be (depending on regulations or customer demand) or as open as the market requires allow organizations to react flexibly on demand amid changing requirements. The third approach is the most promising one when trying to sell your project internally as well as your products to customers. 5 The Dell Security approach to securing Digital Transformation Dell Security focuses on tightly integrated security solutions and services for network security, IAM, and other areas, that can exchange data on both identity context and network context for more advanced analytics and decision-making. Dell Security solutions form the foundation for building the security infrastructure for the type of hyperconnected organizations that emerge in Digital Transformation. Modern organizations need to manage more identities than ever before, and they need to protect their environments against ever-increasing cyber-attacks. Notably, particularly for organizations that are manufacturing physical goods, protection of on-premise environments remains a top priority, due to their operational IT networks, which are increasingly connected to business IT and the outside world. The philosophy Dell Security follows is to help their customers to Govern Every Identity. Inspect Every Packet. Basically, the two main pillars of the Dell portfolio for supporting hyper-connected organizations are their IAM (IAM) products and their Network Security solutions, plus the Security Services that provide real-time threat information. Report No.: Page 9 of 12

10 Dell Security s philosophy is Govern Every Identity. Inspect Every Packet. Dell Security is following a strategy of building context-aware solutions, which understand the actual context of packets and users. Context awareness is mandatory today, where users own a variety of devices and work from locations all over the world. Depending on device, location and other factors, the access risk varies. Security components, be it at the network security level or in IAM, can no longer treat a user the same all the time, but need to take the context into account. On the other hand, security has to move close to real-time. Solutions have to be both fast and thorough when analyzing data. Dell Security has integrated data collected by both its SonicWALL next-generation firewalls and its IAM products to make context-based risk calculations. This integration works in both directions. Decisions made in Dell Identity and Access Management, by Dell Cloud Access Manager when authenticating users, can be based on information and further analysis provided by Dell SonicWALL, while the IAM tools can support with identity context. The Dell nextgeneration firewalls are identity-aware. They provide visibility of remote, network, application and cloud access within the organization to enable visibility, governance, compliance and certification of this access. The Dell One Identity solutions are network-aware. They tighten up security of the most trusted assets in organizations, including managing firewalls with the Dell privileged account management solutions. Dell offers a comprehensive solution for governance. Dell One Identity Manager enables you to mitigate risk; control user and privileged access; govern identities and secure data. Now organizations can achieve governance, unify security policies, meet compliance needs and improve business agility with a modular and scalable solution. The overall solutions are rare and allow for deeper insight and a more complete analysis of both packets and governed access. Based on these solutions, organizations can build layers of defense around their on-premise environments, while managing all types of identities and access. 6 Moving from High Risk/Low Agility to Low Risk/High Agility Creating applications and services that can be configured to meet every level of regulatory compliance, to flexibly control sharing data, and to adapt to ever-changing risks enables organizations to flexibly react to the ever-changing requirements in the age of Digital Transformation. Security and Privacy by Design are the foundation for increased agility in the age of Digital Transformation. They allow for rapid adaptation of software, products, things, and services to changing requirements, be it changes in regulations, in risk perception, or in business processes and partnerships. This involves a well thought-out application design and mature, underlying infrastructure services. A main element therein is IAM, because most risks are about someone or something accessing data he/she/it should not have access rights for. Managing access, from the management of all identities over authentication to authorization and auditing, is a cornerstone of Security and Privacy by Design. Report No.: Page 10 of 12

11 That shift requires two fundamental changes: The organization must be ready for the age of Digital Transformation, with IT moving into the business departments, but with consistent approaches for enforcing security and privacy. Both a modern security architecture guideline and an infrastructure that supports applications built following the paradigms of Security and Privacy by Design must be in place. Moving to such paradigms the first time will require some investment, particularly in defining the concepts and guidelines and educating developers. However, even then, development speed can be accelerated and development cost can be lower than in traditional approaches. The shift must not be a change in already running projects, but any new project will benefit particularly once such approach is in place. Doing Information Security right allows organization to move from a high-risk and low-agility profile to a low-risk and high-agility profile because mitigating risks the right way allows moving from coding to configuration, resulting in flexible applications, apps, services, devices, and things. This is a clear winwin-scenario. Doing security and privacy right results in an agile business, not in slowing down business performance. 7 Copyright 2016 Kuppinger Cole Ltd. All rights reserved. Reproduction and distribution of this publication in any form is forbidden unless prior written permission. All conclusions, recommendations and predictions in this document represent KuppingerCole s initial view. Through gathering more information and performing deep analysis, positions presented in this document will be subject to refinements or even major changes. KuppingerCole disclaim all warranties as to the completeness, accuracy and/or adequacy of this information. Even if KuppingerCole research documents may discuss legal issues related to information security and technology, KuppingerCole do not provide any legal services or advice and its publications shall not be used as such. KuppingerCole shall have no liability for errors or inadequacies in the information contained in this document. Any opinion expressed may be subject to change without notice. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them. Report No.: Page 11 of 12

12 The Future of Information Security Today KuppingerCole supports IT professionals with outstanding expertise in defining IT strategies and in relevant decision-making processes. As a leading analyst company, KuppingerCole provides first-hand vendor-neutral information. Our services allow you to feel comfortable and secure in taking decisions essential to your business. KuppingerCole, founded in 2004, is a global Analyst Company headquartered in Europe focusing on Information Security and IAM (IAM). KuppingerCole stands for expertise, thought leadership, outstanding practical relevance, and a vendor-neutral view on the information security market segments, covering all relevant aspects like: IAM (IAM), Governance and Auditing Tools, Cloud and Virtualization Security, Information Protection, Mobile as well as Software Security, System and Network Security, Security Monitoring, Analytics and Reporting, Governance, and Organization and Policies. For further information, please contact clients@kuppingercole.com Kuppinger Cole Ltd. Sonnenberger Str Wiesbaden Germany Phone +49 (211) Fax +49 (211)