Security Gets a Makeover (part one)
Monday, February 7th, 2011 Chris Witeck, Director Product Marketing
One of the trends we are talking about at iPass is the concept that “Security Gets a Makeover.” Are you embracing this trend or is it still in the clouds?
This trend portends that organizations will fundamentally change how they provide security due to the fact that there are:
1) More users working remotely,
2) More devices being used for access and
3) More applications moving beyond the traditional network perimeter.
The concept should not come as a surprise for most people. What’s probably unsettled is: What will an Enterprise’s security strategy look like going forward?
I’m sure that some people have ideas, but I don’t think that there is a dominant strategy that has emerged. The winds of change are pretty disruptive right now when it comes to Enterprise Mobility and I don’t think that it will settle down in the near future. However, we can always be free to speculate what we think things will look like. Before I offer an opinion on what I think security will look like going forward, let’s take a look back at how enterprise security has evolved since the Internet first really disrupted enterprise security.
I’ve heard Gartner refer to enterprise security categorized as follows: Security at the Device, Security at the Edge, and Security at the Application. A true Defense in Depth security strategy would include elements of all three. That make sense, but I think over the last 10 years most organizations have centered their security strategy at the edge.
Why is that? When the Internet provided the first major remote access disruption, allowing people to work beyond the traditionally LAN boundary for the first time, organizations had a choice of managing access across all of the disparate applications that they manage, or centrally at the edge. With this we saw a new class of edge gateways that allowed organizations to manage security from a single set of edge devices for all applications on the LAN.
This grew complicated with the next remote access disruption: as more and more people started to work remotely, IT started to see access requests beyond the centrally-managed IT managed devices as people started to work from consumer liable devices. That definitely started to promote complexity on how to manage security at the device layer, as there was no longer a single IT-managed device requesting access, so the edge gateway devices evolved to incorporate access from non-IT-managed devices.
You still had elements of security managed at the application, especially as applications started to adopt methods for accessing via the Web (like Outlook Web Access), but much of the permissions for how to access information and work remotely was still done at some sort of edge gateway device. Devices that controlled access at the edge increasingly evolved to authorize access not only based on the user’s credentials, but on the type of device used for access.
Next up: Further disruptions with the rise of smartphones and how IT can embrace the cloud, while not weakening security.
Tags: enterprise mobility, mobile device, mobility management, Security
