Security for the Latest Threats – Moving from Point Protection to a Holistic Battle Plan

Over the last 20 years, security threats have arrived in many different forms.  And the typical plan is to add the latest software product or service that protects against the newest threat.  The result is a patchwork of many different vendors and solutions that are all focused on different threats.

This may have worked in the past, but the lack of a cohesive security barrier and the difficulty in understanding what vulnerabilities exist “between” these products have created numerous problems.  Worse, it may leave an organization with unknown gaps in their coverage that are not apparent.  An important driver of this change is that threat types have morphed dramatically in just the last five to seven years.  Unlike the amateurish nuisance threats that were so prevalent during the 1990s and early 2000s, the new generation of threats are professionally developed with substantial investment and backing.

As a result, the time has come to build a cohesive and comprehensive security approach that is well integrated and provides clarity on what protection is in place.  As Larry Walsh, CEO and Chief Analyst at the 2112 Group, has noted, “defense in depth is the focus today.”

The need for this new approach is driven by two key issues.  First, we are seeing more blended threats that focus on numerous vulnerabilities.  Second, using a combination of security solutions reduces the potential attack surface available to hackers. “There is no single product that provides 100% protection, and even if there was, it would create a single point of failure,” says Walsh.

What’s more, the sharing of malware code on the so-called “black web” as well as the sharing of hacking technology are much more common today, resulting in the broad availability of multiple hacking tools for even the least technically sophisticated hacker.  This situation, coupled with increased funding from state-sponsored or criminal hacker groups, has unleashed a much more sophisticated generation of threats that can more often defeat point security solutions.

Building security frameworks that utilize a number of different technologies that are integrated and well planned is the natural response to blended threats.  As Walsh observes, “It’s all about security effectiveness.  If a product is 85% effective and you add another product that is 90% effective, the attack surface is likely reduced to about 3%. The whole is greater than the sum of the parts.”

This approach has often been used for a specific security tool, such as anti-virus, but the same benefits are accrued from integrating multiple types of security tools. IT security professionals will be developing the security morphology with overlap and joint coverage that provides the same cumulative effect that using multiple point solutions does.

“Deploying multiple layers of security solutions, much like concentric circles, increases the effectiveness of everything that is deployed,” Walsh says.

The time has come for a fundamental “re-think” of how security solutions are architected and deployed. The nature of today’s threats is completely different, and the solutions deployed to meet the last generation of exploits no longer provide an adequate level of protection. Holistic, layered security solutions are the new reality.


aaron goldbergAaron Goldberg is a renowned industry analyst and marketing strategy consultant for B2B information technology, spending more than 35 years working with senior executive management, marketing, and sales teams of IT Vendors, as well as IT Executives at end user organizations.  He has also been a regular columnist covering computer and technology trends and issues. He is well-known for his succinct and realistic style, and his ability to distill the key drivers for customers, marketers, and IT staff.