Tyson Macaulay is the Chief Security Strategist and Vice President of Security Services at Fortinet. This role involves international business strategy and thought leadership for the company, and developing Consulting Services capacity. We caught up with him during his recent visit to Dubai to talk about a range of security issues surrounding the IT landscape.
We read about breaches everyday. Should enterprises now plan to fail and try to limit the damage because we can’t keep the bad guys at bay?
When you are dealing with risks you have to make certain assumptions about the impact and you should plan to win, never fail. So in the case of vulnerabilities and threats faced by enterprises, they should plan to mitigate the damage; they need to assume that at some point a vulnerability could be exploited and they should be prepared to respond to that in a timely manner.
Do you think we need to move beyond network perimeter-based defence?
Yes, perimeter is disappearing quickly, especially with more and more devices getting connected in IOT, more applications are being moved to the cloud and even the network itself is becoming a virtualised infrastructure asset. I see security being distributed across multiple points in the infrastructure– firewalls in data centre, gateways, all the way down to the endpoints. Security has to be distributed, there is no other way. However, the challenge is to manage the security tools that will be distributed across the infrastructure.
Security is increasingly becoming complex and more difficult to manage. How do you help your customers address this?
Fortinet has end-to-end security capabilities, right from high-end data centres, carrier-grade networks, all the way down to small remote gateways for branch offices or even homes. No other vendor has this range of functionality. When you couple that with key products being virtualised and managed through a single interface, our customers are able to reduce complexity significantly.
Given the fact that most enterprises have many point solutions for security, is single pane of glass management even possible?
Our guidance is that you should have two to three security vendors in your infrastructure. In large enterprises it’s common to see seven panes, or in some cases, even 20 panes of glass. You need a vendor that offers end-to-end functionality and can unify the reporting. Having said that, if you are a global enterprise you will never want to get down to just one single vendor. It will be disingenuous on my part to pretend that it is a good piece of advice.
Do you we need to radically rethink our approach to security?
The biggest challenge when it comes to security is skills. As a society, we need to radically rethink how we educate and train young people. Fortinet engages with educational institutions to try and give these young minds more opportunities to learn. I participate in the development of engineering standards for young people, and that’s where it really has to start. I do not think there is a silver bullet to security from a technology perspective.
You can see an emerging interest in massive statistical analysis on patterns in networks, operating systems and the likes but that is only a part of the solution. In the end, there are probably many components available that are not integrated and managed, and that’s what we need to overcome first. It all starts with skills and inside Fortinet we have an excellent training programme for our partners and users. It gives them great insights into not only product functionalities but security in general as well.
Is security really a boardroom issue now?
Not only do I see it becoming a boardroom issue, there is a bill in front of US senate now which mandates that boards of any public listed entity should have someone with a functional knowledge on cybersecurity. I see it becoming more of a matter of compliance and it makes perfect sense because every enterprise now is information-driven and there are so many ways to use that information against the owner, customers and partners.
Are we going to see any type of threats this year?
We have recently released our 2016 threats prediction report. We are going to see more machine to machine type of attacks and new forms of worms coming to take advantage of mobile platform. In the early 90s, we have seen worms that took advantage of Unix, then Windows and now you will see worms on platforms such as Android.
We are talking about a multi-layered defence to combat threats. Will this affect network performance and increase complexity?
IT overall is becoming more complex because of virtualisation, which introduces lot of operational efficiencies but at the same time leads to complexity. Now, virtualisation is moving out of the data cente, right into the edge of the network and now we are talking about virtualised routers and base stations. That is going to require more security and mean more complexity. One way to combat this complexity is through automation and single control points with end-to-end solutions. As well as Jeddah and Riyadh, IDC’s annual IT Security Roadshow has also already stopped off in Kuwait, Istanbul, and Ankara, and its tour of the Middle East and Africa is far from over as events are still to be held in Doha, Oman, Amman, Abu Dhabi, Bahrain, Cairo, Johannesburg, and Lagos. For further details, please visit the dedicated IT Security Roadshow 2016 webpage or tweet about the events using the hashtag #IDCITSECURITY.
A wide range of leading technology vendors partnered with IDC’s ‘IT Security Roadshow 2016’ in Riyadh, including RSA and Palo Alto as Platinum Partners; Help AG (in association with Tenable) and Cyberia as Gold Partners; HP, Aujas, Aruba Networks, and Oxygen as Silver Partners; and Innovative Solutions as lunch partners. IDC’s partners in Jeddah included RSA and HP (in association with Natcom) as Gold Partners; Check Point as Silver Partner; and Innovative Solutions as Lunch Partner.
