​Too many cloud-gazing organisations still using old-fashioned security

The rapid adoption of cloud-based applications has left many organisations exposed in worrying ways because they are still relying on legacy security tools that focus on low-level analysis rather than considering security at an application level, a senior security specialist has warned.

The cloud "is now becoming part of the norm as to how we do business," Palo Alto Networks head of network security Samantha Madrid told CSO Australia during a recent Australian visit. Yet despite this normalisation, she said, many organisations were still failing to appreciate that the new environment required a new approach to security. Users and even many technologists had become "desensitised" to new security requirements and enabling tools – leaving them trying to fix 21st-century services with 20th-century tools.

"You have to think about the technology that you're using and whether it understands the way you communicate," Madrid explained. "The challenge with legacy technologies is that they communicate and make decisions first and foremost on protocol. But that's a cumbersome mindset because it's not how users communicate."

Users "email files, and upload files to cloud shares and enterprise applications," she explained. "If the backbone if your security cannot understand applications, and recognise users by name so you can enforce policy, then you're already a step behind."

Like its many change-minded security peers, Palo Alto Networks is working to bring old security models into the present day – which carries additional challenges in the form of bring your own device (BYOD) models where the preponderance of Web-connected applications makes protocol-based security even more complicated.

Application-level security models offer greater flexibility and the ability to enforce content-based policies – such as controls over the distribution of credit card numbers through online channels – which make them essential in closing the security and compliance gap the broad use of devices creates.

For Madrid, the appeal of BYOD and growing demand for attendant security flexibility have created something of a raison d'être for 2016 and beyond.

Noting market penetration of just around 10 percent,

"For us it is a mission," she said. "We want people to continue to have an environment where they feel comfortable with their devices, so that an organisation can truly embrace BYOD and not choose your own device policies. To do that, we have to think beyond just 'allow' and 'not allow'."

"Security is now part of the fabric where I think historically it hasn't been. And we are laser focused on continuing to innovate on this. For us, it is a mission."

Security ALERT!

Need help making the right choice for you business? Need to update your system but don't know where to start? CSO can help, check out our security hub today.

Gigamon Transform Security Zone

Join the CSO newsletter!

Error: Please check your email address.

Tags palo alto networksold-fashioned securitycloud-based applicationsCSO Australia

More about CSOGigamonPalo Alto Networks

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by David Braue

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts