Why companies in the EU are adopting more and more cloud-based security solutions?

Transcription

1 Transforming IT Security & Compliance Why companies in the EU are adopting more and more cloud-based security solutions? Jörg Vollmer, Qualys GmbH Itsa Nürnberg, Forum Rot 09. November 2013

2 Agenda What is the cloud business value? What about the SecaaS? Why companies are increasingly adopting cloud-based security solutions? Key takeaways 2

3 What is the cloud business value? Trends & Evolution in Cloud Computing market in Europe done by Pierre Audoin Consultants (PAC) in

4 What about the SecaaS? Some definitions Gartner definition: Security controls that are owned, delivered and managed remotely by one or more providers. The provider delivers the security function based on a share set of security technology and data definitions that are consumed in a one-to-many model by all contracted customers anytime on a pay-for-use basis, or as a subscription based on metrics CSA definition: Security as a Service refers to the provision of security applications and services via the cloud either to cloud-based infrastructure and software or from the cloud to the customers on-premise systems SecaaS or Security as a Service or cloud-based security services Taxonomy of IT security services 4

5 What about the SecaaS? An emerging market Services in many forms which have caused market confusion and complicated the selection process for end users Fuzzy and closed frontiers between sub segments and markets Pure players, new entrants, defense and historical players to come Collaboration and competition A star and growing market A very attractive EU market estimated to $1.9 billion in 2012 Gartner predicts that cloud-based security service us will grow to $4.2 billion in 2016 with a 23% CAGR Main market segments IAM services, distributed-denial-of-service protection services Web security services, security services Security intelligence services, Security assessment services 5

6 Why companies are increasingly adopting SecaaS? 6

7 Why companies are increasingly adopting SecaaS? Business drivers Adoption of the cloud in order to enhance IT business value at utility, transformation and innovation levels Focusing on their core business, using security specialists Risk management at the governance level Flexibility and agility Addressing global presence and smooth deployment needs Do more with less Addressing increasing compliance requirements to standards (e.g. PCI-DSS for merchants) and EU regulations (e.g. EU data privacy and breach notification legislations) 7

8 Why companies are increasingly adopting SecaaS? Security drivers CISO becoming more strategic has to excel in innovation, technology, stewardship, and operational efficiencies War of talents and scarcity of security expertise on the market Easy integration and complementary of SecaaS solutions Anticipating more, and reacting efficiently and quickly to new cyber threats and vulnerabilties Focus on analyzing security information and making decisions, not implementing the services Better enforcement of security policy, governance and processes Automatic and transparent security updates and patches Availability of new features and services without deploying software agents/updates 8

9 Why companies are increasingly adopting SecaaS? Cost drivers Reduction of operational cost and maintenance Only OPEX budgets, no CAPEX budgets required Lower switching costs Forrester study «The Total Economic Impact of QualysGuard» (Net Present Value computing)

10 Key takeaways Cloud services can improve security Cloud-based security solutions can be more robust, effective and cheaper than traditional enterprise software solutions. It s a matter of managing risks vs rewards Security is increasingly being seen as a driver rather than an inhibitor (2011 Cloud Computing Outlook Survey by Cloud.com ) Some issues and challenges remain Liability, contracting and SLA terms and conditions Right to audit the provider Data location and transfer Auditing and security certifications (ISO 2700x, SSAE-16) Need for further standards development in order to increase trust and transparency 10

11 Transforming IT Security & Compliance Thank You