Shifting from a monolithic, high investment, capex-based cybersecurity consumption model to an on-demand, pay-as-you-go one is clearly the way of the future. “By the glass” consumption, whereby businesses pay for IT resources and services as and when they need them, offers widely accepted financial and operational benefits that promote agility, scalability, and digital transformation.
This model has already proven successful in the cloud and for IT. Amazon Web Services (AWS), Microsoft, Google and other leading cloud service providers are charging by smaller and smaller increments, allowing service access to users on an as-needed basis. AWS even charges by the second.
Addressing the gap
More and more often we encounter cases whereby business executives and technical leaders find themselves in opposing camps of thought in terms of the best way to achieve goals.
Analysts have found that 67% of business leaders and board members are pushing CIOs, CISOs, and other technical leaders to evolve services and approaches faster and more aggressively. Board members have climbed aboard the digital transformation bandwagon, and they want their organizations to move quicker than their competitors toward that goal.
Research from Palo Alto Networks’ cloud security study which surveyed 500 CISOs in eight countries indicates that most cybersecurity executives believe things might be moving too fast for them to properly assess risks and their implications.
Board members and business leaders have fast become big believers in the notion of “disposable IT,” which imposes a smaller footprint on enterprises while providing greater agility and, potentially, cost savings. Many CISOs, however, are still in a traditional mindset of purchasing multiyear licenses for security, backed up by a lot of testing, risk analysis, and methodical decision-making.
Organizations must find ways of spanning the chasm between the “go faster” mandate from the board and the “let’s tame the cyber-risk monster” philosophy of the CISO.
DevOps to DevSecOps
Paying attention to actual usage patterns of IT and cybersecurity, as well as how security maps to IT services, helps ensure consumption models of cybersecurity and IT match-up. For instance, if your IT organization has adopted a DevOps process, your IT usage and availability profile could change weekly, daily, or even every few hours. Security consumption must align with those IT-usage trend lines.
The process can be viewed as a three-legged stool. First, there’s an operational need; second, the developers build the solution to meet that need; and, third, security must be bound to those operational and development cycles. Unfortunately, DevOps—so far—doesn’t typically include this security leg.
Business leaders are demanding real-time adaptation of software to match operational requirements, and security must match that every step of the way. If not, new DevOps requirements will have come and gone before the security team figure out what was needed—yesterday. Hence, there’s a need to shift from DevOps to DevSecOps, where security is natively part of the process.
Business benefits
Adopting pay-as-you-go cybersecurity enables the agility, responsiveness, scalability, and cost efficiency today’s application-development and deployment cycles require.
Maintaining traditional forms of cybersecurity consumption can mean organizations find themselves over-investing in security and not being able to pivot on a dime when new risks emerge.
Case in point: I recently met with a CIO who wanted to transform his company’s data center, and he told me it took an inordinately long time to re-architect, get approval for, and roll out. So much so that he admitted that, today, the data center is already out of date. Getting caught up in monolithic, long-term investments simply doesn’t make sense if you wish to remain competitive in increasingly digitized markets.
Moving to pay-as-you-go cybersecurity is a win-win for both business leaders and the CISO. Both parties are safe in the knowledge that data, business processes, routes to market, intellectual property, and sources of competitive advantage are protected against cyber threats.
Moving to this model affords the business greater digital agility while avoiding over-provisioning, keeping its executives and board members happy. Meanwhile, the model ensures that the organization is completely protected from cyber threats no matter how fast the business’s development. It also prevents the organization from under-provisioning on cybersecurity, keeping the CISO happy.
Discovering and thwarting breaches before they happen – and doing so against a rapidly evolving and increasingly innovative set of bad actors – can become prohibitively expensive and very manpower-dependent. However, pay-as-you-go security enables agility, reduces costs, and can speed up response times (since there is no limit to capacity).
The value of such a consumption model is clearly already working elsewhere, and there is no reason we should not be embracing this same idea for cybersecurity.