6th European Conference - Academic Conferences

Edwin Leigh Armistead and Thomas Murphy
Agency Corporate Information Security Officers struggle with choosing to simply use a
compliance scorecard or going farther to secure their enterprise. It is easier to say you are
compliant than to prove you are secure. Both are necessary to deliver cost effective solutions.
Department level initiatives drive security agendas. Each USG department has separate
initiatives, which in turn drive their emphasis or lack of emphasis on IA.
Trends in security focus following the path of Perimeter security, then Data security and most
recently Coding security. This end-to-end focus on secure design, development and
implementation is becoming common in all market segments.
Information Systems Security Lines of Business is not expected to cannibalize short term vendor
sales
Demand for Integrated Security Services is growing. Standalone (Point) security opportunities are
on the decline.
Federal agencies still separate IT and physical services. Merger of IT and physical security is
impeded by silos of excellence. Successful contract teams will be able to assist in integrating total
security services.
The Commercial IA segment of the security industry is characterized by an upper management that is
litigation and profit motivated. Major trends are similar to the Federal segment. Secondly, there is a
very rapid consolidation of best industry players. Cyber security firms are motivated to rapidly develop
and offer full suites of integrated and managed services to meet the demand for full services. Large IT
and network organizations can successfully merge with smaller IA firms if the ingenuity of the “pureplay”
or point (individual security component supplier) IA firm is not lost. This is a particularly
advantageous route to speed up the number and scope of offerings and to acquire experienced IA
and Information Security (InfoSec) personnel who are in short supply. It is reasonable to expect
similar motivation and actions in the Federal IA market for the same reasons. Thirdly, there are
external factors, including a continuing rise in cybercrime, which follows the earlier increase in
terrorism. Significant increases (greater than 200%) in cyber crimes occurred over the last two years.
Over 100 million data records have been lost or stolen. The average cost of each data record loss is
about $180/record giving a total estimate of $18 Billion lost over the period of two years, high
motivation to client and criminal alike. There is also a modest trend toward offering cyber and physical
security in packages of offerings.
Agencies and firms increasingly outsource more security activities each year. They determine that
they can achieve cost savings or a higher level of security at the same cost and tend to increase their
outsourcing budgets over time. The firms that do outsource all or part of their IT security activities will
see an increase in their level of security per dollar of investment. Surprisingly, although they don’t
realize it, agencies and firms that outsource Security Services are also likely to benefit from each
other’s decisions to outsource. IT security outsourcing has been shown to result in a reduction in the
firms production costs and a freeing up of other resources. (Outsourcing refers to the relationship
between a firm and another firm it pays to conduct security activities on its behalf). However, without
careful planning and due diligence, the clients return on investment in outsourcing IT security could be
reduced or become negative as a result of a variety of potential costs including both strategic risks
(e.g., principal-agent problems), interoperability issues and other transactions costs.
There are several emerging areas involving the “social” and risk management aspects of IA/IO.
Clearly, “social” is used here to mean relationships among groups of agents, individual or
organizations that involve proprietary information. At the firm level, there is a need to assure individual
firms that their partners, suppliers, or any organization they communicate with over the Internet are
trustworthy to a defined level acceptable to upper management. The economic benefit of securing all
members of the business group is significant. At the individual level there is growing demand to
secure interpersonal communications involving proprietary information (marketing, strategy and
planning, budgets or financial), email, data and image exchanges, instant messaging, etc. This is also
an area of vital national interest to DoD and other Federal agencies.
In addition, the global environment influencing customers as well as the Federal and Commercial IA
segments is characterized by significant stress. Negative pressure from the environment that Federal
and Commercial organizations must perform under has increased significantly since 2007. The United
States government (USG) and the global international community, nation states, state-sponsored
nongovernment organizations (NGOs), organizations, groups, and individuals have rapidly moved into
15