Forrester’s Security & Risk Research Spotlight: Application Security and IoT Security

Once a month I use my blog to highlight some of S&R’s most recent and trending research. This month I’m focusing on application security and asking for your help with some of our upcoming research into the security and privacy risks associated with Internet of Things (IoT). IoT is any technology that enables devices, objects, and infrastructure to interact with monitoring, analytics, and control systems over the Internet. The illustrious and debonair, Tyler Shields (@txs), will lead our research into IoT security, but as the risks become more and more concrete for various verticals, you can expect the entire team to engage in this research.

Take our IoT security survey and talk with our analysts! If you contribute to the emerging IoT market, please fill out this brief survey (http://forr.com/2015-IoT-Security-Survey). Participants will receive a complimentary copy of the completed research report and we'd be happy to interview anyone who would like to discuss IoT and security in detail. Be sure to reach out to Tyler (tshields@forrester.com) or Jennie Duong (jduong@forrester.com) if you’re interested.

Read more

Forrester’s Security & Risk Analyst Spotlight – Nick Hayes

He declined to live tweet his upcoming wedding from the altar, but there is no doubt that Nick Hayes is the social media expert on Forrester’s S&R team. He has extensive knowledge of the security, privacy, archiving, and compliance challenges of social media, as well as the technical controls used to address them. He also specializes in the tools that monitor and analyze social data to improve oversight and mitigation tactics of myriad reputational, third-party, security, and operational risks. He is certainly aware of the reputational risk of staring at your cell phone when you’re supposed to say, “I do”, but maybe if you follow him (@nickhayes10), you might get lucky with a pic or two -- and some good risk thoughts to boot.

Read more

Forrester's Security & Risk Research Spotlight -- Don't Let Cloud Go Over Your Head

With great convenience comes great responsibility...

Once a month I use my blog to highlight some of S&R’s latest and greatest. The cloud is attractive for many reasons -- the possibility of working from home, the vast array of performance and analytical capabilities available, knowing that your backups are safe from that fateful coffee spill, etc. Although the cloud is not a new concept, the security essentials behind it unfortunately remain a mystery to practically all users. What’s worse, the security professionals tasked with protecting corporate data rarely have visibility into all the risk -- it’s simply too easy for users to make critical cloud decisions without process or oversight.   

Underestimating or neglecting the necessary security practices that a cloud requires can lead to hacks, breaches, and horrendous data leaks. We’ve seen our fair share of security embarrassments that range from Hollywood execs to the US government, and S&R pros know that these are far from done.

Read more

Forrester’s Security & Risk Analyst Spotlight – Andras Cser

Last week, we learned that cybercriminals undermined the identity verification of the IRS’ Get Transcript app and gained access to the tax returns on 104,000 US citizens, so it’s only fitting in this analyst spotlight, we interview one of the team’s leading analysts for identity and access management (IAM), VP and Principal Analyst, Andras Cser. Andras consistently produces some of the most widely read research not just for our team but across all of Forrester. And clients seek his insight across a number of coverage areas beyond IAM, including cloud security, enterprise fraud management, and secure payments. As the tallest member of our S&R team at 6’5”, Andras also provides guidance to clients on the emerging fields of height intel and altitude management.

Read more

Forrester’s Security & Risk Research Spotlight – The IAM Playbook For 2015

Once a month I use my blog to highlight some of S&R’s most recent and trending research. When I first became research director of the S&R team more than five years ago, I was amazed to discover that 30% to 35% of the thousands of client questions the team fielded each year were related to IAM. And it’s still true today. Even though no individual technology within IAM has reached the dizzying heights of other buzz inducing trends (e.g. DLP circa 2010 and actionable threat intelligence circa 2014), IAM has remained a consistent problem/opportunity within security. Why? I think it’s because:
 

Read more

Forrester’s Security & Risk Analyst Spotlight – Martin Whitworth

Once a month, my co-research director and partner in crime, Chris McClean, and I will use our blog to highlight one of the 26 people who collaborate to deliver our team’s research and services and always make Chris and I look really, really good. Each “Analyst Spotlight” includes an informational podcast and an offbeat interview with the analyst. This month’s Analyst Spotlight features our newest analyst, Martin Whitworth. Based in London and bringing experience as a CISO and Head of Security across several industries, Martin will cover the most pressing issues keeping CISOs reaching for another bourbon on the rocks, including security strategy, maturity, skills and staffing, business alignment, and everyone’s favorite pastime, reporting to the board. 
 
Martin Whitworth Image Prior to joining Forrester, Martin served as CISO and senior security leader for a number of blue chip organizations, including Coventry Building Society, Steria Group, UK Payments Council, British Energy/EDF Nuclear Generation, and GMAC. In these roles, he developed and executed a variety of security strategies and programs, and he has extensive experience successfully engaging business and board-level stakeholders. He also has considerable experience as a trusted advisor to security leader peers in the public and private sectors internationally, as well as advising standards and regulatory bodies.
 
Read more

Analyst Spotlight Podcast With Merritt Maxim

This month’s S&R Analyst Spotlight Podcast features a slight change to our usual program: we have a guest host! Chris McClean, our San Francisco-based Research Director, interviewed the newest addition to our analyst team, Merritt Maxim. Merritt’s coverage areas include identity and access management, access governance, federation, authentication, and role design and management. In our podcast, Maxim tells us about his career before Forrester, his planned coverage area and his current must-read book on security. 
 
These Analyst Spotlights are all included in S&R’s First Look newsletters. Email srfl@forrester.com to be added to the list!
 
To download the mp3 version of the podcast, click here.
 

Merritt Maxim Image

 

Read more

Analyst Spotlight Podcast With John Kindervag

It's February: time for another S&R Analyst Spotlight Podcast! This month, Forrester VP, principal analyst, and Zero-Trust creator, John Kindervag, joins us. Listen in to learn more about John and his research. While you're at it, be sure to check out our First Look newsletter, which contains an interview with John along with links to his most recent and upcoming research. If you are not already signed up for our First Look newsletters, please email srfl@forrester.com. 

New to the podcast and want to hear more?  Check out our past interviews with analysts Ed Ferrara, Heidi Shey, Renee Murphy, and Tyler Shields.

Click below to listen to the podcast!

John Kindervag Image

To download the mp3 version of the podcast, click here.

Analyst Spotlight Podcast with Ed Ferrara

After a brief hiatus for the holidays, the S&R podcast is back!  For those who are new to the podcast, each month we use our First Look newsletter and podcast to highlight one of the terrific analysts on Forrester's Security and Risk team.  The podcast and newsletter are great ways for Forrester readers to get to know a little more about the analysts writing the reports.  This month we spotlight 4-year Forrester vet Ed Ferrara, one of our vice presidents and principal analysts focused on security strategy, budgets, metrics, consultancies, and managed services — all the topics that you want to tackle at the beginning of a new year.  

Click below to listen to the podcast! If you're not signed up for our newsletters, I highly encourage you to do so; please email srfl@forrester.com for additional details.

Ed Ferrara Image

To download the mp3 version of the podcast, click here.

Just When We Thought Santa Forgot To Put CISOs On His “Nice List,” Along Comes The Sony Breach

Security pros got the Target breach for Christmas last year. The breach hit the retailer during its busiest time of the year and cost them millions in lost business. For security pros desperate for more budget and business prioritization, you couldn’t have asked for a more perfect present - it’s as is if Santa himself came down the chimney and placed a beautifully wrapped gift box topped with a bow right under your own tree. This year it looked as if all we were getting was a lump of coal - but then Sony swooped in to save us like a Grinch realizing the true meaning of Christmas.
 
The Sony Picture Entertainment (SPE) breach is still unfolding, but what we know so far is that a hacktivist group calling themselves the Guardians of Peace (GoP) attacked Sony in retribution for the production of a movie, “The Interview,” which uses the planned assassination of North Korea’s leader as comedic fodder. The hacktivists supposedly stole 100 TBs of data that they are gleefully leaking bit by bit (imagine Jingle Bells as the soundtrack). The attack itself affected the availability of SPE’s IT infrastructure, forcing the company to halt production on several movies.
 
Read more