Techaisle Blog

December has traditionally served as the occasion for the publication of New Year forecasts. It’s understandable that we want to look ahead to the sources of opportunity that lie ahead. But in the business world, December also marks the beginning of the review season. And while detailed forecasts focus on the next twelve months, the planning horizon needs to look a little further, so that tactics provide support for business strategies, rather than simply delivering a series of course adjustments.

This is a two part blog article. The first part, below, reviews the predictions we made for 2015. Second part will focus on outlook for 2016 and for the longer term.

A look back – what was it we said was right around the corner, again?

Here are the issues we highlighted, “Ten predictions for 2015 – and five issues to keep an eye on for 2016 and beyond” and how we think we did in our prognostication.

The Top 10 for 2015

1. Hybrid arrives – not as a strategy but as the result of many discrete decisions

With the benefit of today’s perspective, we might fairly say that in 2015 and for several more years to come, a more apt description of hybrid is journey rather than destination. Digging into the detail, though, we believe our prediction that “an ability to manage hybrid infrastructure will become a key corporate IT requirement in 2015” has been borne out by the focus on tools and strategies (ranging from Docker to Agile) that we saw throughout the year. In Techaisle’ SMB Cloud adoption studies, there was a sense of growing ubiquity in the usage and plans for private, hybrid and public cloud. Use of hybrid cloud continued to increase as both a conscious strategy and as a reaction to use of both public and private resources within a single infrastructure; by the end of 2015, two-thirds of companies with 100-999 employees were using hybrid models.

2. Collaboration becomes a much bigger concept

In 2015, collaboration began to expand beyond file-sharing to become a necessary tool for driving decision-based agility, fostering innovation and extending customer intimacy. Collaboration is a process rather than a discrete outcome. Our key notion that collaboration “extends beyond the corporate staff (and as a result, beyond large enterprises) to include customers” clearly did reflect strategies and investments in 2015. Within the SMB segment collaboration is increasingly becoming a central component to virtually all business activities rather than a means to enable connections between discrete tasks. Other changes in this area will further reshape collaboration, but you’ll need to refer to the “forecast” part of the blog for that discussion.

3. Collabmobilicloud becomes a management reality

The core concept explained that despite vendor tendency towards defining collaboration, mobility and cloud as separate domains, both enterprise and SMB users have started viewing them as integrated components of business solutions. The user belief that collaboration, mobility and cloud should all be attributes of modern applications has become clearer, and even suppliers are starting to recognize the importance of an integrated collabmobilcloud approach.

SMBs are not only increasingly dependent on IT – they are dependent on increasingly-interconnected systems, which are in turn open to an ever-expanding population of devices and access points. The volumes and value of data contained in these systems continues to grow, which both increases the potential damage associated with a breach, and attracts heightened attention from hackers. Techaisle’s SMB survey data finds a disconnect between security policy and security practice that creates the potential for poorly-coordinated approaches to security – an uncertainty that is magnified by shadow IT.

In Techaisle’s latest survey of SMBs, only 13% said that they were fully prepared and confident to handle security challenges, especially mobility security. The remaining 87% were partially prepared, unprepared or unsure. These are very sobering statistics.

Techaisle’s SMB Shadow IT survey data shows that over 70 percent of applications and nearly 60 percent of IT infrastructure related spend and decision authority lies outside of IT. These expenditures are made without the IT department’s approval, guidance, or in some cases, even without IT’s knowledge. 

Security is becoming a more critical component of business rather than IT strategy.

SMB IT security managers should petition for senior executive support which will help to build an approach that safeguards the organizations, users and data, in a framework that is flexible enough to respond to emerging opportunities and threats.

SMB Mobility increases threat perimeter

The problem with mobility (like cloud) is that it changes the concept of “perimeter.” Intruders don’t need to batter through closely-guarded walls to gain access to the interior of the network; they can ride through a permeable configuration on the backs of mobile devices that have been granted access to the precious applications and data that live in the interior of the organization. It is as if the castle walls and drawbridge were replaced by windows and breezeways offering access to visitors arriving from all directions.

With mobility, the SMB user community becomes a ubiquitous and shifting source of portals through the perimeter. As a result, IT doesn’t need to only defend against recognized foes: it needs to protect the corporation from breaches that can result from the actions of its own workers, and needs to protect the same data that it delivers as an essential component of support for the mobile workforce – the workforce that is viewed by senior management as making compelling contributions to the top and bottom-line success of the business.

SMBs should consider a four-layer security framework model for deployment:

A blog “Big Data in the Cloud - an ideal solution for SMB banks” that we wrote touched a nerve, in a good way. Post blog, in our several discussions with both large and community banks we find that cloud objection is largely based on the size of the bank. In addition, regulatory compliance concerns are huge as most midmarket businesses and banks in particular spend a lot of money being compliant. With the move to cloud they want to make sure that the investment extends to the cloud without being exposed to security breaches and from a regulatory point of view.

What is clear is that migration to cloud is forcing businesses to think differently about security, in very standardized ways because the delivery of cloud service is standardized. It is also pushing them to automate security because utilization of cloud is dynamic, elastic, automated and fluid thus making manual or even semi-automated security processes unmanageable. However, this approach creates multiple vulnerabilities. The bad guys themselves are taking advantage of all the cloud technologies and are becoming a lot faster and more automated than the businesses. Security therefore becomes a moving target and cloud security is a perfect opportunity for businesses to improve defenses and reduce risks.

While most midmarket businesses are reactive, hunting after point solutions when something goes wrong, others are taking a proactive approach to risk and threat so that they have more fluidity in the way they respond when a threat occurs.

IBM security is on a path to help businesses think differently about cloud security. It is moving the businesses along a maturity curve from reactive to proactive to optimized. Optimization refers to the difference between being able to weather an attack and continue with business and how much time could one can shave off and how much cost could be optimized for being able to respond to that event in reducing risk.

As Sharon Hagi, Global Strategist and Senior Offering Manager, IBM Security, said in an interview “the state that IBM is advocating goes beyond reactive or proactive. We call it the optimized state where organizations use automation coupled with predictive security analytics to drive towards a higher level of efficiency. By mixing the elements of proactive approach, automation and security intelligence businesses can actually get to the point where they are a lot more efficient and they actually reduce time and cost to respond to risk.”

IBM is differentiating and trying to distance itself from others in a number of different ways. IBM has a managed security services practice with ten plus security operation centers around the world servicing 133 different countries with 6,000 security professionals and its research lab X-Force provides actionable threat intelligence and insights for business and IT leaders. IBM monitors 10,000 security customers globally, 70 million end-points with 20 billion events per day, has made enormous investments in security intelligence analytics platform that allows it to distill information, identify threats and respond quickly.

But for banks and businesses that come under deep regulatory scrutiny, security goes beyond managed services and is a major psychological barrier to cloud adoption triggering a high level of fear-factor. Recently, we posed a fundamental question of “Why do you want security” to banks and midmarket businesses in general. The responses received could easily be bucketed into five categories:

Techaisle’s recently completed study on SMB IT Decision Making Authority: ITDM vs. BDM, examining the balance in SMB IT decision making authority between IT decision makers (ITDMs) and business decision makers (BDMs)  shows that BDMs are becoming increasingly involved in SMB cloud and security management processes. In 76 percent of SMBs BDMs have active roles in cloud security and in a whopping 87 percent of SMBs they are active in mobility security management.

Techaisle’s SMB IT Decision Making Authority: ITDM vs. BDM report provides data to substantiate a common theme: business management is taking a more active role in IT acquisition, deployment and management. This is especially true in cloud and mobility as BDMs are able to directly procure systems that support their business needs (such as CRM systems used by sales management) – avoiding IT’s processes and timeframe for deployment, and in some cases, avoiding input from IT altogether.

When we speak to ITDMs or IT suppliers who work with IT managers we are often exposed to the counter-argument against this newfound BDM freedom: that without effective IT oversight, cloud systems can become disconnected from the corporate IT infrastructure, creating silos of data, and potentially, security, audit, compliance and privacy risks.

To obtain insight into this issue, Techaisle asked survey respondents to identify who (by area of responsibility) has primary responsibility in each of 10 cloud security areas and 12 mobility security areas. Looking across both groups, we see at a glance that in both the small and mid-sized businesses business management is viewed as a source of access policy but the management of the security process is largely the preserve of IT.

Comparing Cloud and Mobility Security Management

The study shows that there are three key players in managing cloud and mobility security within SMB organizations – Business Management, IT Management and Service Providers. Business management involvement is higher than IT management in mobility security, 87 percent vs. 68 percent. Drilling down into the data we find that SMB BDMs take an active role in five out of twelve mobility security areas and have primary responsibility in seven security areas.

On the other hand, SMB BDM involvement in cloud security management is 76 percent which is almost same as ITDM at 78 percent. But unlike mobility security management, BDMs are actively involved in three cloud security areas and have primary responsibility in only one security area.

Within the mid-market businesses, IT management has a higher percent of involvement than business management for both mobility and cloud security administration. ITDMs actively participate in five of twelve mobility security areas and five of ten cloud security areas.

The above data does not imply that BDMs and ITDMs are not involved in all security management areas; in fact, they are but the roles and responsibilities shuttle between the two principle SMB custodians.

Comparing Small and Mid-market Businesses for Cloud security management

Drilling down into the cloud security management process only, the data reveals that BDMs are responsible for setting access policy in over 60 percent of cases – but all other steps in the process are primarily the responsibility of IT but with involvement from BDMs, from user authentication to ensuring consistency with audit, regulatory and compliance requirements and to ensuring that backup is regular, effective and testing.

When we turn our attention to the mid-market businesses, the first finding that leaps out at us is the more prominent role played by business management. In nine of the ten cloud security activities covered in the survey, medium business respondents report more non-IT management involvement than their small business peers – and in one step in the cloud security process (ensuring consistency with audit, regulatory and compliance requirements) medium business BDMs have similar level of responsibility as ITDMs.

Role of Service Provider in Securing SMB Cloud and Mobility solution deployments

Survey data presents a very interesting dichotomy about the role of service providers in securing SMB cloud and mobility solution deployments. Service providers are involved in 47 percent of SMBs for cloud security which is 35 percent higher than their involvement in mobility security. But for mid-market businesses they are 50 percent more involved in mobility security than cloud security. Out of the twelve areas, key roles played by service providers for mobility security are “Authenticating user identities” and “Deploying and updating malware and other security technologies on corporate-owned endpoint devices”. Within the ten different cloud security areas, service providers are most involved in “Safeguarding against unauthorized access” and “Authenticating user identities”.

It is interesting to note that both small and mid-sized businesses rely on cloud suppliers through the security process – interesting primarily because (as the saying goes) “you can’t outsource responsibility”. SMBs are free to rely on cloud suppliers for assistance through the cloud security process, but if/where there are breaches or other issues, the responsibility still rests with the business, not with the supplier. Techaisle believes that the proportion of SMBs –both small and medium businesses – who report that their cloud suppliers have responsibility for one or more cloud security activities should take a closer look at whether and how they might separate responsibility (which is a management requirement) from delivery (which may well be best outsourced to a cloud vendor). Here again, SMBs require guidance from security specialists to align practices with requirements.

Details about the report can be found here

Related research:

2014 SMB & Mid-Market Cloud Computing Adoption Trends

2014 SMB & Mid-Market Mobility Solutions Adoption & Trends