Pay-As-You-Go Cybersecurity

Shifting from a monolithic, high investment, capex-based cybersecurity consumption model to an on-demand, pay-as-you-go one is clearly the way of the future.

“By the glass” consumption, whereby businesses pay for IT resources and services as and when they need them, offers widely accepted financial and operational benefits that promote agility, scalability, and digital transformation.

This model has already proven successful in the cloud and for IT. Amazon Web Services (AWS), Microsoft, Google and other leading cloud service providers are charging by smaller and smaller increments, allowing service access to users on an as-needed basis. AWS even charges by the second.

Addressing the Gap

More and more often we encounter cases whereby business executives and technical leaders find themselves in opposing camps of thought in terms of the best way to achieve goals.

Analysts have found that 67% of business leaders and board members are pushing CIOs, CISOs, and other technical leaders to evolve services and approaches faster and more aggressively.

Board members have climbed aboard the digital transformation bandwagon, and they want their organisations to move quicker than their competitors toward that goal.

Research from Palo Alto Networks’ cloud security study which surveyed 500 CISOs in eight countries indicates that most cybersecurity executives believe things might be moving too fast for them to properly assess risks and their implications.

Board members and business leaders have fast become big believers in the notion of “disposable IT,” which imposes a smaller footprint on enterprises while providing greater agility and, potentially, cost savings. Many CISOs, however, are still in a traditional mindset of purchasing multiyear licenses for security, backed up by a lot of testing, risk analysis, and methodical decision-making.

Organisations must find ways of spanning the chasm between the “go faster” mandate from the board and the “let’s tame the cyber-risk monster” philosophy of the CISO.

DevOps to DevSecOps

Paying attention to actual usage patterns of IT and cybersecurity, as well as how security maps to IT services, helps ensure consumption models of cybersecurity and IT match-up. For instance, if your IT organization has adopted a DevOps process, your IT usage and availability profile could change weekly, daily, or even every few hours. Security consumption must align with those IT-usage trend lines.

The process can be viewed as a three-legged stool. First, there’s an operational need; second, the developers build the solution to meet that need; and, third, security must be bound to those operational and development cycles. Unfortunately, DevOps, so far, doesn’t typically include this security leg.

Business leaders are demanding real-time adaptation of software to match operational requirements, and security must match that every step of the way. If not, new DevOps requirements will have come and gone before the security team figure out what was needed, yesterday. Hence, there’s a need to shift from DevOps to DevSecOps, where security is natively part of the process.

Business Benefits

Adopting pay-as-you-go cybersecurity enables the agility, responsiveness, scalability, and cost efficiency today’s application-development and deployment cycles require.

Maintaining traditional forms of cybersecurity consumption can mean organisations find themselves over-investing in security and not being able to pivot on a dime when new risks emerge.

A case in point: a CIO who wanted to transform his company’s data center, says it took an inordinately long time to re-architect, get approval for, and roll out. So much so that he admitted that, today, the data center is already out of date.

Getting caught up in monolithic, long-term investments simply doesn’t make sense if you wish to remain competitive in increasingly digitised markets.

Moving to pay-as-you-go cybersecurity is a win-win for both business leaders and the CISO. Both parties are safe in the knowledge that data, business processes, routes to market, intellectual property, and sources of competitive advantage are protected against cyber threats.

Moving to this model affords the business greater digital agility while avoiding over-provisioning, keeping its executives and board members happy. Meanwhile, the model ensures that the organisation is completely protected from cyber threats no matter how fast the business’s development. It also prevents the organisation from under-provisioning on cybersecurity, keeping the CISO happy.

Discovering and thwarting breaches before they happen, and doing so against a rapidly evolving and increasingly innovative set of bad actors, can become prohibitively expensive and very manpower-dependent. However, pay-as-you-go security enables agility, reduces costs, and can speed up response times (since there is no limit to capacity).

The value of such a consumption model is clearly already working elsewhere, and there is no reason we should not be embracing this same idea for cybersecurity.

Infosecurity-Magazine

You Might Also Read: 

What Every Small Business Should Know About Hackers & Cybersecurity:

Big Companies Have An Achilles Heel:

 

« Blockchain May Break Tech’s Hold On AI
British Airways Hack Was Much Bigger Than First Admitted »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Roka Security

Roka Security

Roka Security is a boutique security firm specializing in full-scale network protection, defending against advanced attacks, and rapid response to security incidents.

SANS Institute

SANS Institute

SANS is the most trusted and by far the largest source for information security training and security certification in the world.

GigaOm

GigaOm

GigaOm's mission is to provide enterprises with information and analysis to help them make better decisions about technology.

Information Commissioner's Office (ICO)

Information Commissioner's Office (ICO)

The Information Commissioner's Office is an independent authority set up to uphold information rights in the public interest.

VdS

VdS

VdS is an independent safety and security testing institution. Cybersecurity services include standards, audit/assessment and certification for SMEs.

Swiss Re

Swiss Re

Swiss Re Group is a leading wholesale provider of reinsurance, insurance and other insurance-based forms of risk transfer including cyber risk.

achelos

achelos

achelos is an independent software development company providing innovative technical solutions for micro-processor chips / security chips and embedded systems in security-critical application fields.

ePlus

ePlus

ePlus designs and delivers effective, integrated cybersecurity programs centered on culture and technology, aimed at mitigating business risk and empowering digital transformation.

Plug and Play Tech Center

Plug and Play Tech Center

Plug and Play is the ultimate innovation platform, bringing together the best startups and the world’s largest corporations.

Soffid

Soffid

Soffid provides full Single-Sign-On experience and full Identity and Access Management features by policy-based centralised orchestration of user identities.

Edureka

Edureka

Edureka is an online technology training provider with the most effective learning system in the world. We help professionals learn trending technologies for career growth.

Acreto

Acreto

Acreto is an end-to-end security infrastructure that protects all your technologies with a single, simple cloud service.

TatvaSoft

TatvaSoft

TatvaSoft is a custom software development company delivering business IT solutions and related services to customers across the globe.

Darknone Global

Darknone Global

Darknone is a consortium of elite hackers and security leaders united by an unbridled passion for augmenting the security of the digital realm.

DeXpose

DeXpose

DeXpose is a hybrid dark/deep web monitoring and attack surface mapping platform to help you find compromised data or exposed assets related to your organization way before threat actors.

Telarus

Telarus

Telarus is a Technology Services Brokerage that holds contracts with the world's leading cloud voice, contact center, cybersecurity, mobility and IoT providers.