Predictions 2020: Is Security Automation the Answer?
As we look toward 2020 and plan for the ongoing IT security skills shortage, we continue to rationalize the use of automation. Will it help reduce complexities and improve compliance? Are there more risks than rewards? With Gartner predicting that 99% of all firewall breaches will be caused by misconfigurations not flaws throughout 2023, it can’t hurt to try?
FireMon uncovered in its recent 2019 “State of the Firewall” report that these misconfigurations are largely caused by human error and outdated, manual IT processes. With 65% of respondents not using any automation to manage their security policies, what does the future hold? Let’s look at two sides of the automation coin to toss out some predictions.
If adoption is slow, then we will, unfortunately, see more of the same.
- Firewall misconfigurations will increase. The sheer volume of rules today is already unmanageable without some form of policy behavior analysis. According to the 2019 “FireMon State of the Firewall” report, manual processes led to misconfigurations accounting for 10% to 24% of the changes that require work. With security teams dealing with 25 to 100 manual firewall changes per week, it’s no wonder misconfigurations are at an all-time high and the number of data breaches is following suit. In the coming year, we can expect to see policy complexity increase if better firewall management hygiene is not applied. As unnecessary complexity increases across the infrastructure, you can count on human error and additional risk to enter the picture at an even more alarming rate. The year 2020 could set a new record for breaches as a result of firewall misconfigurations.
- The cost of failure to comply will cost organizations more. In the recent report, we uncovered that almost 20% of C-level executives were unsure if they failed a compliance audit in the last 12 months. This was largely due to a lack of visibility regarding security risk. If businesses don’t adopt automation, we will see this number increase by almost 50% and result in crippling fines from noncompliance.
- Network visibility will take a hit. Increased firewall change requests with ad hoc/manual processes will decrease visibility into network security risks. In the 2019 report, 12% of respondents did not even know when a misconfigured firewall caused an issue on their network. As the lack of visibility increases from growing network complexities, we could see that number double.
- Cloud migration projects will slow. In 2020, there will be a number of major enterprise breaches leveraging hybrid/multi-cloud architectures resulting from insufficient visibility of the underlying network topology that leads to misconfigured routes between the cloud provider, enterprise and internet. These types of breaches in 2019 and beyond are slowing cloud migration projects as IT security professionals are concerned about having a consistent way of managing policies across their infrastructure and cloud workloads.
However, if automation becomes a top security priority in 2020, we could see:
- Firewall misconfigurations decrease by 20%. If enterprises increased their adoption of automated change management tools, we could expect misconfigurations to decrease by almost 20%. This would, of course, lead to a significant decrease in data breaches as well.
- Organizations will increase their risk visibility to ensure compliance. With increased network visibility, organizations will have full insight into security risks and what’s needed to comply with regulations. In our recent report, we found that less than 5% of respondents were 100% prepared for a compliance audit. Automation would dramatically increase compliance success for today’s enterprises.
- Businesses will better utilize their IT staff to address high-priority needs. By automating change requests to reduce the need to remediate misconfigurations, IT security resources will be better utilized, resulting in both a reduction in cost and time. Further, the ability to offload highly repetitive tasks could give security professionals 40% of their time back in a day.
If businesses do not automate their network security management processes, we can only expect an increase in misconfigurations and therefore more breaches, amongst other security challenges. By introducing the right amount of automation for their organizations’ current needs in 2020, security teams can mitigate the burden of human error and better utilize their security resources, without adding complexity to their security operations.
Want to learn more about what to expect in 2020? Join us Jan. 23 for our Predict 2020 Virtual Summit featuring discussions from some of the industry’s best and brightest offering up their visions for the future. Sign up today for this free daylong virtual event.
