Different conferences, common theme: How to best manage the disparate security solutions we’re using

As a venture capitalist focused on security, I’ve spoken at and participated in a number of terrific conferences this year.  Each has offered an opportunity to explore different specific market segments and to make valuable new connections.  Most recently, I’ve picked up on converging macro themes and similarities across events.

At the end of July, I attended and spoke at Cyber:Secured Forum in Dallas, a conference primarily attended by physical security professionals, and in early August, I attended Black Hat in Las Vegas. On the surface, these conferences are very different. Black Hat, one of the biggest cybersecurity conferences, had thousands of attendees, while Cyber:Secured, a conference focused on protecting the technology of physical security devices and services, had just a few hundred. The common thread between them?  How to manage the disparate security solutions we are using. Here are the key take-away points from both the events.

Cyber:Secured Forum

Most of the people in attendance were executives from the physical security world – executives from physical security product companies, service providers, systems integrators and distributors – with some participants from the cybersecurity ecosystem. Most of the storylines in the sessions I attended were how the physical security world is becoming more like the cybersecurity world, with greater emphasis on tools and technology. This is very different from the past, when physical security was about the people tasked with protecting a designated beat or watching a cluster of video monitors connected to surveillance cameras.

Today, however, physical security tends to mirror the digital world, with security products relying on IoT-enabled sensors and the collection of data. The IT devices of the security world are just as susceptible to data breaches and other cyberattacks as any other IoT or connected device. So, as organizations move to a more technical physical security focus, they also need to include cybersecurity.

In many companies, the CSO or CISO has started wearing two hats and is beginning to manage both IT security and physical security. Essentially, managing two islands by one executive. But as you can imagine, the culture of security guards or campus police is very different than the culture of those tasked with cybersecurity. From the CISO’s point of view, the questions that arose were: how do you manage these two entities without disrupting each other and how do you ensure the technology is able to keep up with and integrate well with the critical people on the front lines?

Black Hat

At Black Hat, we were presented with an overdose of cybersecurity technology, and different product silos. Each of these silos was littered with a number of similar-looking vendors making copycat claims of technical superiority.  Sessions touched on this issue and the addressed the need for better integration across this plethora of technology.

From a macro level view, both the conferences were trying to grapple with the same issues: solving security problems from a more holistic perspective. Session after session, it became clear that rather than looking at how to protect a single endpoint device or database from compromise, it’s time to think about all of the technologies and how they interrelate. And, like in physical security, the issues come down to how to best manage all of these disparate technologies.

Organizations are using multiple solutions for different cybersecurity needs, but they don’t necessarily know how to manage them as a collective. For example, what is the optimal mix of products and configurations to provide the lowest risk for a particular security budget?  Or, if there are three solutions out of a dozen that need patching or updating, how can organizations know the optimal sequential order to do the updates, and how do they know that if they fix the firewall first, that it would have been more critical to manage the endpoints first to reduce risk?

Moving in the same direction

While each of the conferences addressed the problems they face from different angles, the goal was the same. In one case it might be physical versus cyber, while in the other case it might be bringing multiple technologies together, but the bottom line discussion was how can the CSO or CISO find the best solution to manage all these entities – or separate islands – to work in harmony. How can you roll it all up into an easier to manage construct that gives you a greater level of confidence to bring to higher management or the board of directors as the most viable approach to protecting the business?

What is clear is that it’s not easy. There isn’t always the budget or staffing to properly manage the disparate approaches. Or if there is budget available, companies don’t always know what kind of solution they’ll need, or how to optimize the configuration of that solution. On a show floor like the one at Black Hat, it can be overwhelming. You take one look and wonder, “How can you figure out what to buy when there are hundreds of products and services that essentially sound alike?”

While it was encouraging to hear at both the physical and cybersecurity conferences the calls for integration, if we don’t find a way to integrate and optimize these solutions and have a holistic view of what we’re dealing with, it will be that much easier for the bad guys to break through. We need to unite the different islands of security solutions in both the physical and cyber worlds to provide the best level of protection, and that all comes down to finding a better way to manage all of it.