Endpoint Security And Intrusion Detection Remain Top Concern

Continued from page 1

“From IBM’s perspective we are cautiously moving forward, but we are also enabling a large number of folks to do this, as we really do want to enable enterprise apps on mobile devices,” said Merrill. “But this does raise issues such as what data resides on the device, and how do we control that data?

“To be fair for most enterprises data control is already well defined, but we need to ensure this control extends to these new endpoints,” he added.

The Internal Threat

That said, securing the endpoint is all very well, but surely no amount of investment and technology can counter the internal threat posed by disgruntled employees?

“I think the malicious employee can also have the same sensitive data stored on their mobile device and their conventional workstation,” replied Merrill. “I for example use Lotus Traveller which means that it much harder to get data off my mobile device because it is encrypted. But to be honest I think the threat posed by malicious staff is more the exception than the norm, as IT managers are more likely to be concerned about attacks from the outside, or staff simply losing their smartphone or laptops. And to be honest, it is far easier to lose a smartphone than a laptop.”

“What we at IBM are trying to do is define the roles of people within company, and then equate those roles with the right technologies,” said Merrill. “Whether virtual machines or mobile solutions, we are focusing on the security layer, where the platform doesn’t matter. That is the challenge, so we don’t sacrifice security across the platforms as we apply the layer.”

Cloud Approach

What about the advent of the cloud? How is that effecting businesses and enterprises, and will security worries mean they opt for a public or private cloud approach in future?

“Well more and more enterprises have approached the cloud conservatively, and that is not going to change,” said Merrill. “Organisations will always be cautious about what they put in the public versus private cloud.”

“The cloud simply means an extension of our current security architectures of external versus internal services, so that we never expose our internal services externally,” said Merrill. “External services will likely sit on a public cloud. For us public cloud services examples includes conferencing services (both public and private). We for example have a cloud that supports conferencing, both for internal IBM staff, but the same service is also used for external purposes.”

Continued on page 3