Why security is failing #2: Complexity

virtualization-securityYesterday, I wrote about the first of three reasons that the mainstream approach to security is failing to meet businesses’ needs: incomplete protection.

Today I’m back with the second part of the series, focused on reason #2: complexity.

As security guru Bruce Schneier says, “complexity is the worst enemy of security.” Yet sometimes it seems that if you want advanced security, you have to have an advanced degree. Why exactly is security so complicated?

For one thing, it’s much easier for engineers to build a feature that’s hard to use than one that’s easy to use. Powerful smartphones existed before the iPhone, and some of them had more powerful features than the first iPhone model. But it took the brilliance of Steve Jobs and his team at Apple to create an interface that was intuitive and a set of features and apps that just worked.

Security is also complicated because of the incomplete protection problem I wrote about yesterday. If each product only addresses one small part of the problem, then it’s up to the business to figure out how to piece these products together and make them work effectively to fill in all the gaps. And each of those products has its own console, its own terminology, its own policies, its own alerts… it’s no wonder that IT professionals, especially in small and midsize companies, are overwhelmed!

Trying to make sense of all those disparate systems has led to the emergence of SIEMs, which gather alerts from multiple products and attempt to organize and display them in a consumable way. But that still requires someone to sift through a haystack of data looking for a needle of actual danger. That takes time and expertise that many organizations don’t have; and even those that do are still often plagued by false positives and, even worse, false negatives — cases where the analyst just didn’t see a connection between events amongst all the noise.

Sophos adheres to the principle that security can be made simple. And, not only that it can, but that it should. Nowhere is this more evident than in Sophos Cloud, which delivers complete endpoint, mobile, and web security that just works, starting the moment you create an account. And with real-time threat intelligence integrated into the product, the hard work of identifying threats and knowing what to do about them is left to the experts at SophosLabs.

On Monday, I’ll write about the final challenge in delivering successful business security. And on Tuesday, January 20, watch this blog to see what we’re doing to deliver even simpler (yet more effective) security for our customers.

For even more details, check out our webinar on all the features in Next-Gen Enduser Protection.

3 thoughts on “Why security is failing #2: Complexity

  1. Pingback: Why security is failing #3: It lacks coordination | Sophos Blog

  2. Pingback: Introducing Next-Gen Enduser Protection | Sophos Blog

  3. Pingback: Net Universe ǀ Connecting Solutions – Why security is failing #3: It lacks coordination

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s