Trends in Information Security

Yesterday I made my annual trip to Infosecurity Europe, Europe's biggest information security exhibition, and I observed a few trends in the information security market -- the biggest involving specialization and authentication/trust.

• Specialization. As the information security market becomes more and more sophisticated, and buyers become more knowledgeable about the real challenges, the solutions being offered are more and more specialized and focused on specific threats. Perhaps the clearest illustration of this is the fact that the two biggest infosec companies -- Symantec and McAfee (Intel) -- were not even present at the event. In the past, they have each had huge booths, advertising their varied, general infosec offerings. Threat-focused players like FireEye are now the companies that are selling most prominently.
• Authentication/Trust. As threats become more severe, it is becoming clearer that restricting network access to trusted persons and devices is one of the key ways to mitigate risk as part of a resilient security architecture. There have long been many vendors of authentication solutions, but they are becoming more and more prominent.

Other less prominent developments that I observed were:

• Compliance Up. Compliance with regulatory obligations and standards has long been a focus of infosec offerings, but this seems to be becoming more prominent.
• SIEM Down? The biggest trend that I noted last year was the growth of products and offerings in security information and event management (SIEM). There are many and increasingly-sophisticated offerings in this area, but the marketing of them seems somewhat less prominent, with solutions protecting against specific threats (see above) taking the limelight.
• DDoS Up? It seemed to me that a particularly large number of vendors are offering solutions to deal with distributed denial of service (DDoS) attacks. This is not a new threat, so I am not quite sure the reason for this trend.