Key Findings & Highlights:

The profile of security attackers has changed, from lone attackers to organized crime and cyber espionage at a national level. The cause of the attacks have changed as the attacker profile changes, for example lone attackers a decade ago may have targeted a very high number of email addresses with a phishing scheme, for which the attacker would get a low response rate with each hit, providing a nominal reward. Organized cybercriminals, however, may now be performing attacks targeted at a specific organization over a long period, with the express purpose of copying the organization's IP, or silently disrupting the organization's operations, to gain a competitive advantage.

The general populace is more aware of cybersecurity through the reporting of insider threats such as Snowdon and Wikileaks or mega breaches. Coupled with an increasing number of government regulations on the storage and security of client data, it has become increasingly important for organizations to have an IT security strategy.

With the growth of third party storage such as cloud based storage, a number of organizations have moved from internally managed databases to third party solutions. This move typically causes a disconnect within the organization's security operations, and creates a more attractive target for attackers.

The increasing use of cybersecurity can be attributed to:

• Increasing cost of cybersecurity
• Access to cybersecurity skills and up to date information
• Ability to respond quickly to threats
• Ability to gain a holistic view of cybersecurity
• Strengthening social engineering around security
• Uneven workloads inherent in IT security.

IT security services can broadly be split between application and infrastructure security:

• Application security includes activities in support of the clients' applications or endpoints, with services including vulnerability testing/management, endpoint security management, application firewall, identity access management (IAM), and application secure development lifecycle (SDLC)
• Infrastructure security includes activities in support of the client's network, whether this is external or internal, and the information transferred across the network. Services include vulnerability management, SIEM, firewall management, network data loss prevention (DLP), intrusion detection/prevention services (IDS/IPS).