Concerns.
1. Lack of enterprise security architecture framework or Security Program Strategy. This is a methodology for addressing security concerns at every and each architecture domain. The existing enterprise architecture and security architecture frameworks are not quite there yet or non-existent.
The legislative arms of the government fall here too. If the architecture exist, then its is viewed as a panacea, no actioning is needed, e.g the password policy. It is general knowledge on how it should be done but implementation is shelf-based.
2. Lack of alignment with both business, IT, operations and regulatory,therefore,a need to transform the security organization, i.e placing the security capabilities as a subset of the business reference model to give understanding of how they fit within the strategy,organizational units, business functions and processes.
3. Legal regulatory and internal compliance(stakeholder business objectives and investment) conflicts . The increasing number and scope of regulatory requirements often can override business objectives or internal compliance and affects core business capabilities. Security is the viewed as hindrance.
4. A need for business-outcome-focused and risk-driven security reference architectures. In our enterprise security architecture framework, risk and business objectives are the key drivers for the selection of security controls. As this is a top-down approach, it ensures that all policies and controls are identified and owned.
5. Emerging trends and technologies, such as IoT,cloud, BYOD and mobility affect data privacy. The challenge is gaining knowledge around the relation to data privacy requirements, threat and vulnerability vectors and business objectives.
Having a proper security program/architecture sanctioned by the stakeholders and mostly importantly, the executive management and the government legislation(of course without the evident greed governments) will trickle down to every unit and person. Verizon reports (
http://www.verizonenterprise.com/DBIR/2015/) that 96
percent of attacks are not sophisticated and 97 percent are easily
avoidable. Blowing your mind of is that, it is due to simple stupidity(my meaning), lax access policies and
internal employees.