Rise in tech threats spawns growth for region's IT security vendors
The rise of targeted attacks on information systems has created growth opportunities for security software companies in Central Massachusetts, according to industry experts.
Globally, revenue for security software vendors has grown 10.5 percent over the past two years, from $8.57 billion in the first half of 2011 to $9.47 billion in the first half of last year, according to technology research firm IDC of Framingham.
A good chunk of that growth has been concentrated in Massachusetts, with revenue for eight of the Bay State's largest security software companies — including Hopkinton-based EMC and Courion Corp. of Westborough — growing 15.5 percent over the same period from $1.3 billion to $1.5 billion, IDC found.
Growth potential
The commonwealth has more security companies than anywhere outside Silicon Valley, said Charles Kolodgy, a research vice president for IDC.
“Threats aren't going away,” Kolodgy said. “In fact, they're getting stronger.”
And projections for global security spending are even rosier, Gartner found. The Stamford, Conn.-based research company expects worldwide security spending to grow 18.6 percent over the next two years, from $67.44 billion in 2013 to $79.96 billion in 2015.
“Within a matter of minutes, anybody can download the tools and launch an attack,” said Nirav Shah, director of product management for Corero Network Security, a Hudson-based cyber-security firm.
“It just takes one or two attacks to get a return on your investment.”
Attacks in recent years have become easier to launch, harder to detect and more sophisticated in nature, experts said.
Malicious software found its way into the checkout terminals at Target stores across the nation, exposing data from 40 million credit and debit cards between Nov. 27 and Dec. 15. Investigators believe the attack originated overseas.
Software security companies used to focus almost exclusively on protecting against denial-of-service attacks — which make a website or other network tool unavailable to users — through defenses such as a firewall, Shah said.
A complicated web
As attacks have expanded to the domain of cyber-criminals and enemy states, they have become increasingly more complex, said Steve Orenberg, president of Kaspersky Lab, a Woburn-based computer security company.
Instead of casting a wide net, attackers have increasingly relied on insider intelligence to take advantage of vulnerabilities within a particular organization, according to Ruggero Contu, a research director for Gartner.
The most destructive attacks often require a good amount of financing for sophisticated coding, Orenberg said.
“It's not just someone in the basement,” he said.
Application-layer attacks, which can impact a company's web presence by keeping servers busy, have really taken off over the past year, Shah said.
Shah said these attacks are tough to detect — the uptick in server activity could be a result of a legitimate increase in web traffic — and for users to recognize. They bring the website to a crawl, but don't produce an error message.
Smaller businesses would lose $100,000 to $200,000 if their websites were to be down for an hour, Shah said, while a retail giant like Amazon would lose nearly $2 million per hour.
It costs less than $50,000 to defend against an application-layer attack, Shah said.
Foreign governments
The most insidious new attacks are being carried out by nation states and are affecting critical resources, Orenberg said.
The targeted malware typically hits a specific aspect of a country's supply chain - such as infrastructure that supplies goods to the military - rather than a particular corporation, Orenberg said.
Nation state attacks are launched to gather information on foreign systems or substations, Orenberg said. The transportation, energy and telecommunications industries are the most frequent targets.
Companies are increasingly looking for software that's compatible with tablets or smartphones, said Aviram Hinenzon, vice president of marketing for ViryaNet. The Westborough-based company sells mobile applications that can assist with everything from scheduling appointments to getting directions.
“We can offer so much more today than we could offer five years ago,” Hinenzon said.
But mobile technology also poses a whole new set of security threats.
To start, many use personal mobile devices for businesses, Contu said, posing legal challenges for firms looking to implement security rules or policies.
There's also a greater likelihood that mobile devices will be misplaced, which Contu said poses a major risk to company data.
Employers have tried to mitigate that threat by requiring workers to use secure channels like virtual private networks or encryption to access corporate systems, Contu said.
Securing applications is the greatest challenge associated with mobile devices, Contu said. And even more traditional lines of attack such as malware have become increasingly prevalent on Androids, Kolodgy said.
However, “attackers always adjust to the new technology,” Kolodgy said.
WBJ Web Partners
Most Recent
Most Recent
0 Comments