Prescott Winter, the former CIO and CTO of the USA's National Security Agency, has said that most big companies, including those in the Fortune 100, have "no idea what they are doing" when it comes to risk management and security.
Winter now works for security consultants The Chertoff Group and was speaking at Splunk's annual user conference in Las Vegas this week.
"As we look at the security situation at the moment, we see an awful lot of big companies, Fortune 100 companies, with appallingly weak security. They have no idea what they are doing," said Winter.
"But it is possible to protect your enterprise, it involves a risk management approach, which is then enhanced by big data. I think security can be a business enabler, it can really allow your senior officers to exercise what they want to do with confidence and the assurance that information is well protected."
Identifying critical assets
Winter argues that companies need to develop an approach that looks to protect the most critical business assets, supported by an architecture that collects a wide variety of data and works to identify any suspicious activity.
He said: "Point solutions and single systems are inadequate. You take data from all kinds of things, all kinds of sources, even for things that aren't intended as security sources, and you turn that wonderful rich stew of information into useful answers."
"The real threat is the lack of understanding what is important to the enterprise and the ability to identify the assets that matter and begin to watch those in a structured, architectured way."
Winter states that once companies have identified the assets that are the most important to the business, the ones that make the most money, CIOs need to establish how they are going to use identity and access management, encryption, and other security measures, to protect them.
"The whole point of architecture is essentially to be able to design an outcome that you want - what are the security objectives that we want to define? That's the architecture layer, you really want to design visibility and agility to be able to see the assets and to know who is in your network and to be able to support the business goals," he said.
"It's about looking at all the types of data you have got, assembling pictures and understanding what is happening and what has to stop."
Using big data to deliver secure assets
According to Winter, companies need to continuously monitor how effectively these critical assets are being protected. This is going to be delivered by collecting as much data as possible from the assets and checking for discrepancies in order to check that no vulnerabilities are being created.
Sign up for Computerworld eNewsletters.