How to manage information security during an innovation void

Although predictions for the coming year are a staple of the season, I will do more than offer an educated guess. I am going on the record with a guarantee: in 2012 we will see an increase in network intrusions from disparate parties trying to create IT infrastructure chaos for a variety of reasons primarily political, financial and economic. An easy prediction perhaps given the trend and yet while I fully trust CSOs and CISOs and security teams are doing all they can to prevent breaches; I am deeply concerned that they still lack the technology to adequately protect IT infrastructure from malicious attacks.

There are several reasons for this state of unpreparedness. Budget constraints certainly continue to be an issue even as the US economy plods along in recovery mode. However, the more disconcerting limiting factor is beyond the direct control of infosec executives: the scarcity of innovation in the information security industry.

Too few entrepreneurs are bringing to market new technologies that are the core building blocks for information security. While I wouldn't go so far as the say enterprises are bringing a knife to a gun fight, there is no doubt that the industry is not keeping pace with the technology or the ability of attackers. The resulting disparity between available options and the growing challenges faced is what I call the innovation void.