Analyst Chat

Analyst Chat #5: Beyond prevention - The Bigger Picture of Cyber Security

Show description
Speakers
IAM Practice Director / Head of Advisory
KuppingerCole Analysts AG
Having worked for his whole professional life in Identity and Access Management, Matthias joined KuppingerCole in 2014. In his role of the Director of the Practice IAM he works on maintaining the leading role of KuppingerCole in all facets of the topic of digital identities and their access to...
View profile
Cybersecurity Practice Director & Chief Information Security Officer
KuppingerCole Analysts AG
With almost 15 years of experience in IAM and Cybersecurity, Christopher is experienced in advising clients on a strategic level with necessary technological background. He holds a Master's degree in Computer Science from the Karlsruhe Institute of Technology and combines both theoretical...
View profile
Playlist
KuppingerCole Analyst Chat
Analyst Chat
Analyst Chat #11: How to Ensure Your Video Conference’s Security
May 08, 2020

Matthias Reinwarth and Martin Kuppinger discuss the measures necessary for securing your favorite online communication platform.

Analyst Chat
Analyst Chat #99: Protecting OT and ICS
Oct 18, 2021

John Tolbert sits down with Matthias and shares his insights into current approaches for protecting and defending essential enterprise systems beyond traditional, often office-focused cybersecurity. Safeguarding Operational Technology (OT), Industrial Control Systems (ICS), and the Industrial Internet of Things (IIoT) is getting increasingly important. John explains that modern approaches like Network Detection and Response (NDR) and especially Distributed Deception Platforms (DDP) can be valuable building blocks in an overall strategy for defending, for example, the factory floor or critical clinical systems.

Analyst Chat
Analyst Chat #178: Identification of Natural Enemies in the IAM Area: Active Directory and IGA
Jun 26, 2023

In the episode of the KuppingerCole Analyst Chat series, Martin Kuppinger and host Matthias engage in a detailed discussion about the challenges associated with the integration of Identity Governance and Administration (IGA) into identity management systems based on on-premises Active Directories.

They dissect the structural and deployment aspects of Active Directories, highlighting how these often conflict with contemporary access governance paradigms. Martin explains why these contradictions can make the overlay of IGA on Active Directories extremely challenging, if not entirely unfeasible.

Analyst Chat
Analyst Chat #9: The Dark Side of the API Economy
Apr 30, 2020

Matthias Reinwarth and Alexei Balaganski discuss the challenges of explosive API growth without proper security controls in place.

Analyst Chat
Analyst Chat #108: Privacy and Consent Management
Jan 17, 2022

"Privacy and Consent Management" is an exciting topic in a continuously changing market. Annie Bailey has just completed her latest Leadership Compass, which researches this market segment. To mark the release of this document, she joined Matthias for an Analyst Chat episode where she talks about the innovations and current developments.

In A Nutshell

In the episode 108 “Privacy & Consent Management” Matthias hosts Anne Bailey.

Q: “From a definition point of view, what do we need to think of when we talk about privacy and consent management?”

Anne: “Yeah. So this is one of those terms where you could spin it in a lot of different ways, you know, privacy is so much in the public discourse that it doesn't really have a concrete definition anymore. So I thought it might be useful to get us all on the same page before we talk any more about it. So the way at least I have defined privacy and consent management in this most recent report. It's, of course, considering organizations and it's their administrative and governance capabilities over data privacy within their organization and of course, the tools and the solutions that are there to make that happen. So you could think of it then in a simplified manner about the capabilities that such a tool or a solution would have to the first group of capabilities, would then to be able to manage any incoming signals about privacy and consent. So these are things like being able to manage cookies and trackers that are on websites, being able to accept and then implement those consent or preference choices that an end user would make. And that would be over the range of different channels. So on a smart TV, on a mobile device, on a website, over the phone, via email in person interactions as well, should be considered. So that's all about managing the incoming signals. But what's also very important as well is the organization's ability to take care of their own internal management of privacy. So being able to govern sensitive data, which is in the organization and private data, being able to document their steps towards compliance and something which is a buzzword in this most recent report is being able to operationalize privacy.”

Q: “Recently, you published an updated version of your Leadership Compass report, which compares providers and services. What are the changes in the market that you can observe that you want to share with us?”

Anne: “Yeah. So this is an especially dynamic market area. Things are always changing. And so we can see some pretty big market changes between the report which published 18 months ago or so and the one which just came out this week. And that's in the types of vendors that were interested in participating. So what we saw in the last report were a lot of vendors that really focused on being able to manage those incoming signals, so being very focused on cookie management, on being able to collect consents and preferences and make sure that those are all able to be implemented in the many different connected systems within an organization and all the downstream vendors that may impact. Very focused on this incoming flow of information from end users. And what we saw, which was different in this report, is that there were more vendors that are really focused on data governance and using that as a foundation for privacy. So being able to operationalize and take action within the organization to further their privacy goals. And so we could think of that as an example. So being able to identify a privacy weakness of some sort in a process and then from that same administrative screen, then be able to do something to address that weakness. I guess we could go into more concrete details on what that could be. So, you know, if there was a scan done on a database and that scan returns the notification that there is private information in this database, there would then be the chance to leverage automation to go and anonymize those sensitive fields. So you're then connecting information about the status of privacy in the organization with an action to then improve it. So that was something that we noticed among several of the vendors that they're moving more in this direction. And that also does connect back to the relationship between the end user and the organization. So there was a big focus on being able to provide support for data subject requests and being able to process those. So in the same way of operationalizing privacy, if a consumer then submits a data subject request, the administrator would then be able to scan and automatically compile a report containing their personal information rather than needing to do that manually.”

Q: “Vendors offer products and services globally. Do you think they can catch up with changing privacy and consent requirements?”

Anne: “Mm-Hmm. Yeah. And frankly, this is really hard to stay up to date with because given our very globalized presence on the internet and connection with consumers all around the world, many organizations do have to stay up to date with the regulations that are not just for their own jurisdiction and in the region where they reside, but they have to pay attention to where their customers are, where any of their downstream suppliers or, you know, MarTech partners may reside and where this data is moving. So they have to be aware of a much wider legal domain than they've been used to before. And as I mentioned before, this is a really dynamic space. And part of that is because there are many privacy regulations which are being released all around the world. So this is something that we've identified as a really key capability in privacy and consent management tools, is that having some basis, some support from legal experts in-house to be able to keep up with all of these changing regulations and be able to pass that knowledge down to their customers is a really valuable thing.”

 

Analyst Chat
Analyst Chat #131: How to protect your OT and IoT from Cybersecurity Threats
Jul 04, 2022

Graham Williamson has teamed up with John Tolbert to research the current state of the Operational Technology (OT) and Industrial Control Systems (ICS) sectors. They documented the ability of the main industry players to support a coordinated approach to detecting, responding to, and recovering from, cybersecurity attacks and intrusions. Graham joins Matthias to provide insight into this market on the occasion of the publication of the Market Compass Cybersecurity for Industrial Control Systems. 

Analyst Chat
Analyst Chat #88: What (and why) is XDR?
Aug 09, 2021
XDR (eXtended Detection & Response) solutions are an emerging category of security tools that are designed to consolidate and replace multiple point solutions. John Tolbert and Alexei Balaganski join Matthias and share their views on this market, the existing offerings, and how it might evolve.
Analyst Chat
Analyst Chat #138: Jumpstart Your Zero Trust Strategy With Zero Trust Network Access (ZTNA) Solutions
Aug 22, 2022

Zero Trust is rapidly gaining popularity as a modern alternative to traditional perimeter-based security. While it is (rightfully) mainly considered a concept rather than a product, a new market segment has developed. Those solutions apply this concept to network-based access to existing applications and other systems by creating a logical identity- and context-based overlay over existing (and presumed hostile) networks. Alexei Balaganski has examined this new market for KuppingerCole Analysts research and talks to Matthias about how this can speed up ZT deployments. 

Analyst Chat
Analyst Chat #86: Zero Trust Means Zero Blind Spots
Jul 26, 2021

The path toward a Zero Trust architecture to improve cybersecurity for modern enterprises in a hybrid IT landscape often seems overly complex and burdensome. Alexei Balaganski is this week's chat partner for Matthias and he draws attention to an often overlooked benefit of such an infrastructure. One key idea of Zero Trust is to actually reduce complexity and unnecessary effort and instead focus on what really needs to be protected.

Analyst Chat
Analyst Chat #20: PAM - What are Privileged Accounts
Jun 08, 2020

Matthias Reinwarth and Paul Fisher launch a new series of talks about privileged access management.

Analyst Chat
Analyst Chat #16: Enterprise Databases in the Cloud
May 25, 2020

Matthias Reinwarth and Alexei Balaganski talk about making the right choice of a database engine to power your next cloud project.

Analyst Chat
Analyst Chat #130: Leadership Compass Endpoint Protection, Detection and Response (EPDR)
Jun 27, 2022

The previously distinct but now converged fields and product lines of Endpoint Protection (EPP) and Endpoint Detection & Response (EDR) are covered in the brand new KuppingerCole Analysts Leadership Compass on EPDR (Endpoint Protection Detection & Response). Lead Analyst John Tolbert joins Matthias to give a sneak peek into this market segment and shares some results of the evaluation as well.