In reply to mark goudie.

Mark - All too often in the course of my dealings with customers and clients, I see evidence of the fascination with “shiny objects” and the “magic quadrant shopping approach” to security. It wastes money, often takes forever to implement and integrate into an already complicated array of disparate and fragmented security tools and technologies. What's more, at the end of the day, that expensive solution doesn’t really reduce the highest risks across the business.

As you state, point solutions are not the answer. We need a holistic managerial approach across all aspects of security and a better (quantitative) understanding of risks, along with the application of improved controls to those areas exhibiting the greatest risk and threats to the business.

The first step has to be for CISOs and their leadership teams, to improve their understanding of the entire attack profile; to understand where potential attacks are likely to target, then to procure expert services from specialist security services providers, to protect against these attacks and to provide holistic evaluation and road-mapping expertise so that the CISO and his or her Board, are better informed where they need to focus scare resources.