The analyst firm predicts by 2018, 25 per cent of large organisations will have an explicit strategy to make their corporate computing environments similar to a consumer computing experience.
Security organisations and leaders that fail to alter strategies to accommodate a more consumerised workforce will be sidelined by engaged organisations.
"Significant changes that impact an organisation's approach to security are underway," says Tom Scholtz, Gartner vice president.
"Employee digital literacy has led to a growing consumerisation movement within most enterprises, with employees using a wide variety of consumer-oriented apps for business purposes.”
Read more: State of the CIO 2014: Tackling the tsunami of technology disruption
Scholtz says other workplace trends - such as globalisation, networked reporting structures, shadow IT and a desire to foster employee engagement - are all impacting IT strategies. "As organisations shift toward a more digital workplace, long-held approaches to security need to be re-examined."
"Implementation of a digital workplace exacerbates the IT department's loss of control over endpoint devices, servers, the network and applications," says Scholtz. "In a fully consumerised workplace, the information layer becomes the primary infrastructure focal point for security control. This reality necessitates a shift toward a more information-focused security strategy."
The massive volume of devices and access vectors implied by a digital workplace, coupled with the increase in sophisticated, dynamic attack methods and insider threats, makes the traditional approach of focusing on preventive controls (such as signature-based anti-malware, network and host intrusion prevention systems, pervasive encryption and continuous patching) increasingly ineffective, says Gartner.
While the value of and need for preventive controls will never go away, the digital workplace reinforces the need to focus more on detective and reactive controls. In practice, this means increasing investments in context-aware security monitoring for internal and external environments, threat intelligence assessment capabilities and incident response. Pervasive, context-based monitoring and security information analytics will form the core of next-generation security architectures.
Read more: Expect tech spending outside the CIO’s department to rise in 2015: Forrester
Effective behaviour management is not produced by the mere deployment of an education program.
Strategies such as the digital workplace implicitly recognise that users will be given more freedom in how they use technology and information. This implies a higher level of trust that users will exhibit appropriate behaviour in dealing with enterprises' information resources.
Key elements of a behaviour-focused security communication strategy include considering "just in time" security awareness techniques, which remediate or reward user behaviour based on the appropriateness of that behaviour within the user's context.
Read more: Samsung touts ‘effortless multi-tasking’ features of Galaxy Tab S
"Effective behaviour management is not produced by the mere deployment of an education program," says Scholtz. "In addition to an education program that is focused on measurable behavioural outcomes, security leaders should develop their ability to collaborate with personnel and line-of-business managers to modify job descriptions and reward mechanisms so that they are aligned with desired security performance."
Gartner believes that trusting the motives and behaviour of individual users is a key enabler for the digital workplace. Conventional approaches to information security tend to treat everyone, including employees, with distrust. By implication, such an attitude will impede the digital workplace. However, a more people-centric approach to security will contribute to the potential success of the initiative.
People-centric security (PCS) is a strategic approach to information security that emphasizes individual accountability and trust, and that de-emphasises restrictive, preventive security controls.
"The digital workplace implies new and different security risks," says Scholtz. Thus it is imperative for the impact of the digital workplace to be properly risk-assessed.
Read more: CIO issues differ across regions, but all face digital data threats and opportunities: Gartner
Owners of information assets involved in the initiative must be informed of the risks, and the security team must help them assess the potential impact of the risks against the expected business benefits of the digital workplace, he says. Affected information owners must likewise sign off on any additional risk that they are willing to accept in the interest of the digital workplace.
Send news tips and comments to divina_paredes@idg.co.nz
Follow Divina Paredes on Twitter: @divinap
Follow CIO New Zealand on Twitter:@cio_nz
Read more: Wanted: Trailblazers putting 'disruptive technologies to work'
Sign up for CIO newsletters for regular updates on CIO news, views and events.
Join the CIO New Zealand group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.