HP Enterprise Security Exec: Training, Process Keys to Cyber Safety

A top Hewlett-Packard (HPQ) cyber security expert said businesses should invest in training staffers and perfecting internal processes rather than relying solely on new technology to guard against cyber criminal intrusions.

Art Gilliland, HP Enterprise Security Products senior vice president and general manager, told attendees at the vendor’s Software Government Summit in Washington, D.C., that many businesses allocate resources to the next security technology despite evidence that most cybersecurity invasions result from human error and unsound processes and procedures.

“This is hard for a product guy to say out loud to an audience, but invest in your people and process,” Gilliland said, as ComputerWorld reported. “The first thing that always gets negotiated out of every [security software] contract is the training and the services.”

Gilliland, a 15-year enterprise security veteran who joined HP in July, 2012 after a six-year stint at Symantec (SYMC), further advised companies to invest in threat detection security technologies to stop attackers before they gain entry rather than relying on traditional firewalls and anti-malware products.

The security strategy shouldn’t be to dismiss traditional defenses but also to invest in systems to technology to identify network intrusions before a break-in occurs and in encryption technology to safeguard confidential data, he said, as ComputerWorld recounted.

Along the lines of Gilliland’s remarks, in mid-February, HP bought Voltage Security, a 13-year old, Cupertino, CA-based developer of encryption and tokenization technology, in a move aimed at bolstering the company’s security portfolio. Terms of the deal, which is expected to close by June, 2015, were not disclosed by either party.

HP said Voltage’s products, designed to “close the gaps that exist in traditional encryption and tokenization approaches,” will be folded into its Atalla information security and encryption businesses. The vendor positioned the Voltage acquisition as aligning with its “focus on end-to-end protection of the data itself, helping enterprises neutralize the impact of a breach and proactively combat new security threats.”