I agree that “the most concerning figure of all is that 13 percent of respondents said they were “unaware” as to whether their corporation suffered a data breach.” Noise makes detection very
difficult, as evidenced by the fewer than 14 percent of breaches detected by internal security tools, according to the latest Verizon Data Breach Investigations Report (DBIR). Monitoring is not catching the bad guys, and we cannot wait for better monitoring tools.

I also agree that “Executives continue to try the same tactics and strategies over and over again to secure their businesses, even when it is proven that those strategies aren’t enough.” Ponemon Institute published an interesting survey related to the recent spate of high-profile cyber attacks. According to the survey database security was recommended by 49% of respondents, but the study found that organizations continue to allocate the bulk of their budget (40%) to network security and only 19% to database security. Ponemon concluded that “This is often because organizations have traditionally spent money on network security and so it is earmarked in the budget and requires no further justification.”

I found good guidance in a recent report from Gartner. The report analyzed solutions for Data Protection and Data Access Governance and the title of the report is "Market Guide for Data-Centric Audit and Protection.” The report concluded that "Organizations that have not developed data-centric security policies to coordinate management processes and security controls across data silos need to act."

We need a layered security model with a data-centric core.

Ulf Mattsson, CTO Protegrity