The fast migration to cloud-based technologies is the largest disrupter globally of operations and a key driver when organisations plan their spending increases, in accordance to the consequences of the latest SANS 2020 Cybersecurity Spending Survey.

The SANS survey showed that rapid motion of corporate services and business applications to cloud-based technology is the huge factor inflicting breakage in current security architectures as well as driving most new security spending, says John Pescatore, SANS Director of Emerging Security Trends. Cloud monitoring and cloud security access controls were the top two spending areas, followed by spending to increase security staff capabilities to deal with new technologies, such as the cloud, and to keep up with modifications in regulations as well as new threats.

Slightly more than 50% of respondents ranked the increased use of public cloud infrastructure-as-a-service (IaaS) implementations as the biggest disrupter to security programs in the next 12 months. Based on that, 71% of respondents reported seeing a need to increase spending on cloud security monitoring, followed by cloud access security broker cloud-specific equipment (53%), staff skills training (52%) and robust authentication (46%).

Overall, 57% of respondents feel that out of people, process and technology, an improved investment in people would provide the huge improvement to their overall security posture, observed distantly by process (19%) and technology (18%).

Managers see increased and refreshed competencies in their present staff as being considerably more critical than absolutely growing headcount, in accordance to Barbara Filkins, SANS Analyst Program Research Director and author of the report. The fact that respondents prioritise growing staff abilities considerably over growing headcount to deal with disruptive technologies, particularly when confronted with escalating privacy regulationsand finesworldwide, is not surprising. Business use of IaaS and hybrid cloud requires re-architecting security controls and integrating with CI/CD methodologies.

In a series of follow-up interviews with selected survey respondents, security managers realize the need for upskilling to increase retention rates, which improves both effectiveness and efficiency. Increased abilities around new technologies and new security methods is also required to enable any use of security automation technologies, which were not quite mentioned for spending will increase in 2020.

Strong authentication, the fourth most highly noted area of planned new spending, factors to the recognition that the majority of damage from breaches and ransomware attacks in the previous year have been enabled via the use of reusable passwords that were easily captured by phishing attacks. CEOs and boards of directors are backing security groups in overcoming barriers to enforcing multifactor authentication.

The survey and related report have been sponsored by ExtraHop, Gigamon, and Netskope, with more than 450 survey respondents. Developed by SANS Research Director, Barbara Filkins, with advice from John Pescatore, SANS Director of Emerging Security Trends, the report can be downloaded from the SANS website.