Q&A: George Kurtz, CTO, McAfee

We met with the chief technology officer (CTO) of McAfee, the largest dedicated security vendor, to discuss the growing information security threats facing business, and how IT professionals can respond.

If you think about the consumerisation of IT, IT departments can no longer say no. If you have an iPad, an iPhone, or an Android [device] and want to bring it in, you will do it. What we've found is the IT departments that say no, people will still bring the devices in and people will start forwarding their work mail to their personal accounts, and read it there.

We have to embrace consumerisation as these devices are more powerful than some enterprise devices. So the question is how do you secure them and how do you enable them? We are focusing on being able to manage and provide security policies on all these devices, whether it's an iPhone, a slate or Windows Mobile. We bought Trust Digital to help organisations to manage these devices.

All IT budgets are under pressure. How do chief information security officers defend their corner, and ensure that if they do make cuts, it doesn't create new vulnerabilities?

One of the most important things is having meaningful metrics. That is lacking in the security world. There is really no way to see how company A compares to company B, in security terms, and in terms of how much money they are spending.

Advertisement - Article continues below

What we see is fairly useless metrics how many hits on our IDS how many viruses. From a CSO's perspective they need to be able to put real metrics into to business terms. Putting it into business terms allows you to articulate the value. This is the security paradox: the more nothing happens, the more secure you are.

You need metrics that can show how you reduced risk and support the business. They can't put it in terms that a business person doesn't understand: viruses, registry entries and all kinds of gobbledygook.

A business person cares about time, money, and not going to jail because of a regulatory requirement.

If chief security officers can put it in those terms they have a much better chance of being able to pursue their agenda, and reduce risk from a business perspective.

Featured Resources

The IT Pro guide to Windows 10 migration

Everything you need to know for a successful transition

Download now

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Software-defined storage for dummies

Control storage costs, eliminate storage bottlenecks and solve storage management challenges

Download now

6 best practices for escaping ransomware

A complete guide to tackling ransomware attacks

Download now

Most Popular

Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019

Five signs that it’s time to retire IT kit

29 Nov 2019
Business strategy

Huawei takes the US trade sanctions into its own hands

3 Dec 2019
Mobile Phones

Pablo Escobar's brother launches budget foldable phone

4 Dec 2019