2. Keep the good things in
Traditional security postures are focused towards protecting organization information and "keeping the bad out". However internal information leakage (intentional or accidental) is considered very important to "keep the good things in".

3. Enterprise risk management approach
IT risk is traditionally considered in isolation due to its technical complexity and constant change. However it needs to link up with the business enterprise risk management postures as business is what would drive all initiatives and investments specially in the current economic scenario.                                                                                   | Top |

4. Protection at the source
Security investments at the infrastructure level have been focused on already (e.g. firewalls, AV systems etc.). With most vulnerability in the applications the focus would now moved to secure applications or better build secure applications. This would be significantly more important when new age applications such as Mobile Banking, 3G applications etc. come up.

5. Focus on "Management" aspects of security
Most organizations are challenged with the operational aspects of security. It's easier to focus on security during high alert/risk times. How can the same level of diligence be achieved during business as usual times also?

6. Synergy of controls: physical and logical security
Physical security postures would integrate with IT or logical security controls. As a combined physical and logical security posture would help organization achieve higher and more relevant security levels.

7. Conscious security posture
Several organizations have invested in security postures and know that they are secure to an extent. This "extent" is most times now known which can be called as a "non-conscious" security posture. Which we know we are secure, not sure against what all and for how much time. Organizations would want to move towards a more aware and conscious state of security.

8. Result oriented automation
Automation of security controls has been done for years and is very important to achieve scalability and reliability of controls. As new security technologies immerge organizations would look as meaningful ways of deploying them. It's not about what the technology or tools offer, but what I want from them. This would be further driven by the need to derive more from current investments, the new economic mantra.

9. Build up toward ROSI models
ROSI (Return on Security Investment) is a concept which is yet to mature. It's not something which can be developed and used effectively for some time. However organizations would move towards trying to develop ROSI models. The big difficulty in ROSI is security investments are not done so that you get something; they are done so that we don't get something's (e.g. exposures, exploits etc.)

10. Build security into business
Today, security is always external to business, which is we do business activities in a way and then deploy security controls to protect what we do. In an ideal world we should do business activities in a secure way itself. This is building security into the business with the business owners owning the security of whatever they do. This again is not easy, but organizations would need to move towards it, with a small step being educating business owners on their responsibility towards security.                                                     | Top |

Source:http://www.ciol.com/Technology/Security/Feature/Outlook-2009-Top-10-trends-in-security/91208113520/0/