We predict predictions

December approaches and as could be predicted, the coming of the New Year brings the annual emergence of New Year Predictions.

One of the first out of the blocks this time round is Tim Keanini, CTO at security intelligence specialists,  Lancope, who has set his eye on some promising, as well as some concerning, innovations that will shape the way networks are secured in the coming year.  

His first prediction is that Incident Response will finally mature to become a business process. Responding to an information security incident is not just an IT thing anymore, it is a business thing. 2014 is the year businesses will finally realise that leveraging the Internet for business growth also means that responding to incidents is par for the course.

He is certain that in 2014, some companies will step up and show everyone else in the world how to excel at incident response. Successful businesses are the most attractive to the adversaries, so it is fitting that these companies will have no choice but to step up and lead. They will show us how business continuity is job one, and they will no doubt execute their incident response processes as well as a world-class sports team on game day – interfacing with legal, PR, marketing and external crime fighters to get the job done.

Second up is Software-Defined Networking (SDN) and the adaptive perimeter. In Keanini’s view, when security experts say that the network perimeter is dead, and that the boundaries that firewalls have established between ‘inside’ and ‘outside’ are disappearing, what they really mean is that static and physically established boundaries are dead. The reason is they cannot adapt quickly to changing threat and business requirements. This all changes with Software-Defined Networking (SDN).

In 2014, we will see an adaptive perimeter or intelligence-based enclaves that are dynamic and both serving to the business needs as well as being defensive against advanced threats. This, he suggests, is like the human body’s reaction to cell replication that goes awry. When errors occur at this cellular level, this is cancer and the difference between it being life threatening or not depends on the body’s ability to encapsulate this error and stop its replication – the successful result is a benign tumour that in most cases can be removed. 

This form of containment is completely attainable with SDN as long as some intelligent system is monitoring for and detecting anomalies. Self-forming enclaves are also proactive in that they can dynamically partition the network in such a way that no one threat can have a life-threatening effect on the business.

He predicts an increase in two-factor authentication of users to overcome the common use of weak passwords. He sees 2014 bringing more vendors online implementing two-factor authentication and offering it as an option, and more of the user base starting to use it. Sadly, however is still usually takes a person going through the pain of a security incident before they start to practice better security.

He sees 20214 meaning that the `Internet of Everything’ will also see a move towards the `Security of Everything’ especially when devices that have traditionally been out of the reach of bad guys are now in reach. In practice, 2014 will only see the start of this, with what he calls the `Internet of Somethings’ which will need to be resilient to the threats present online. The question that has to be asked about every `something’ now is: If it were compromised, how would it behave differently?

Printing in 3D opens up many new opportunities, not all of them good. Keanini suggests that, with 3D printing dropping in price, 2014 could see clever criminals will begin to copy physical objects that, by themselves, can provide authentication or access. Some examples he suggests include concert badges (maybe even backstage passes) and physical keys for simple locks. This will be a real threat any time a physical object alone is enough proof to gain access.

He also predicts growth in tracking devices, and not just for things, but for people too. A few startups this year offer tiny little devices that, when attached or embedded in objects, can be tracked from your smartphone via a complicated mesh of peer-to-peer networks. The intended use cases are to find personal belongings, but he suggests that the bad guys are already thinking up other nasty ways to exploit this very personal device.

Overall, Keanini sees 2014 being the year when those in charge of security strategy realise that there are virtually no limits to today’s technology innovations. And unfortunately, that also means that there are no limits to the potential opportunities for today’s online attackers.

On the other side of that coin, however, is the fact that this same innovation is also feeding the security solutions available today. It is time to look beyond your firewalls, antivirus and other conventional tools, he suggests, and embrace new, more progressive means of securing networks in 2014 and beyond.