(This blog post was written by Christina Torode, Editorial Director of SearchCIO Media Group)
I spent a whirlwind trip to the RSA conference this week in San Francisco hanging out in the Information Systems Security Association (ISSA) booth, catching up with the group’s members as they popped in. We talked about many things: cyber warfare, the need for collective security intelligence, how important being a member of a group such as ISSA is to a career, Edward Snowden, how much system access security vendors should give the government, how threats are becoming increasingly political in nature.
This post would be extraordinarily long if I went into all the discussions, but here are few snippets of the conversations where ISSA members and industry luminaries describe threats the security profession need to pay more attention to:
Marcus Ranum, CSO of Tenable and developer of the first commercial firewall
“The threats aren’t really new or emerging ones. We’re always up against mistakes we made 10 or 15 years ago. We’re really just now starting to cope with problems raised by distributed computing, which is kind of sad. We haven’t even gotten to transitive trust. Hackers are starting to understand transitive trust and we’re going to have a serious problem when that happens.”
Howard Schmidt, professor at Idaho State University, consultant with Ridge-Schmidt Cyber and former White House cyber advisor for Presidents George W. Bush and Barack Obama
“The mobile environment. When there were just a few BYO devices, there wasn’t a lot of connectivity so they weren’t really a threat to the environment. Now virtually everything has an IP address and is connected to a network to network through the home or work environment. We really haven’t thought that through. Some software is well vetted, but other software can be downloaded with malware, that piece of extra piece of extra software that can pull out your PII.
What people pay even less attention to is all the devices in the home. The TV is becoming an Internet device looking to control access to a lot of things. Hopefully we won’t go down the path [with home devices such as the TV] and make the same mistakes we have with other systems. We know that there are vulnerabilities, we need to get them fixed and go to the manufacturer and say ‘It’s great that you have this application, but it also exposes me.’”
Dave Cullinane, former eBay CISO and founder of SecurityStarfish
“The level of attack sophistication is getting incredibly scary. Ebay was a technology company so we had the resources and kind of money to be able to access shared information and intelligence on what’s going on across the industry and businesses. Small and mid-size companies don’t have those resources. Access to good intelligence [analytics] on what to look for and what to do about [a security threat] helps you invest the right way.
Another area that can help is software-defined perimeters. Coca-Cola and the Cloud Security Alliance are working with open standards, some technology that has been around for a while, that has the capability to eliminate the potential for huge groups of attacks.
Another helpful measure? If your customers pose a threat to your own security, teach them how to defend themselves and give them the tools to do it. Ebay gave its customers Microsoft Security Essentials, which allowed their customers to uncover a lot of hidden threats.”
Gene “Spaf” Spafford, professor of computer science at Purdue University
“I don’t think I’ve seen anything that I would consider a new attack. Many of the things occurring are attack technologies and behaviors that have been known about for decades, but practitioners in the field today don’t know about them. Certainly an awful lot of organizations that have been attacked have not bothered to make appropriate investments in security, so when these attacks occur everyone goes ‘wow that’s a surprise,’ but it isn’t really.
The recent series of attacks on POS terminals to collect credit card numbers, that’s not new. It’s malware, going after personal information and these organizations were ignoring the warnings.
What we are seeing that’s a little bit different is larger scale and a little more politically motivated element to attacks. The Syrian Electronic Army, for example. Those are disturbing because we don’t have a coordinated international response to the wide scale cybercrime and the politically motivated behavior.”
Christina Torode oversees coverage and special projects for SearchCIO.com, SearchCIO-Midmarket.com and SearchCompliance.com. She has been a high-tech journalist for more than a decade. Before joining TechTarget, she was a reporter for technology trade publication CRN, covering a variety of beats including security, networking, telcos and the channel. She also spent time as a business reporter and editor with Eagle Tribune Publishing in eastern Massachusetts.