Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

The Future of IT security

“What a nice, easy topic,” I thought to myself as I read through the email from those good people at Computing. “The Future of IT security” – how simple it would be to write something focused, straight and to the point, given that remit.

Nothing could be further from the truth, of course. There’s a quite straightforward way to write such a piece, along the lines of, “There will be threats, and they will be big threats. Organisations need to get their act together, understand the risks and implement mitigating strategies if they want to keep ahead of the bad guys.” Trouble is, such articles preach to the converted. There are three categories of organization: those who get security and who have ongoing risk management activities in place; those who get it but struggle to prioritise and implement appropriate measures; and those who think that if they keep their heads down, the bad stuff will pass them by.

For most, the future of IT security will be much like the present. We know for example that the bad guys are now following the money rather than the kudos: sure, there will always be people out there who prefer to call themselves ‘Cobra’ or ‘Hummerkazi’ who spend their waking hours decoding encryprion algorithms and looking for back doors into telephone networks. Meanwhile, there is an evolving economy building around the market value of credit card details and the ability to launch denial of service bots from unsuspecting (and generally poorly configured) home computers. While this needs to be taken seriously, to be honest it doesn’t look awfully different to last year, and neither will it change much in the next.

Meanwhile, we have the risks caused by our own employees, be they trough malice or stupidity. Strangely enough, internal staff have always posed the biggest threat to computer systems, even before product categories such as “data leakage prevention” were posited (ain’t it funny how the pundits only get round to recognizing a problem on the back of IT companies happening to have developed a solution, but that’s not important right now). I would suggest that, unless we all become RFID-tagged and have probes inserted into our brains to read our darkest thoughts, we shall continue to find it difficult to counter what some term “the insider threat.” And, thankfully, my vision of the future of IT security does not include any such mechanisms.

So, what does it include? As a starting point to think about the future of IT security, its worth reflecting on the future of IT as a whole. There are a number of trends that are driving how organizations are developing, deploying and operating their IT systems that will have a direct impact on security, including:

  • Outsourcingand offshoring. The offshore resourcing market continues to mature, with Indian companies such as Wipro setting up in the UK and traditionally local companies continuing to expand their offshore operations. Risks range from difficulties in vetting offshore staff, and challenges of maintaining business information at offshore locations.

  • Hosting and Software as a Service (SaaS). We are not seeing wholesale mass adoption of the SaaS model, with reason as it is still maturing for example in areas such as data integration with other corporate systems. Risks are similar to those of outsourcing, which from the data’s perspective is what it is.

  • Service Oriented Architectures and Web 2.0. Both of these topic areas share the risks of being distributed systems architectures which may extend beyond the corporate firewall. As well s being open to confidentiality breach and denial of service, there are also questions around the publishing of interfaces onto corporate systems. In some instances, the interface itself may be company confidential.

  • Virtualisation and data centre automation. Virtualisation offers a quick win for many organizations, which can consolidate applications down onto a reduced set of physical servers (numbers up to80% reductions are touted; we have seen 60% reductions in physical servers). While the centralized management of preconfigured virtual servers can reduce security risks, equally there is the risk of virtual server proliferation, and indeed the potential for mismanagement which could leave virtual servers more open to breach.

  • Mobility and unified communications (UC). While UC may currently be an oxymoron, vendors are working hard to deliver on the idea of enabling us to communicate with each other a simply and seamlessly as possible. Like with any technology, UC is a two-edged sword and it is not hard to think up scenarios for its exploitation, for example UC-spam calls.

  • Social networking. We are already seeing some of the security challenges that social networking can pose, in terms of privacy and identity issues for example. There are other risks nobody has yet (to our knowledge) pulled together composite identities of individuals across social networking sites, but this will no doubt come. While these are personal security issues on the surface, they have corporate implications for example in terms of duty of care.

What this list demonstrates is that “continued vigilance” is only part of the answer. So too is risk management: a good process for which, starting with business objectives and considering IT security in that context, should be a fundamental part of any organisation’s security strategy. But neither is ris=k management going to be enough, by itself. If there’s one thing that all of the above trends share, it is that they affect all parts of the IT architecture. These are not risks that can be mitigated by tactically acquiring some appliance, and plonking it into the server room.

So, what to do? If IT security is to be characterized by having a far-reaching impact, so we need to consider how the roles responsible for IT Security have a similarly far-reaching remit. We are already seeing this in some organisations: HSBC for example, has combined its IT security function with its business fraud function, enabling it to deal with both the business and IT issues from the same point.

Where does this leave the IT security industry? I have often characterized this as a fire extinguisher industry, which makes sense, if all people are doing is fighting fires. Challenges such as those above will require us to move to more of a prevention-based approach rather than a series of poorly funded coping strategies. And frankly, given that the trends are happening whether organizations want the to or not, the sooner we can get there the better.