How is it 2020 already? We’re in the last month of the decade, and the year that has long held a “futurist bookmark” in people’s minds is now upon us.
We may not have hoverboards and flying cars yet, but our adoption, connectedness, and reliance on technology is accelerating faster than it ever has before. Here is how I think the cybersecurity landscape will evolve in response to this in 2020.
Elections: Cybersecurity is a Citizen Problem
New media and western democratic processes will collide on the cybersecurity battleground. The combination of a higher percentage of digitally-native, first-time voters; an increased reliance on connected systems for registration, tallying, and voting itself; and the wide knowledge and sharing of Russia’s disinformation playbook from 2016 indicates to me that we’re in for a wild ride through the 2020 elections — not just in the U.S., and not just with Russia as a potential aggressor.
Much of the voter narrative on elections focuses on the cybersecurity elements. In 2020, this will drive a rapid increase in the consumer demand for vendors and governments of all types to demonstrate accountability for the measures they’re taking to keep the data and processes of their customers confidential, integrated, and available.
The good news is, we’re already seeing a move in the right direction with the call for vulnerability disclosure programs across agencies, which would allow whitehat hackers to help surface flaws in election websites and applications in lead up to and through the elections.
Containers: Make Bad Security Decisions Faster, and with More Energy!
I started life in penetration testing (breaking into computers to help organizations understand how they could be made safer) around the year 2000. Back at that time, hacking the internet was a little bit like shooting fish in a barrel. After the Summer of Worms in 2003 and Microsoft’s legendary Trustworthy Computing Memo, a lot of things started to improve rapidly when it came to securing the perimeter — keeping the important stuff in, and the bad guys out.
Then came the cloud and, more specifically, the ability and expectation for a new generation of developers to deploy infrastructure and data as code in a DevOps model, despite not having an understanding of how things like the OSI Model work. We’ve seen this risk manifest in the past couple years with the rash of breaches tied to data storage misconfiguration and poorly stored secrets. In 2020, container misconfiguration, network hygiene, and breakouts on containers themselves will be heavily targeted.
Know your entire attack surface, prioritize assets, and get ahead of potential back doors to your organization. Unknown assets have long been the cause of headline-drawing security incidents.
RISK! PRIORITY! Do The Next Thing Well!
In one of the most memorable talks I’ve been too, the speaker pointed out that the etymology of the word “priority” is literally “first thing.” The word wasn’t pluralized until the 1950s. Aside from that being quite profound to ponder on its own merit, it’s also where cybersecurity defenders are arriving in how to tackle, and continue to tackle, this complex and growing set of problems.
2019 was the first year that I consistently heard risk-based prioritization as a business imperative, as opposed to “the new thing the cool kids are talking about.” Security practitioners are drowning in data and things to consider and action. Prioritization across the entire security domain is now being seen as a necessity for completion of the mission, and not just a neat new thing to try. And the Crowd is up for the challenge.
Global organizations are already turning to security researchers to pressure test their known assets, and yet it’s the unknown and unprioritized that is oftentimes the trigger for a security incident. Identifying and understanding the unknown is something many security researchers already do as part of their default methodology. By discovering the less-tested and more vulnerable assets, organization can receive context to feed into their risk assessments to help truly prioritize.
One thing is certain: As we enter a new decade, technology will continue to advance and bad actors will continue to innovate in response. In the 2020s as a decade, the nature of the cat-and-mouse game that exists will escalate and continue to elevate itself on the radar of the average internet citizen.
Stay safe out there!
