The Future of Cyberspace Security: The Law of The Rodeo

– Power generation from motion is almost ready for prime time.  This will allow devices to gain energy from vibrations, like the vibrations in a bridge when a car passes over it, or the vibrations in a wall of a
building when the wind blows past it, or the vibrations caused by a person’s movement through the day.

– Communication capability (bandwidth) between fixed facilities will increase 1000 fold over the next five years. Cellular systems are on a dramatic improvement slope.  My view: AT&T seems to lead in speed this year.  Verizon will probably lead next year.

– More users will be on the net.  There are about 1.3Billion PC’s connected to the Internet today.  There are about 3.3Billion active cell phone subscriber accounts today.  Those numbers will grow.

– Storage, especially flash storage technologies, is decreasing in price so much we can afford to store data anywhere on almost anything.

– Chips are being designed in ways that actually beat the old Moore’s Law projections.  This is being done by placing many cores on one chip.  Very high data rate capabilities are being connected directly to the cores on these chips.

– RFID is becoming so widespread we can place devices on everything that allows devices to report back what they are and what they are for and where they have been.

– All this capabilities are being networked together, including increasingly direct device to device connections via capabilities provided by enhanced protocols (especially IPv6).

– Consumer devices, especially consumer communication devices, are becoming increasingly capable.  What used to be called a cell phone is now a phone/video recorder/video editor/entertainment/mobile office device with location aware data (GPS).

– Web2.0 and Social networking sites/tools such as Facebook will expand till one day 100% of the population will have active, up to date, authoratative online profiles.

– Cloud computing capabilities are not only being delivered to companies, but to end users.  Google leads the pack in this space, but Microsoft and Adobe are up and comers.

There are many other elements of the future relevant to security discussions, but the projections above lead to some interesting conclusions on their own.   So lets think through some of the impacts
of the above.

– Bad actors who want to exploit systems will increasingly not have to worry about them being powered off.  They will be on all the time.

– Bad actors will increasinly be able to expoit social systems to gather data pre-attack.  However, the powerful trust models of social networks may offer a counter to some of these attacks.

– Many paths into devices will be available for unauthorized users to exploit.   And if they are compromised by people or code that intend on generating denial of service attacks, huge amounts of bandwidth will exist for them to attack from.

– When a bad actor gets through defenses into data stores, they will likely find a wide range of data to exploit, since it is becoming so easy and low cost for us to store everything.

– Having things networked together means it can be easier to penetrate a target by finding one weak link that is connected to the infrastructure.

– Areas of people’s lives they once thought private, especially their cell phones and the data on their cell phones, are increasingly becoming attractive targets to hackers.

What is needed in an environment like this?  I can’t pretend to know all the solutions but here are a few points I support:

– Enhanced firewalls and intrusion detection devices.

– Better configuration control, for all devices.  When a device is out of configuration is must be brought back into compliance immediately.

– Better laws and treaties concerning cyberspace. Deterrence policies by governments.

– More attention to standards and to industry organizations (including supply chain quality  organizations) is a must.

– Better training and education for all (I mean ALL) humans connected to the grid.

– Better, continuous upgraded anti-virus solutions.

– Automated response to attacks.

– Enhanced, easier to use encryption.

– Enhanced, more secure identity and authorization technologies.