Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


10:30 AM
TK Keanini
TK Keanini
Connect Directly
E-Mail vvv

A 2014 Lookback: Predictions vs. Reality

It was a tumultuous year for cyber security, but it drove the adoption of incident response plans and two-factor authentication.

At the beginning of the year, I made a series of cyber security predictions for 2014. Some proved true, while others are happening a little more slowly than I anticipated. Let’s see how they stacked up against reality.

I predicted that in 2014 incident response would finally mature as a business process, and it seems that sentiment is well on its way to becoming reality. Security incidents threatened everyone this year. While these events were unfortunate, they prompted many organizations to adopt incident response plans. These high-profile, high-impact breaches and exploits will drive stronger incident response readiness in 2015, which is great news. But it will also cause attackers to innovate as we all continue to co-evolve in this security spiral.

As I anticipated, more online services implemented two-factor authentication in 2014, and more two-factor technology vendors have emerged, making implementation, administration, and maintenance much simpler. The website Two Factor Auth tracks the services across many industries that have implemented two-factor authentication. On that site, you will also find a list of organizations that employ two-factor authentication, which has more than doubled in 2014.

The trouble with 2FA: People
There is one problem with two-factor: community adoption. For this method of authentication to work, it must be used. I’ve seen many folks move to two-factor authentication after their accounts online were compromised several times, but more people need to adopt it before their accounts are jeopardized. Like incident response plans, wide adoption of two-factor will likely cause attackers to adapt their tactics and focus their attention on different parts of the authentication chain.

My false prediction was that more organizations would implement software-defined networking (SDN) and adaptive perimeters. While SDN technology further developed and matured this year, adoption of it did not. I still believe that this practice will eventually be embraced on a wide scale, but it seems I was a little too early with my predictions. However, the need for the adaptive perimeter is even greater in 2015 as the Internet of Things and a dynamic BYOD workforce drive the need. This one will become more obvious in the coming year.

Emerging threats: "Things" and mobile
In addition to the above, 2014 saw some smaller security challenges that could develop into future threats. As the Internet of Things expands into untapped and unexpected areas of our lives, the security stakes continue to rise. This year vulnerabilities were identified in automobiles, home appliances, and other unanticipated devices. If we are to avoid extensive exploitation, we must begin evaluating and preparing for the security risk imposed by these products.

3D printers continue to drop in price, and users continue to produce amazing and controversial output. This technology can save lives -- for example, enabling the printing of a perfectly fitted heart valve for an infant. On the other hand, technologists have demonstrated that they can print keys for high-security locks and inexpensive safe-cracking devices, adding a new dimension of vulnerability.

The prevalence of mobile apps that can access your personal location continue to be popular. How many times in 2014 were you asked if an application could use your location information? More than in 2013, I’ll bet, and this trend will only rise, because where you are matters to a lot of people -- both good and bad.

Surprise attacks: Heartbleed, Bash, and Shellshock
While it should be no surprise that attackers will focus their efforts on infrastructural components because the payoff is so great, no one believes it until made a reality by an active exploit. When news of the Heartbleed vulnerability broke, my opinion was that we should begin to look at other fundamental technology components and the risks they pose if exploited. This attack was a classic low-likelihood, but high-impact, black swan event.

The Bash shell was the next big attack vector on the list with the Shellshock bug, and we will be feeling the impact of this for years since Linux is the primary OS in so many embedded systems that remain unpatched.

We need to change the way we assess risks in fundamental software components with better threat modeling. While there will always be surprises, we need to be in a state of readiness that diminishes the payoff to the attacker and ensures the utmost levels of business continuity. These kinds of threats will happen again. We must be ready for them.

The past year had its ups and downs, but it drove the adoption of incident response plans and two-factor authentication. As the industry begins to implement these and other new security tactics, attackers will innovate as well. There are some important lessons from 2014. Take note, and we will all be better prepared next time.

TK Keanini brings nearly 25 years of network and security experience to the CTO role. He is responsible for leading Lancope's evolution toward integrating security solutions with private and public cloud-based computing platforms. TK is also responsible for developing the ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
User Rank: Ninja
12/29/2014 | 1:37:43 PM
2015 Predictions
Have you compiled predictions for the year 2015? If so, do you plan on creating another article to denote them?

I would be interested to see how your predictions align with the roadmapped enterprise initiatives.
User Rank: Apprentice
12/31/2014 | 2:40:56 AM
Re: 2015 Predictions
The two-factor authentication, though not a silver bullet, could be reliable when it comes with a reliable password. 2 is larger than 1 on paper, but two weak boys in the real world may well be far weaker than a toughened guy.  Physical tokens and phones are easily lost, stolen and abused. Then the password would be the last resort.  It should be strongly emphasized that a truly reliable 2-factor solution needed for important accounts requires the use of the most reliable password.  

Using a strong password does help a lot even against the attack of cracking the leaked/stolen hashed passwords back to the original passwords.  The problem is that few of us can firmly remember many such strong passwords.  It is like we cannot run as fast and far as horses however strongly urged we may be.  We are not built like horses.

 At the root of the password headache is the cognitive phenomena called "interference of memory", by which we cannot firmly remember more than 5 text passwords on average.  What worries us is not the password, but the textual password.  The textual memory is only a small part of what we remember.  We could think of making use of the larger part of our memory that is less subject to interference of memory.  More attention could be paid to the efforts of expanding the password system to include images, particularly KNOWN images, as well as conventional texts.

 By the way, some people shout that the password is dead or should be killed dead.  The password could be killed only when there is an alternative to the password.  Something belonging to the password(PIN, passphrase, etc)and something dependent on the password (ID federations, 2/multi-factor, etc) cannot be the alternative to the password.  Neither can be something that has to be used together with the password (biometrics, auto-login, etc). What could be killed is the text password, not the password.  

User Rank: Ninja
12/31/2014 | 11:34:21 AM
Re: 2015 Predictions
Very interesting post. I agree with many of the statements you made.

People have difficulty remembering intricate strings, hence principles behind DNS. But I think with items such as tokens and devices, Security professionals have the right to hold people accountable to not lose the token. In an environment that requires this type of authentication being responsible is not a lofty request. That being said I understand mistakes happen.

Biometric is ideal but a very expensive means of authentication. This may not be feasible for implementation. What is your advice for a happy medium?
User Rank: Apprentice
1/1/2015 | 7:49:44 PM
Re: 2015 Predictions
I am supporting the thought and theory of Expanded Password System advocated by Hitoshi Kokumai whose writings are posted on LinkedIn at


Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
1/6/2015 | 9:21:44 AM
Re: 2015 Predictions
Adding the live link to the Hitoshi Kokumai page on LI. Some interesting content there. Thanks for sharing @HAnatomi!

COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/1/2020
Stay-at-Home Orders Coincide With Massive DNS Surge
Robert Lemos, Contributing Writer,  5/27/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-06-02
Multiple products that implement the IP Encapsulation within IP standard (RFC 2003, STD 1) decapsulate and route IP-in-IP traffic without any validation, which could allow an unauthenticated remote attacker to route arbitrary traffic via an exposed network interface and lead to spoofing, access cont...
PUBLISHED: 2020-06-01
Python-RSA 4.0 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing exces...
PUBLISHED: 2020-06-01
modules/security/classes/general.post_filter.php/post_filter.php in the Web Application Firewall in Bitrix24 through 20.0.950 allows XSS by placing %00 before the payload.
PUBLISHED: 2020-06-01
An Insecure Temporary File vulnerability in FortiClient for Windows 6.2.1 and below may allow a local user to gain elevated privileges via exhausting the pool of temporary file names combined with a symbolic link attack.
PUBLISHED: 2020-06-01
An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorized administrators to overwrite system files via specially crafted tcpdump commands in the CLI.