A 2014 Lookback: Predictions vs. Reality

At the beginning of the year, I made a series of cyber security predictions for 2014. Some proved true, while others are happening a little more slowly than I anticipated. Let’s see how they stacked up against reality.

I predicted that in 2014 incident response would finally mature as a business process, and it seems that sentiment is well on its way to becoming reality. Security incidents threatened everyone this year. While these events were unfortunate, they prompted many organizations to adopt incident response plans. These high-profile, high-impact breaches and exploits will drive stronger incident response readiness in 2015, which is great news. But it will also cause attackers to innovate as we all continue to co-evolve in this security spiral.

As I anticipated, more online services implemented two-factor authentication in 2014, and more two-factor technology vendors have emerged, making implementation, administration, and maintenance much simpler. The website Two Factor Auth tracks the services across many industries that have implemented two-factor authentication. On that site, you will also find a list of organizations that employ two-factor authentication, which has more than doubled in 2014.

The trouble with 2FA: People
There is one problem with two-factor: community adoption. For this method of authentication to work, it must be used. I’ve seen many folks move to two-factor authentication after their accounts online were compromised several times, but more people need to adopt it before their accounts are jeopardized. Like incident response plans, wide adoption of two-factor will likely cause attackers to adapt their tactics and focus their attention on different parts of the authentication chain.

My false prediction was that more organizations would implement software-defined networking (SDN) and adaptive perimeters. While SDN technology further developed and matured this year, adoption of it did not. I still believe that this practice will eventually be embraced on a wide scale, but it seems I was a little too early with my predictions. However, the need for the adaptive perimeter is even greater in 2015 as the Internet of Things and a dynamic BYOD workforce drive the need. This one will become more obvious in the coming year.

Emerging threats: "Things" and mobile
In addition to the above, 2014 saw some smaller security challenges that could develop into future threats. As the Internet of Things expands into untapped and unexpected areas of our lives, the security stakes continue to rise. This year vulnerabilities were identified in automobiles, home appliances, and other unanticipated devices. If we are to avoid extensive exploitation, we must begin evaluating and preparing for the security risk imposed by these products.

3D printers continue to drop in price, and users continue to produce amazing and controversial output. This technology can save lives -- for example, enabling the printing of a perfectly fitted heart valve for an infant. On the other hand, technologists have demonstrated that they can print keys for high-security locks and inexpensive safe-cracking devices, adding a new dimension of vulnerability.

The prevalence of mobile apps that can access your personal location continue to be popular. How many times in 2014 were you asked if an application could use your location information? More than in 2013, I’ll bet, and this trend will only rise, because where you are matters to a lot of people -- both good and bad.

Surprise attacks: Heartbleed, Bash, and Shellshock
While it should be no surprise that attackers will focus their efforts on infrastructural components because the payoff is so great, no one believes it until made a reality by an active exploit. When news of the Heartbleed vulnerability broke, my opinion was that we should begin to look at other fundamental technology components and the risks they pose if exploited. This attack was a classic low-likelihood, but high-impact, black swan event.

The Bash shell was the next big attack vector on the list with the Shellshock bug, and we will be feeling the impact of this for years since Linux is the primary OS in so many embedded systems that remain unpatched.

We need to change the way we assess risks in fundamental software components with better threat modeling. While there will always be surprises, we need to be in a state of readiness that diminishes the payoff to the attacker and ensures the utmost levels of business continuity. These kinds of threats will happen again. We must be ready for them.

The past year had its ups and downs, but it drove the adoption of incident response plans and two-factor authentication. As the industry begins to implement these and other new security tactics, attackers will innovate as well. There are some important lessons from 2014. Take note, and we will all be better prepared next time.