Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


11:00 AM
Jeff Schilling
Jeff Schilling
Connect Directly
E-Mail vvv

In The Cyber Realm, Lets Be Knights Not Blacksmiths

Why the Internet of Things is our chance to finally get information security right.

It happens every year. I attend the major security conferences and watch them devolve into rhetoric-filled conduits void of productivity and education. In fact, many decisions-makers no longer attend. And if they do, they don’t appear at many sessions and avoid venturing into the noise of the vendor exhibit floor.  

It’s the same monotonous commotion. Vendors and experts flooding the floor and claiming, “We are the only one doing this.” It’s been quite a while since I’ve seen new technology that makes me think, “Wow, that’s unique.” Each year, everyone has their spin on four components of the same mantra:

  • Artificial Intelligence/Machine-Learning 
  • Big Data Analytics
  • Anomaly Detection 
  • Finding the “Right Needle in the Stack of Needles”  

It continues to be the wrong mindset for security professionals. It’s a warehouse of weaponry without anyone skilled in using it properly or safely. To me, it’s akin to a blacksmith dropping off a cart full of swords and shields at a village and saying, "Stack these weapons on the road to your town. Don’t worry, it will protect you from evildoers."  

What is forgotten in the conversation is that it takes skilled professionals — or knights in this rudimentary analogy — to wield tools to protect themselves or organizations from malicious threat actors.

Everyone’s Doing It, And Doing it Wrong
Security vendors continually deploy a basic set of tools: a security information and event management (SIEM) tool; virtual machine inspection; “Layer 7” inspection; and finish with a variety of inline deep-packet inspection. I see limited innovation with vendors that have successfully integrated these capabilities in a unified threat management (UTM) platform.

The effectiveness of this approach will lean heavily on vendors’ ability in integrating and simplifying threat detection functions within UTMs. However, these UTM platforms are usually not strong in all functional capabilities.

An emerging trend that appears to be the new direction in security tools is application security capabilities, which proclaim to sit between the app server and the database. Are we simply building more swords and shields, but not making any real progress against true threats? Today’s security tools are overly complex and, in most cases, ineffective if not employed by highly trained security teams. In many scenarios, you may have to accept that while you have a great sword, it may be two feet shorter than your enemy’s simple but effective spear.

Embrace IOT Security Before It’s Too Late
So, what’s the core problem? As I see it, most security teams lack a true strategy. They continue to pile swords, spears and shields on the road to the village and hope threat actors will somehow be deterred or trip and fall on a sword. Unlikely.

In my opinion, 99 percent of the problem faced by professionals struggling to secure their networks boils down to one simple fact: their architecture cannot be defended. The traditional network-centric model — a framework that has evolved since the evolution of TCP/IP in the late ‘80s — has too much surface area to protect. We will never get the initiative back from the threat actors. I just stated a fact of the obvious. But is there a solution?

There is:  Embrace the Internet of Things (IOT) as a new security architecture. I may be in the minority. I still very much feel like the lone professional on every security panel I sit on who believes the IOT is our chance to get security right.

Four Key Steps for IOT
Essentially, we seek to transform our fundamental architecture from a network-centric model (where you pull data and applications into many endpoints) to a data-centric model (where applications and data don’t move). The ubiquitous user moves around on many different platforms, but for the most part they connect to the application and data, view it or interact with it, then drop the connection. Nothing of value to exploit is left on the end-user device.

In this framework, I recommend four key focus areas for security and technology vendors, some of which are already in flight.

  1. Develop a foolproof, role-based identity management system that is easy to scale and manage access to applications and data
  2. Provide an application/database encryption solution that denies an authorized user, who does not present the right token, from getting unencrypted data access  
  3. Build a sandbox environment in the application for interaction on the user host that is protected from any malware that exists on user devices
  4. Design infallible handshake and en route encryption capabilities so attacks like man-in-the-middle are not possible

If we’re able to move away from legacy network-centric thinking toward new IoT frameworks, we’ll have a great opportunity to improve security. This will help us clearly identify users; protect both data at rest and in transit; eliminate the ability of users to move data to their devices; and stop defending the endpoint.

I am ready for the Internet of Things to usher us into a new security era. The strategy of bolting on security technology to an un-defendable network-centric architecture is obsolete. It’s time.

Jeff Schilling, a retired U.S. Army colonel, is Armor's chief security officer. He is responsible for the cyber and physical security programs for the corporate environment and customer-focused capabilities. His areas of responsibilities include security operation, governance ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Author
7/6/2015 | 5:50:22 PM
Re: Kights with weak swords

Thank you for your response to the article.  Great points all around.  Flawed Software is the crux of the issue.  I tell people everyday that threat actors are not doing much different from when I ran the DOD Security Ops centers from 2007-2012.  Their operational processes have gotten much more organized and their ability to leverage Zero day exploits much quicker.  

I am hopeful we will get it right when we move to IOT, which really a cloud-based, data centric model vice a network centric model we live in for the most part today.

Blog Voyage
Blog Voyage,
User Rank: Strategist
7/3/2015 | 9:06:21 AM
Re: Kights with weak swords
Very nice analysis.
User Rank: Apprentice
7/2/2015 | 3:47:33 PM
Kights with weak swords
I suggest that the issue is more than not being knights (a good and important point).  Rather the idea of having swords 2-feet shorter starts to highlight the pragmatic reality.  Attackers have a large attack surface to attack, a surface that to the defender is much like an iceberg - the part we see (known vulnerabilities) is only a small part of the overall.  And we face adversaries conducting 'undersea' operations.  Moreover, the 4 IOT actions could be quite effective if (BIG IF) they are implemented such that they are correct, always invoked when needed, not bypassed, and not tampered with.  Yet if we could do that for these IOT actions, we could do it for non-IOT means as well.  And the reasons we are not would apply to the IOT actions as well.

A first principle is that a problem due to flawed software cannot be corrected by adding more flawed software.  The trustworthiness of SW is NOT determined by what it does, but by how it came to be.  And the software for the 4-IOT actions will be implemented with SW of the same low assurance as the SW it is trying to protect; unless doing differently is an explicit part of the actions to be performed.

My suggestion is - sure, absolutely pursue ideas such as your 4-IOT actions.  Yet more importantly and as mandatory for mission/business success FIRST:

a. See the reality of large low assurance IT for what it is - highly susceptible to attack and a situation that cannot, on first principles, be meaningfully changed by the addition of more low-assurance SW;

b. Use the IT we have according to what it is, not what we wish it was, making 'wise use' decisions as to what and how much to automate and having alternative mission/business processes for contingency operations;

c. Measure our cybersecurity capability against the adversary, not against our previous capability (to avoid measuring degrees of ineffectiveness and start measuring how effective we really are); and

d. Make changes to the above as the reality of the IT we use changes in a meaningful manner.

Gary Stoneburner, Senior Professional Staff, Johns Hopkins University/Applied Physics Laboratory and major contributor to NIST information security guidance (Expressing personnal judgement and not an position of my employer)
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-10
Valve Steam through 2021-04-10, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because of a buffer overflow that occurs for a Steam invite after one click.
PUBLISHED: 2021-04-10
A command execution vulnerability in SonicWall GMS 9.3 allows a remote unauthenticated attacker to locally escalate privilege to root.
PUBLISHED: 2021-04-09
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker must be within the same organization, or an external party who has been accepted as a contact. NOTE: this is specific to the Zoom Chat softw...
PUBLISHED: 2021-04-09
Use after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
PUBLISHED: 2021-04-09
Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.