Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


11:00 AM
Jeff Schilling
Jeff Schilling
Connect Directly
E-Mail vvv

In The Cyber Realm, Lets Be Knights Not Blacksmiths

Why the Internet of Things is our chance to finally get information security right.

It happens every year. I attend the major security conferences and watch them devolve into rhetoric-filled conduits void of productivity and education. In fact, many decisions-makers no longer attend. And if they do, they don’t appear at many sessions and avoid venturing into the noise of the vendor exhibit floor.  

It’s the same monotonous commotion. Vendors and experts flooding the floor and claiming, “We are the only one doing this.” It’s been quite a while since I’ve seen new technology that makes me think, “Wow, that’s unique.” Each year, everyone has their spin on four components of the same mantra:

  • Artificial Intelligence/Machine-Learning 
  • Big Data Analytics
  • Anomaly Detection 
  • Finding the “Right Needle in the Stack of Needles”  

It continues to be the wrong mindset for security professionals. It’s a warehouse of weaponry without anyone skilled in using it properly or safely. To me, it’s akin to a blacksmith dropping off a cart full of swords and shields at a village and saying, "Stack these weapons on the road to your town. Don’t worry, it will protect you from evildoers."  

What is forgotten in the conversation is that it takes skilled professionals — or knights in this rudimentary analogy — to wield tools to protect themselves or organizations from malicious threat actors.

Everyone’s Doing It, And Doing it Wrong
Security vendors continually deploy a basic set of tools: a security information and event management (SIEM) tool; virtual machine inspection; “Layer 7” inspection; and finish with a variety of inline deep-packet inspection. I see limited innovation with vendors that have successfully integrated these capabilities in a unified threat management (UTM) platform.

The effectiveness of this approach will lean heavily on vendors’ ability in integrating and simplifying threat detection functions within UTMs. However, these UTM platforms are usually not strong in all functional capabilities.

An emerging trend that appears to be the new direction in security tools is application security capabilities, which proclaim to sit between the app server and the database. Are we simply building more swords and shields, but not making any real progress against true threats? Today’s security tools are overly complex and, in most cases, ineffective if not employed by highly trained security teams. In many scenarios, you may have to accept that while you have a great sword, it may be two feet shorter than your enemy’s simple but effective spear.

Embrace IOT Security Before It’s Too Late
So, what’s the core problem? As I see it, most security teams lack a true strategy. They continue to pile swords, spears and shields on the road to the village and hope threat actors will somehow be deterred or trip and fall on a sword. Unlikely.

In my opinion, 99 percent of the problem faced by professionals struggling to secure their networks boils down to one simple fact: their architecture cannot be defended. The traditional network-centric model — a framework that has evolved since the evolution of TCP/IP in the late ‘80s — has too much surface area to protect. We will never get the initiative back from the threat actors. I just stated a fact of the obvious. But is there a solution?

There is:  Embrace the Internet of Things (IOT) as a new security architecture. I may be in the minority. I still very much feel like the lone professional on every security panel I sit on who believes the IOT is our chance to get security right.

Four Key Steps for IOT
Essentially, we seek to transform our fundamental architecture from a network-centric model (where you pull data and applications into many endpoints) to a data-centric model (where applications and data don’t move). The ubiquitous user moves around on many different platforms, but for the most part they connect to the application and data, view it or interact with it, then drop the connection. Nothing of value to exploit is left on the end-user device.

In this framework, I recommend four key focus areas for security and technology vendors, some of which are already in flight.

  1. Develop a foolproof, role-based identity management system that is easy to scale and manage access to applications and data
  2. Provide an application/database encryption solution that denies an authorized user, who does not present the right token, from getting unencrypted data access  
  3. Build a sandbox environment in the application for interaction on the user host that is protected from any malware that exists on user devices
  4. Design infallible handshake and en route encryption capabilities so attacks like man-in-the-middle are not possible

If we’re able to move away from legacy network-centric thinking toward new IoT frameworks, we’ll have a great opportunity to improve security. This will help us clearly identify users; protect both data at rest and in transit; eliminate the ability of users to move data to their devices; and stop defending the endpoint.

I am ready for the Internet of Things to usher us into a new security era. The strategy of bolting on security technology to an un-defendable network-centric architecture is obsolete. It’s time.

Jeff Schilling, a retired U.S. Army colonel, is Armor's chief security officer. He is responsible for the cyber and physical security programs for the corporate environment and customer-focused capabilities. His areas of responsibilities include security operation, governance ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Author
7/6/2015 | 5:50:22 PM
Re: Kights with weak swords

Thank you for your response to the article.  Great points all around.  Flawed Software is the crux of the issue.  I tell people everyday that threat actors are not doing much different from when I ran the DOD Security Ops centers from 2007-2012.  Their operational processes have gotten much more organized and their ability to leverage Zero day exploits much quicker.  

I am hopeful we will get it right when we move to IOT, which really a cloud-based, data centric model vice a network centric model we live in for the most part today.

Blog Voyage
Blog Voyage,
User Rank: Strategist
7/3/2015 | 9:06:21 AM
Re: Kights with weak swords
Very nice analysis.
User Rank: Apprentice
7/2/2015 | 3:47:33 PM
Kights with weak swords
I suggest that the issue is more than not being knights (a good and important point).  Rather the idea of having swords 2-feet shorter starts to highlight the pragmatic reality.  Attackers have a large attack surface to attack, a surface that to the defender is much like an iceberg - the part we see (known vulnerabilities) is only a small part of the overall.  And we face adversaries conducting 'undersea' operations.  Moreover, the 4 IOT actions could be quite effective if (BIG IF) they are implemented such that they are correct, always invoked when needed, not bypassed, and not tampered with.  Yet if we could do that for these IOT actions, we could do it for non-IOT means as well.  And the reasons we are not would apply to the IOT actions as well.

A first principle is that a problem due to flawed software cannot be corrected by adding more flawed software.  The trustworthiness of SW is NOT determined by what it does, but by how it came to be.  And the software for the 4-IOT actions will be implemented with SW of the same low assurance as the SW it is trying to protect; unless doing differently is an explicit part of the actions to be performed.

My suggestion is - sure, absolutely pursue ideas such as your 4-IOT actions.  Yet more importantly and as mandatory for mission/business success FIRST:

a. See the reality of large low assurance IT for what it is - highly susceptible to attack and a situation that cannot, on first principles, be meaningfully changed by the addition of more low-assurance SW;

b. Use the IT we have according to what it is, not what we wish it was, making 'wise use' decisions as to what and how much to automate and having alternative mission/business processes for contingency operations;

c. Measure our cybersecurity capability against the adversary, not against our previous capability (to avoid measuring degrees of ineffectiveness and start measuring how effective we really are); and

d. Make changes to the above as the reality of the IT we use changes in a meaningful manner.

Gary Stoneburner, Senior Professional Staff, Johns Hopkins University/Applied Physics Laboratory and major contributor to NIST information security guidance (Expressing personnal judgement and not an position of my employer)
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-20
A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient authentication validation.
PUBLISHED: 2021-04-20
vscode-restructuredtext before 146.0.0 contains an incorrect access control vulnerability, where a crafted project folder could execute arbitrary binaries via crafted workspace configuration.
PUBLISHED: 2021-04-20
** UNSUPPORTED WHEN ASSIGNED ** The AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions as well since they have not previously been disclosed....
PUBLISHED: 2021-04-20
** UNSUPPORTED WHEN ASSIGNED ** The AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions as well since they have not previously been disclosed. Only...
PUBLISHED: 2021-04-20
** UNSUPPORTED WHEN ASSIGNED ** AdTran Personal Phone Manager 10.8.1 software is vulnerable to an issue that allows for exfiltration of data over DNS. This could allow for exposed AdTran Personal Phone Manager web servers to be used as DNS redirectors to tunnel arbitrary data over DNS. NOTE: The aff...