Mobile

12/1/2017
09:30 AM
100%
0%

Sallie Mae CISO: 4 Technologies That Will Shape IT Security

'The world as we know it will vanish,' according to Jerry Archer.

INSECURITY CONFERENCE 2017 - Washington, DC – IT security is will undergo a major transformation in the coming years due to four waves of technology changes, according to Jerry Archer, Sallie Mae's chief information security officer.

In a keynote here this week at Dark Reading's INsecurity conference, Archer said cloud computing is the first wave of technology changes affecting IT security. "We have a complex (IT) environment, so we abstract to make the complex simple," Archer said. "But this abstraction creates gaps and that presents vulnerabilities."

Although cloud computing is more secure than companies building a distributed environment for their data, there are a couple of problems they face in keeping their cloud secure. One problem is companies need to remember to "turn on the security," Archer said, pointing to breaches companies have faced when misconfiguring their Amazon S3 buckets.  Another problem is they forget to keep their security "on" once they have initially taken that step, he said.

Cloud computing is also creating an environment where companies are deploying software-defined perimeters, where users must authenticate to the network based on risk-based calculations before they can connect to it. This reliance on behavioral analytics is creating a who, what, when, and where is happening in the cloud without the traditional visibility, he noted.

A second wave of technology that will affect IT security is artificial intelligence in networking, according to Archer. Companies will turn to AI to parcel out the workloads into smaller pieces that will be secured in lots of tiny containers, which Archer described as "rain," and moved to policy-based computing clouds that perform specific tasks, he said.

Additionally, the data will go from micro-segmentation to nano-segmentation, with the containers enabling agile security services, he said.

Massively Integrated Systems of Smart Transducers (MIST) will be the third technology wave, in which data is everywhere and moves continuously: "Things will come and go out of my orbit."

He added it will be a return to a larger environment that companies will need to secure, after having taken the steps to simplify their IT environment.

The fourth technology wave is quantum computing, which has many unforeseen implications for IT security as computers become exponentially more powerful, Archer said. But one area already being discussed is quantum computing's impact on encryption and its expected ability to break it, he added.

"The world as we know it will vanish," Archer said. "This may happen in three years, five years, or 10 years. I don't know when but it will happen."

Related Content:

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Veterans Find New Roles in Enterprise Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/12/2018
Empathy: The Next Killer App for Cybersecurity?
Shay Colson, CISSP, Senior Manager, CyberClarity360,  11/13/2018
Understanding Evil Twin AP Attacks and How to Prevent Them
Ryan Orsi, Director of Product Management for Wi-Fi at WatchGuard Technologies,  11/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Post a Comment
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15759
PUBLISHED: 2018-11-19
Pivotal Cloud Foundry On Demand Services SDK, versions prior to 0.24 contain an insecure method of verifying credentials. A remote unauthenticated malicious user may make many requests to the service broker with different credentials, allowing them to infer valid credentials and gain access to perfo...
CVE-2018-15761
PUBLISHED: 2018-11-19
Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation. A remote authenticated user may modify the url and content of a consent page to gain a token with arbitrary scopes that escalates their privileges...
CVE-2018-17190
PUBLISHED: 2018-11-19
In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The master itself does not, by design, execute user code. A specially-crafted request to the master can, however, cause the master to execute code ...
CVE-2018-1841
PUBLISHED: 2018-11-19
IBM Cloud Private 2.1.0 could allow a local user to obtain the CA Private Key due to it being world readable in boot/master node. IBM X-Force ID: 150901.
CVE-2018-18519
PUBLISHED: 2018-11-19
BestXsoftware Best Free Keylogger 5.2.9 allows local users to gain privileges via a Trojan horse "%PROGRAMFILES%\BFK 5.2.9\syscrb.exe" file because of insecure permissions for the BUILTIN\Users group.