Threat Intelligence

5/31/2016
12:00 PM
50%
50%

10 Sea-Changing IT Security Trends Of The Last 10 Years

A look at ten of the megatrends that have shaped IT security -- and in some cases, enterprise business -- over the last decade.

When it comes to IT security, the old saw says, the only constant is change. As Dark Reading looks back over the ten years since its launch in 2006, that maxim seems more accurate than ever.

Like generals fighting a losing battle, security thought leaders and professionals have been forced to change strategies many time over the last decade, often in response to technological and strategic advancements developed by the attackers. While IT itself has evolved quickly, the pace of new security threats has continued to move at even faster speeds, often leaving defenders in firefights that change almost daily. And defense strategies that were once fundamental to the security industry are now being constantly challenged – if not outright rejected -- by the thinkers who once promoted them.

In this feature, we take a look at some of the fundamental sea changes that have occurred over the last 10 years. Perhaps a look at where we’ve been will give us a hint at where we’re going – or at least prepare us for more change in the future.

From Sentries To Detectives

Ten years ago, IT security professionals were often seen as the guards at the gate – the people who were responsible for protecting corporate data and preventing cyber criminals from gaining access to enterprise systems. There was a perception of a defensible "perimeter” for each organization, and a relatively stable set of end user technologies to secure.

Today, the majority of security technologies and strategies assume that the enterprise has already been compromised. There is a heavy emphasis on the use of data forensics to ferret out sophisticated exploits hiding in the infrastructure, as well as incident response tools to detect and remediate compromises as soon as possible. Enterprises’ broader shift to technologies that are outside the IT department’s span of control – including cloud services and user-owned mobile devices – has virtually shattered the perimeter defense concept and forced the security team to spend most of its time searching for threats that have already penetrated the organizational walls.

The Shrinking Skills Pool

In 2006, a significant portion of the security team could be described as system administrators who spent much of their time onboarding new users, maintaining simple access controls, and administering passwords. While there were plenty of security thinkers and strategy architects, the demands on the average security pro were mostly around policy management and internal system defense – and while hiring was not easy, it was often possible to bring in an entry-level system administrator and teach them what they needed to know about more sophisticated threats and defenses over time.

Over the past decade, however, the rapid evolution of online threats – and the negative publicity received by companies that were breached – has generated a nearly-insatiable demand for more IT security talent. Not only does the industry need more bodies – some estimates say that as many as 1.5 million new security jobs will be created over the next five years – but the skills requirement has increased, as enterprises do less simple systems administration and more post-compromise analysis of incoming threats. If current trends are any indication, IT security will continue to remain a negative-unemployment industry for many years to come, and the most skilled people will generate the greatest demand.

The Erosion Of Layered Security

For many of the last ten years, IT security lived and died by the philosophy of "layered security," which holds that an enterprise’s best defense is to challenge the attacker with an array of different defenses – firewalls, antivirus, intrusion detection/prevention, encryption, authentication, and many more – in an effort to discourage all but the most determined attackers. This strategy, sometimes called "defense in depth," encouraged enterprises to purchase and implement a wide variety of security tools and practices, making it difficult for any single-vectored attack to get through.

However, after ten years of buying and deploying new security technologies and breaking new IT security spending records year after year, most security experts are beginning to wonder if the layered security philosophy is the best approach. The incidence and cost of data breaches continue to increase, and some business executives have begun to balk at the notion of continually increasing spending on technology and people without any guarantee of data security. Many enterprises and security experts are rethinking some of the basic precepts of IT security, though a clear new philosophy has yet to emerge.

Cybercrime Boom

In 2006, many security strategies were still predicated on the proliferation of viruses and worms such as Love and Code Red, which were designed to infect as many machines as possible and to gain notoriety for their creators. In some quarters, there was still a perception of hackers as teenagers working late at night in their basements, seeking approval from others online.

In fact, by 2006 the cybercrime market had already begun a massive shift toward an organized, underground economy that has continued to grow and flourish over the past decade. Malware developers create and sell their exploits in online forums -- and support their products with upgrades, patches, and even 24-hour customer service. Criminals can rent botnets by the hour, or purchase long lists of valid credit cards at less than a dollar apiece. Recent estimates project that cybercrime costs will reach $2 trillion by 2019, and some law enforcement agencies say organized crime syndicates now make more money from cybercrime than from drugs or prostitution. Clearly, cybercrime is more lucrative than ever – and that trend bodes poorly for tomorrow’s IT security defenders.

Security Goes Public

When Dark Reading was launched in 2006, it carried only a few stories about security breaches, partly because laws requiring companies to disclose such breaches were only just going into effect. With the passage of breach disclosure laws in California – and subsequently, 47 other states – the extent of the cybersecurity problem became increasingly evident. The Identity Theft 

(Continued on Page 2) 

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
ChrisHarget
50%
50%
ChrisHarget,
User Rank: Author
6/1/2016 | 6:17:52 PM
What's Next? Machine Learning, Anyone?
A number of startups are trying to find ways to let machines look at internal user behavior, create statistical norms for what is typical, then highlight or escalate abnormal behavior that might be a breach. If you have 100 employees with the same job title, but only one of them is storing gigabytes of data in a cloud drive, that might merit the attention of a security analyst.

 

This is still very early days, and one can imagine all manner of places it won't work (what if you only have 2 employees with a particular job title?), but if it's even useful 1/4th the time in a large organization, that might still be a big step forward for accelerating early detection.
Facebook Aims to Make Security More Social
Kelly Sheridan, Associate Editor, Dark Reading,  2/20/2018
SEC: Companies Must Disclose More Info on Cybersecurity Attacks & Risks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  2/22/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.