Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

10 Sea-Changing IT Security Trends Of The Last 10 Years

A look at ten of the megatrends that have shaped IT security -- and in some cases, enterprise business -- over the last decade.

When it comes to IT security, the old saw says, the only constant is change. As Dark Reading looks back over the ten years since its launch in 2006, that maxim seems more accurate than ever.

Like generals fighting a losing battle, security thought leaders and professionals have been forced to change strategies many time over the last decade, often in response to technological and strategic advancements developed by the attackers. While IT itself has evolved quickly, the pace of new security threats has continued to move at even faster speeds, often leaving defenders in firefights that change almost daily. And defense strategies that were once fundamental to the security industry are now being constantly challenged – if not outright rejected -- by the thinkers who once promoted them.

In this feature, we take a look at some of the fundamental sea changes that have occurred over the last 10 years. Perhaps a look at where we’ve been will give us a hint at where we’re going – or at least prepare us for more change in the future.

From Sentries To Detectives

Ten years ago, IT security professionals were often seen as the guards at the gate – the people who were responsible for protecting corporate data and preventing cyber criminals from gaining access to enterprise systems. There was a perception of a defensible "perimeter” for each organization, and a relatively stable set of end user technologies to secure.

Today, the majority of security technologies and strategies assume that the enterprise has already been compromised. There is a heavy emphasis on the use of data forensics to ferret out sophisticated exploits hiding in the infrastructure, as well as incident response tools to detect and remediate compromises as soon as possible. Enterprises’ broader shift to technologies that are outside the IT department’s span of control – including cloud services and user-owned mobile devices – has virtually shattered the perimeter defense concept and forced the security team to spend most of its time searching for threats that have already penetrated the organizational walls.

The Shrinking Skills Pool

In 2006, a significant portion of the security team could be described as system administrators who spent much of their time onboarding new users, maintaining simple access controls, and administering passwords. While there were plenty of security thinkers and strategy architects, the demands on the average security pro were mostly around policy management and internal system defense – and while hiring was not easy, it was often possible to bring in an entry-level system administrator and teach them what they needed to know about more sophisticated threats and defenses over time.

Over the past decade, however, the rapid evolution of online threats – and the negative publicity received by companies that were breached – has generated a nearly-insatiable demand for more IT security talent. Not only does the industry need more bodies – some estimates say that as many as 1.5 million new security jobs will be created over the next five years – but the skills requirement has increased, as enterprises do less simple systems administration and more post-compromise analysis of incoming threats. If current trends are any indication, IT security will continue to remain a negative-unemployment industry for many years to come, and the most skilled people will generate the greatest demand.

The Erosion Of Layered Security

For many of the last ten years, IT security lived and died by the philosophy of "layered security," which holds that an enterprise’s best defense is to challenge the attacker with an array of different defenses – firewalls, antivirus, intrusion detection/prevention, encryption, authentication, and many more – in an effort to discourage all but the most determined attackers. This strategy, sometimes called "defense in depth," encouraged enterprises to purchase and implement a wide variety of security tools and practices, making it difficult for any single-vectored attack to get through.

However, after ten years of buying and deploying new security technologies and breaking new IT security spending records year after year, most security experts are beginning to wonder if the layered security philosophy is the best approach. The incidence and cost of data breaches continue to increase, and some business executives have begun to balk at the notion of continually increasing spending on technology and people without any guarantee of data security. Many enterprises and security experts are rethinking some of the basic precepts of IT security, though a clear new philosophy has yet to emerge.

Cybercrime Boom

In 2006, many security strategies were still predicated on the proliferation of viruses and worms such as Love and Code Red, which were designed to infect as many machines as possible and to gain notoriety for their creators. In some quarters, there was still a perception of hackers as teenagers working late at night in their basements, seeking approval from others online.

In fact, by 2006 the cybercrime market had already begun a massive shift toward an organized, underground economy that has continued to grow and flourish over the past decade. Malware developers create and sell their exploits in online forums -- and support their products with upgrades, patches, and even 24-hour customer service. Criminals can rent botnets by the hour, or purchase long lists of valid credit cards at less than a dollar apiece. Recent estimates project that cybercrime costs will reach $2 trillion by 2019, and some law enforcement agencies say organized crime syndicates now make more money from cybercrime than from drugs or prostitution. Clearly, cybercrime is more lucrative than ever – and that trend bodes poorly for tomorrow’s IT security defenders.

Security Goes Public

When Dark Reading was launched in 2006, it carried only a few stories about security breaches, partly because laws requiring companies to disclose such breaches were only just going into effect. With the passage of breach disclosure laws in California – and subsequently, 47 other states – the extent of the cybersecurity problem became increasingly evident. The Identity Theft 

(Continued on Page 2) 

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
ChrisHarget
50%
50%
ChrisHarget,
User Rank: Author
6/1/2016 | 6:17:52 PM
What's Next? Machine Learning, Anyone?
A number of startups are trying to find ways to let machines look at internal user behavior, create statistical norms for what is typical, then highlight or escalate abnormal behavior that might be a breach. If you have 100 employees with the same job title, but only one of them is storing gigabytes of data in a cloud drive, that might merit the attention of a security analyst.

 

This is still very early days, and one can imagine all manner of places it won't work (what if you only have 2 employees with a particular job title?), but if it's even useful 1/4th the time in a large organization, that might still be a big step forward for accelerating early detection.
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7227
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.