Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/29/2014
10:30 AM
TK Keanini
TK Keanini
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

A 2014 Lookback: Predictions vs. Reality

It was a tumultuous year for cyber security, but it drove the adoption of incident response plans and two-factor authentication.

At the beginning of the year, I made a series of cyber security predictions for 2014. Some proved true, while others are happening a little more slowly than I anticipated. Let’s see how they stacked up against reality.

I predicted that in 2014 incident response would finally mature as a business process, and it seems that sentiment is well on its way to becoming reality. Security incidents threatened everyone this year. While these events were unfortunate, they prompted many organizations to adopt incident response plans. These high-profile, high-impact breaches and exploits will drive stronger incident response readiness in 2015, which is great news. But it will also cause attackers to innovate as we all continue to co-evolve in this security spiral.

As I anticipated, more online services implemented two-factor authentication in 2014, and more two-factor technology vendors have emerged, making implementation, administration, and maintenance much simpler. The website Two Factor Auth tracks the services across many industries that have implemented two-factor authentication. On that site, you will also find a list of organizations that employ two-factor authentication, which has more than doubled in 2014.

The trouble with 2FA: People
There is one problem with two-factor: community adoption. For this method of authentication to work, it must be used. I’ve seen many folks move to two-factor authentication after their accounts online were compromised several times, but more people need to adopt it before their accounts are jeopardized. Like incident response plans, wide adoption of two-factor will likely cause attackers to adapt their tactics and focus their attention on different parts of the authentication chain.

My false prediction was that more organizations would implement software-defined networking (SDN) and adaptive perimeters. While SDN technology further developed and matured this year, adoption of it did not. I still believe that this practice will eventually be embraced on a wide scale, but it seems I was a little too early with my predictions. However, the need for the adaptive perimeter is even greater in 2015 as the Internet of Things and a dynamic BYOD workforce drive the need. This one will become more obvious in the coming year.

Emerging threats: "Things" and mobile
In addition to the above, 2014 saw some smaller security challenges that could develop into future threats. As the Internet of Things expands into untapped and unexpected areas of our lives, the security stakes continue to rise. This year vulnerabilities were identified in automobiles, home appliances, and other unanticipated devices. If we are to avoid extensive exploitation, we must begin evaluating and preparing for the security risk imposed by these products.

3D printers continue to drop in price, and users continue to produce amazing and controversial output. This technology can save lives -- for example, enabling the printing of a perfectly fitted heart valve for an infant. On the other hand, technologists have demonstrated that they can print keys for high-security locks and inexpensive safe-cracking devices, adding a new dimension of vulnerability.

The prevalence of mobile apps that can access your personal location continue to be popular. How many times in 2014 were you asked if an application could use your location information? More than in 2013, I’ll bet, and this trend will only rise, because where you are matters to a lot of people -- both good and bad.

Surprise attacks: Heartbleed, Bash, and Shellshock
While it should be no surprise that attackers will focus their efforts on infrastructural components because the payoff is so great, no one believes it until made a reality by an active exploit. When news of the Heartbleed vulnerability broke, my opinion was that we should begin to look at other fundamental technology components and the risks they pose if exploited. This attack was a classic low-likelihood, but high-impact, black swan event.

The Bash shell was the next big attack vector on the list with the Shellshock bug, and we will be feeling the impact of this for years since Linux is the primary OS in so many embedded systems that remain unpatched.

We need to change the way we assess risks in fundamental software components with better threat modeling. While there will always be surprises, we need to be in a state of readiness that diminishes the payoff to the attacker and ensures the utmost levels of business continuity. These kinds of threats will happen again. We must be ready for them.

The past year had its ups and downs, but it drove the adoption of incident response plans and two-factor authentication. As the industry begins to implement these and other new security tactics, attackers will innovate as well. There are some important lessons from 2014. Take note, and we will all be better prepared next time.

TK Keanini brings nearly 25 years of network and security experience to the CTO role. He is responsible for leading Lancope's evolution toward integrating security solutions with private and public cloud-based computing platforms. TK is also responsible for developing the ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
1/6/2015 | 9:21:44 AM
Re: 2015 Predictions
Adding the live link to the Hitoshi Kokumai page on LI. Some interesting content there. Thanks for sharing @HAnatomi!

https://www.linkedin.com/today/author/141508358?trk=pulse-det-athr_posts
HAnatomi
50%
50%
HAnatomi,
User Rank: Apprentice
1/1/2015 | 7:49:44 PM
Re: 2015 Predictions
I am supporting the thought and theory of Expanded Password System advocated by Hitoshi Kokumai whose writings are posted on LinkedIn at

https://www.linkedin.com/today/author/141508358?trk=pulse-det-athr_posts

 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
12/31/2014 | 11:34:21 AM
Re: 2015 Predictions
Very interesting post. I agree with many of the statements you made.

People have difficulty remembering intricate strings, hence principles behind DNS. But I think with items such as tokens and devices, Security professionals have the right to hold people accountable to not lose the token. In an environment that requires this type of authentication being responsible is not a lofty request. That being said I understand mistakes happen.

Biometric is ideal but a very expensive means of authentication. This may not be feasible for implementation. What is your advice for a happy medium?
HAnatomi
50%
50%
HAnatomi,
User Rank: Apprentice
12/31/2014 | 2:40:56 AM
Re: 2015 Predictions
The two-factor authentication, though not a silver bullet, could be reliable when it comes with a reliable password. 2 is larger than 1 on paper, but two weak boys in the real world may well be far weaker than a toughened guy.  Physical tokens and phones are easily lost, stolen and abused. Then the password would be the last resort.  It should be strongly emphasized that a truly reliable 2-factor solution needed for important accounts requires the use of the most reliable password.  

Using a strong password does help a lot even against the attack of cracking the leaked/stolen hashed passwords back to the original passwords.  The problem is that few of us can firmly remember many such strong passwords.  It is like we cannot run as fast and far as horses however strongly urged we may be.  We are not built like horses.

 At the root of the password headache is the cognitive phenomena called "interference of memory", by which we cannot firmly remember more than 5 text passwords on average.  What worries us is not the password, but the textual password.  The textual memory is only a small part of what we remember.  We could think of making use of the larger part of our memory that is less subject to interference of memory.  More attention could be paid to the efforts of expanding the password system to include images, particularly KNOWN images, as well as conventional texts.

 By the way, some people shout that the password is dead or should be killed dead.  The password could be killed only when there is an alternative to the password.  Something belonging to the password(PIN, passphrase, etc)and something dependent on the password (ID federations, 2/multi-factor, etc) cannot be the alternative to the password.  Neither can be something that has to be used together with the password (biometrics, auto-login, etc). What could be killed is the text password, not the password.  

 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
12/29/2014 | 1:37:43 PM
2015 Predictions
Have you compiled predictions for the year 2015? If so, do you plan on creating another article to denote them?

I would be interested to see how your predictions align with the roadmapped enterprise initiatives.
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
6 Small-Business Password Managers
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/8/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11931
PUBLISHED: 2019-11-14
A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user. The issue was present in parsing the elementary stream metadata of an MP4 file and could result in a DoS or RCE. This affects Android versions prior to 2.19.274, iOS versions prio...
CVE-2019-18980
PUBLISHED: 2019-11-14
On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. Anyone can turn the bulb on or off, or change its color or brightness remotely. There is no authentication or encryption to use the control API. The o...
CVE-2019-17391
PUBLISHED: 2019-11-14
An issue was discovered in the Espressif ESP32 mask ROM code 2016-06-08 0 through 2. Lack of anti-glitch mitigations in the first stage bootloader of the ESP32 chip allows an attacker (with physical access to the device) to read the contents of read-protected eFuses, such as flash encryption and sec...
CVE-2019-18651
PUBLISHED: 2019-11-14
A cross-site request forgery (CSRF) vulnerability in 3xLogic Infinias Access Control through 6.6.9586.0 allows remote attackers to execute malicious and unauthorized actions (e.g., delete application users) by sending a crafted HTML document to a user that the website trusts. The user needs to have ...
CVE-2019-18978
PUBLISHED: 2019-11-14
An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.