In The Cyber Realm, Let’s Be Knights Not Blacksmiths

It happens every year. I attend the major security conferences and watch them devolve into rhetoric-filled conduits void of productivity and education. In fact, many decisions-makers no longer attend. And if they do, they don’t appear at many sessions and avoid venturing into the noise of the vendor exhibit floor.  

It’s the same monotonous commotion. Vendors and experts flooding the floor and claiming, “We are the only one doing this.” It’s been quite a while since I’ve seen new technology that makes me think, “Wow, that’s unique.” Each year, everyone has their spin on four components of the same mantra:

It continues to be the wrong mindset for security professionals. It’s a warehouse of weaponry without anyone skilled in using it properly or safely. To me, it’s akin to a blacksmith dropping off a cart full of swords and shields at a village and saying, "Stack these weapons on the road to your town. Don’t worry, it will protect you from evildoers."  

What is forgotten in the conversation is that it takes skilled professionals — or knights in this rudimentary analogy — to wield tools to protect themselves or organizations from malicious threat actors.

Everyone’s Doing It, And Doing it Wrong
Security vendors continually deploy a basic set of tools: a security information and event management (SIEM) tool; virtual machine inspection; “Layer 7” inspection; and finish with a variety of inline deep-packet inspection. I see limited innovation with vendors that have successfully integrated these capabilities in a unified threat management (UTM) platform.

The effectiveness of this approach will lean heavily on vendors’ ability in integrating and simplifying threat detection functions within UTMs. However, these UTM platforms are usually not strong in all functional capabilities.

An emerging trend that appears to be the new direction in security tools is application security capabilities, which proclaim to sit between the app server and the database. Are we simply building more swords and shields, but not making any real progress against true threats? Today’s security tools are overly complex and, in most cases, ineffective if not employed by highly trained security teams. In many scenarios, you may have to accept that while you have a great sword, it may be two feet shorter than your enemy’s simple but effective spear.

Embrace IOT Security Before It’s Too Late
So, what’s the core problem? As I see it, most security teams lack a true strategy. They continue to pile swords, spears and shields on the road to the village and hope threat actors will somehow be deterred or trip and fall on a sword. Unlikely.

In my opinion, 99 percent of the problem faced by professionals struggling to secure their networks boils down to one simple fact: their architecture cannot be defended. The traditional network-centric model — a framework that has evolved since the evolution of TCP/IP in the late ‘80s — has too much surface area to protect. We will never get the initiative back from the threat actors. I just stated a fact of the obvious. But is there a solution?

There is:  Embrace the Internet of Things (IOT) as a new security architecture. I may be in the minority. I still very much feel like the lone professional on every security panel I sit on who believes the IOT is our chance to get security right.

Four Key Steps for IOT
Essentially, we seek to transform our fundamental architecture from a network-centric model (where you pull data and applications into many endpoints) to a data-centric model (where applications and data don’t move). The ubiquitous user moves around on many different platforms, but for the most part they connect to the application and data, view it or interact with it, then drop the connection. Nothing of value to exploit is left on the end-user device.

In this framework, I recommend four key focus areas for security and technology vendors, some of which are already in flight.

If we’re able to move away from legacy network-centric thinking toward new IoT frameworks, we’ll have a great opportunity to improve security. This will help us clearly identify users; protect both data at rest and in transit; eliminate the ability of users to move data to their devices; and stop defending the endpoint.

I am ready for the Internet of Things to usher us into a new security era. The strategy of bolting on security technology to an un-defendable network-centric architecture is obsolete. It’s time.