They Told You So

9:30 AM -- Sometimes, Wall Street analysts actually do know which way the market is heading. Sometimes, the TV meteorologist really predicts the weather correctly. And sometimes, security experts' warnings about future threats come absolutely true.

Over the past week, a number of systems and enterprises have fallen victim to vulnerabilities and exploits that have been forecast in the past. It started when a security firm uncovered the long-dormant cross-site request forgery (CSRF) bug in products from eight other security vendors. (See CSRF Bug Runs Rampant.) Analysts have been warning users about the CSRF flaw since last October (See CSRF Vulnerability: A 'Sleeping Giant'.)

Then, we saw the introduction of the Apple iPhone, a technology that hackers and researchers have been watching – and drooling over – for some time. Just hours after they got service, researchers were already disclosing vulnerabilities in the hot new device. (See i Caramba! iPhone Hacked Already.) But warnings about the iPhone were being circulated months before its release. (See Should IT Block iPhone?)

Later in the week, there was controversy over a new release of FlexiSPY, an application sold by Vervata Co. Ltd. as a means of tracking the activities of employees, children, and cheating spouses. (See FlexiSPY: Product or Trojan?) But security companies like F-Secure Corp. called the application a malicious Trojan – just as they had warned the industry when the technology was released a year ago. (See F-Secure's advisory.)

And finally, an employee at Fidelity National Information Services, a financial processing company, was fired for stealing some 2.3 million customer names and selling them to a data broker. (See Admin Accused of Stealing 2.3M Names.) The theft is consistent with forecasts last year that predicted insider data theft would increase as the market for stolen information improved. (See Stolen Data's Black Market.)

Does all of this mean that security managers should forget log analysis and go hire a psychic? No – though that might be fun. However, the trend does suggest that sometimes there is some merit to threat forecasts that might otherwise seem a bit paranoiac. Sometimes the threats are real, and it's worth taking steps to prevent them.

After all, even the TV weather guy is right once in a while.

— Tim Wilson, Site Editor, Dark Reading