Well, it's that time of year again. Each year at this time we take a look into the future while everyone else is reliving the events of the past year. Perverse, I know, but in our field the future really is now. So in the spirit of keeping up with advancements in information security, we take the December issue to examine those companies that will likely generate those advancements.
Taking just a moment to look back with a couple of observations is not out of the question of course, so, a couple of thoughts on the past year. First, I do not think I have yet seen a year where the bad guys made more advances in technology, techniques and general damaging activities. We saw the emergence of what I call a cyber smash and grab, where the crooks take weeks or more quietly penetrating a card clearing house or other card provider and then – in a 24-hour period – use the stolen information to clean out hundreds of ATMs netting millions in stolen cash.
We saw the re-emergence of real creativity in malware so that now a very high percentage of all breaches involve malware. Some of the malware is quite interesting, even though much of it is reworked older bugs. Even the reworking seems to be creative and, in some cases, quite dangerous. This, after all, was the year when we learned without question or argument that computer malware can have physical consequences. Ironically, Stuxnet, the bug heard around the world, was not created this year, and Flame, touted as the most advanced malware ever (by some, anyway), was older still.
All of this criminal innovation, disruptive though it was, had one very positive effect: It shaped our security sensibilities and consequently our industry. One of the innovators I interviewed, told me that in this field you innovate or you go out of business. That person was from a large company, and large companies aren't always known for being innovators. That may well be changing now, out of necessity if for no other reason.
Over the years I have watched innovation in our field ebb and flow. It appears to me that we are in a period of innovation and creativity that might eclipse anything we've seen since the earliest glory days of Silicon Valley. Convergence in technologies and companies is increasing rapidly and academics, more than ever, are engaging with industry to discover new solutions to difficult security problems.
Also, this year marked my 50th year in the information security world, which started in 1963 as a Navy crypto tech. Over this last half century, I have watched patterns in the security field change, the attacks change and the technologies change to keep up. Always to keep up. I hope that this year, my 51st, is the year when we with the white hats can say that we did it…. We pulled ahead. After many years of playing “catch-up,” finally we pulled ahead. Have a great holiday season and we'll meet again on the other side.
