Threat Horizon:
identifying future trends
Dr Adrian Davis, MBA, MBCS, CITP, CISMP
Principal Research Analyst
Information S...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 2
Agenda
The challenge
Our an...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 3
The Information Security Fo...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 4
THE CHALLENGE
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 5
The world is flat...
5
(Wit...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 6
Organisations: from value c...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 7
IT: from mainframe to commo...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 8
Technology: from data centr...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 9
Manufacturing: from in stoc...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 10
The information security c...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 11
Is to predict the future…
...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 12
OUR ANSWER: THREAT
HORIZON
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 13
Why look into the future?
...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 14
What is the threat horizon...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 15
Threat
Horizon
Dataset
Ong...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 16
Threat horizon methodology...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 17
2011...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 18
The world of 2011
A view o...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 19
OLITICALP
EGALL
CONOMICE
T...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 20
Criminal attacks
•Crimewar...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 21
2012...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 22
The world of 2012
A view o...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 23
OLITICALP
EGALL
CONOMICE
T...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 24
The scenarios…. Infrastruc...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 25
The scenarios…. Changing c...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 26
The scenarios…. Trends for...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 27
2013...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 28
2013 PLEST
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 29
Government
intervention
St...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 30
OLITICALP
EGALL
CONOMICE
T...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 31
An overview of the threats...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 32
Threats for 2013
On the ra...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 33
Threats for 2013
Below the...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 34
Beyond the horizon
Biometr...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 35
WHAT CAN I DO?
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 36
Responding to the threat h...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 37
What do I do now? – at a s...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 38
Create a security-positive...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 39
Manage your external suppl...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 40
Manage the cloud: the seve...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 41
Prepare for consumerisatio...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 42
CONCLUSION
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 43
Keeping up with change
• S...
www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 44
Information Security Forum...
Upcoming SlideShare
Loading in …5
×

El horizonte de las amenazas: identificando futuras tendencias / Threat Horizon: Identifying Future Trends

689 views

Published on

Ponencia de Adrian Davis. Analista Principal de Investigación. Information Security Forum.
Adrian Davis. Principal Research Analyst. Information Security Forum.

Curso de Verano / Summer Course CIGTR/URJC 2011

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
689
On SlideShare
0
From Embeds
0
Number of Embeds
97
Actions
Shares
0
Downloads
7
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

El horizonte de las amenazas: identificando futuras tendencias / Threat Horizon: Identifying Future Trends

  1. 1. Threat Horizon: identifying future trends Dr Adrian Davis, MBA, MBCS, CITP, CISMP Principal Research Analyst Information Security Forum
  2. 2. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 2 Agenda The challenge Our answer: Threat Horizon 2012... 2013.. What can I do? Conclusion
  3. 3. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 3 The Information Security Forum
  4. 4. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 4 THE CHALLENGE
  5. 5. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 5 The world is flat... 5 (With apologies to Thomas Friedman) Anything, including IT and information security, can be outsourced anywhere
  6. 6. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 6 Organisations: from value chain to corporate LEGO® • Single, vertically integrated organisation • Did everything and provided everything • Diverse, management –heavy, operations (cost of coordination) • Outsourcing means that organisations can assemble, break apart and reassemble themselves using different components • Focus on core competences • The supply chain can also be similarly reconfigured Firm infrastructure Human resource management Technology development Procurement Inbound Logistics Operations Outbound Logistics Sales and Marketing Service Value
  7. 7. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 7 IT: from mainframe to commodity • Services accessed across a network by a user at a ‘dumb’ terminal • Multiple applications • Multiple users • Charged on a per-use basis • Relentless technological innovation • The rise of the ‘app’ • Availability, affordability, connectivity, interactivity...
  8. 8. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 8 Technology: from data centre to cloudification... • Specialised, highly specified, purpose built facilities • Often owned by the organisation or provided as part of an outsourcing deal • Fairly easy to audit and monitor • Black box – the service is bought ‘as is’ • Opportunity to specify is lower • Your suppliers may be using the cloud • Audit and monitoring may be very different
  9. 9. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 9 Manufacturing: from in stock to just in time • Logistics is king • Minimal storage overhead • Reduced shrinkage and obsolescence • Information has to be freely shared across supply chain • Wasting asset – stock takes up space, time and cash • Opportunity for shrinkage and obsolescence • Information is concentrated in warehouses
  10. 10. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 10 The information security challenge.... How do we make sure we don’t cry wolf?
  11. 11. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 11 Is to predict the future… “Heavier-than-air flying machines are impossible” Lord Kelvin, president, Royal Society 1895 “I think there is a world market for maybe five computers” Thomas Watson, chairman of IBM 1943 “I have travelled the length and breadth of this country and talked with the best people, and I can assure you that data processing is a fad that won't last out the year.” The editor in charge of business books for Prentice Hall 1957 “This 'telephone' has too many shortcomings to be seriously considered as a means of communication. The device is inherently of no value to us.” Western Union internal memo 1876 Increasingly, information technology is playing a pivotal role in all our lives, both at work and at home
  12. 12. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 12 OUR ANSWER: THREAT HORIZON
  13. 13. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 13 Why look into the future? In order to understand how good practice should change in the future we need to understand what threats that we will face in the future and how we should respond to them. The ISF call this the Threat Horizon
  14. 14. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 14 What is the threat horizon? A report that... • identifies new and changing threats that are likely to impact information security over the next 24 months • is written for both information security and business audiences • informs information security strategy.
  15. 15. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 15 Threat Horizon Dataset Ongoing ISF research and analysis ISF Analysis Threat Horizon report The process… Regional meetings ISF Members around the globe Sector input Finance, Manufacturing, Pharmaceutical, Services... Expert Input WEF, OECD, Futurologists World Congress
  16. 16. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 16 Threat horizon methodology Consider the world of the future and how this may give rise to information security threats OLITICALP EGALL CONOMICE T ECHNICAL S OCIO-CULURAL
  17. 17. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 17 2011...
  18. 18. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 18 The world of 2011 A view of the business and technical trends.... OLITICALP EGALL CONOMICE T ECHNICAL S OCIO-CULTURAL Protectionism Regional blocs Inter- dependence More legislation Harsher penalties Outsourcing E-crime Less R&D Internet vs. reality Haves vs. have-nots Cloud grows up Corporate vs. home Encryption Security vs. privacy Home vs. office
  19. 19. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 19 OLITICALP EGALL CONOMICE T ECHNICAL S OCIO-CULURAL The information security trends of 2011 Considering the PLEST framework, several major trends emerge: Criminal attacks Changing cultures Weaknesses in infrastructure Erosion of network boundaries Identity theft Espionage Tougher statutory environment Mobile malware Pressures on outsourcing
  20. 20. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 20 Criminal attacks •Crimeware as a service •Insider attacks •Infiltration Tougher rules •Emphasis on privacy •Incompatible laws •Increasing punishment Outsourcing / Offshoring •More outsourcing •Meeting compliance •Instability of providers Weak infrastructure •Reduced investment •Complexity •Zero-day attacks Eroding boundaries •Cloud computing •More connections •Bypass of defences Top five threats in detail
  21. 21. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 21 2012...
  22. 22. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 22 The world of 2012 A view of the business and technical trends.... OLITICALP EGALL CONOMICE T ECHNICAL S OCIO-CULTURAL Protectionism Government Intervention Governmental sharing Regulation Privacy Over-regulation Cloud economics Recession legacyE-crime economics Blur Digital have-nots Cloud grows up Mobile dominates Mobile malware
  23. 23. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 23 OLITICALP EGALL CONOMICE T ECHNICAL S OCIO-CULURAL The information security trends of 2012 Considering the PLEST framework, several major trends emerge: Abuse of personal & mobile devices Changing cultures Weaknesses in infrastructure Erosion of network boundaries Identity theft Loss of communication links and power Cyber extortion Mobile malware Criminal attacks and espionage
  24. 24. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 24 The scenarios…. Infrastructural weaknesses Infrastructural weaknesses Contingency fails The cloud becomes a fog Who took my boundary? •Over reliance on Internet-only sales channels combines with poor resilience at pinch points •Impact •Loss of business and increased costs •Reduced transaction integrity and associated fraud •Loss of trust in the Internet channel •Loss of customers to competitors who can offer an easy alternative • Threats •Loss of or damage to communications links / services •Malfunction of computer / network equipment
  25. 25. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 25 The scenarios…. Changing cultures The mobile mainframe in your pocket A merger of home and work-life : the avatar effect • Increasing use of smartphones for business and personal transactions • Increased impact from of: •Fraud •Information leakage •Loss of integrity •Threats: •Distributing computer viruses (including worms) •Theft of equipment •Disclosing important business information •Theft of personally identifiable information
  26. 26. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 26 The scenarios…. Trends for multi-nationals The privacy vs. security debate becomes a high profile issue Espionage gets serious The greening of business Integrity is king Threats converge •Insufficient granularity in controls, lack of a trust model and poor compensating controls means that the accuracy, provenance, traceability and authenticity of information is unclear. •Impact •Trivial to significant. •Loss of trust with regulators, suppliers and customers •Downstream consequences to reputation. •Threats •Unforeseen effect of changes to business information •Misusing systems to commit fraud •Compliance failure
  27. 27. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 27 2013...
  28. 28. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 28 2013 PLEST
  29. 29. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 29 Government intervention State vs. State Breach notification Digital human rights Cost of resources m- economyRise of Africa Single-issue activism Location services 4G/LTE networks The world of 2013 A view of the business and technical trends.... OLITICALP EGALL CONOMICE T ECHNICAL S OCIO-CULTURAL IPv6 adoptionSmart grids State vs. Non-state
  30. 30. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 30 OLITICALP EGALL CONOMICE T ECHNICAL S OCIO-CULURAL Considering the PLEST framework, several major trends emerge: Data leakage Securing the supply chain Blended attacks Device revolution Data quality issues Attacks on infrastructure Hacktivism Beyond cloud New e-crime opportunities The information security trends of 2013
  31. 31. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 31 An overview of the threats On the radar but not manageable On the radar and manageable Below the radar Black swans
  32. 32. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 32 Threats for 2013 On the radar and manageable - Uncontrolled introduction of consumer devices - Loss of trust / inability to prove identity and authenticate - Loss of workforce loyalty – loss of organisational culture and knowledge On the radar but not manageable - State-sponsored cyber-activity - Social media - Embedded location services
  33. 33. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 33 Threats for 2013 Below the radar - Governmental requirements - Co-ordinated attacks for extortion, blackmail, bribery or stock manipulation - RFID exploits Black swans - Hardware back doors (low-level attacks / vulnerabilities) in chips, SCADA - Solar activity disrupts communications globally
  34. 34. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 34 Beyond the horizon Biometrics Embedded chips Quantum computing SPIT Nano-technology AI New interfaces Everyone connected to everything
  35. 35. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 35 WHAT CAN I DO?
  36. 36. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 36 Responding to the threat horizon Information security controls that defend against threats are: Often part of a wide infrastructure project (eg firewall, network segregation) Sometimes difficult to justify to the business AND Sometimes can take years to plan and deliver THEREFORE We need to start to plan controls for future threats NOW!
  37. 37. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 37 What do I do now? – at a strategic level Re-assess the risks to your organisation and its information • Inside and outside… Change your thinking about threats • Don’t rely on trends or historical data Revise your information security arrangements • Question ‘security as usual’ Focus on the basics • That includes people, not just technology! Prepare for the future • Be ready to support initiatives such as cloud computing, consumerisation....
  38. 38. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 38 Create a security-positive environment or culture Security positive environment Security Policy Security Awareness Organisational Culture Framework of Controls Visibility of Security Function Local Security Coordination Leadership and Governance Communication and Messaging Organisational factors: Engagement and commitment Security factors: Knowledge and know how
  39. 39. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 39 Manage your external suppliers 1. Identify and classify external suppliers 2. Define a baseline of information security and privacy arrangements 3. Validate external supplier information security and privacy arrangements regularly 4. Plan for the end 39 Managingtherelationships A: Identify and classify external suppliers D: Handling termination C: Validate external suppliers security B: Agree external suppliers security
  40. 40. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 40 Manage the cloud: the seven deadly sins 1. Ignorance 2. Ambiguity 3. Doubt 4. Trespass 5. Chaos 6. Conceit 7. Complacency
  41. 41. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 41 Prepare for consumerisation • A strategic imperative • Securing consumer / mobile devices forms the centre piece of the organisational response • Four aspects to your response 1. Governance 2. Users 3. Devices 4. Applications and data “Communication and information processing devices originally designed for personal use being used in the workplace”
  42. 42. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 42 CONCLUSION
  43. 43. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 43 Keeping up with change • Social environment (demographics, attitudes, cultures) • Business environment (activities, operations, markets) • Economic environment (credit crunch, realignment of world economy, rise of China) • Global environment (global warming, interconnectivity, competition for resources) • Technological environment (mobile phones, nanotechnology, pervasiveness) ACTIONS • Engage with the business • Question the beliefs • Craft a new security strategy • Plan for uncertainty • Prepare for change
  44. 44. www.securityforum.org ISF Threat Horizon Copyright © 2011 Information Security Forum Limited 44 Information Security Forum adrian.davis@securityforum.org www.securityforum.org http://uk.linkedin.com/in/adriandaviscitp/

×