What Security Trends Defined RSA Conference 2012?

TL;DR

Security teams should reassess practices whose original assumptions no longer match the current environment. Discoverable personal data weakens biographical password-reset questions, scarce security metrics can distort risk judgments, and targeted attacks expose weak collaborative information sharing. Sound risk assessment should focus on practical impact, not dramatic percentage changes or headlines.

Transcript

This is Jean Friedman, Content Manager for RSA Conference, and welcome to the webcast, Crystal Ball Reflections from RSA Conference Two Thousand Twelve and Looking at the Year Ahead. I am pleased to introduce Hugh Thompson, who will be reviewing some of the trends presented at RSA Conference Two Thousand Twelve and his future views for the rest of ... Read More

Key Insights

• Security practices are only reliable while their underlying assumptions match current conditions. Advice that was technically reasonable years earlier can become harmful or ineffective after environmental changes, so established habits should be periodically examined through risk assessment rather than preserved merely because they are familiar.
• Biographical password-reset questions have weakened because personal information is increasingly discoverable online. Social networks, blogs, contributions from friends or relatives, and searchable digitized public records can reveal facts that previously seemed private enough to authenticate an account holder.
• Percentage increases do not establish practical significance without baseline context. Worldwide shark attacks rose from sixty-three to seventy-nine, which was a twenty-five percent increase, yet the underlying event remained rare and therefore did not justify the alarm suggested by dramatic headlines.
• Information security has relatively few dependable metrics, which can cause practitioners to overvalue whatever measurements are available. A statistic may accurately describe change while still providing a misleading basis for decisions if rarity, consequences, causes, and relevant context are ignored.
• Advanced persistent threats and targeted attacks were serious concerns during twenty eleven and prominent subjects in the technology press. Their importance extended beyond individual incidents because they exposed weaknesses in how the information security industry collaborates and shares information about attacks.
• Hacktivism changed the security industry in a notable way and became a major topic at RSA Conference twenty twelve. Its prominence placed it alongside advanced threats as one of the developments shaping the security discussion after an unusually incident-heavy year.
• Embedded-device vulnerabilities deserve attention even when targeted attacks and hacktivism dominate headlines. The conference discussion treated embedded security as an important area whose findings could easily be overlooked because more visible threats attracted a disproportionate share of public attention.
• User choice creates security and business implications when increasingly fine-grained decisions are pushed to individuals. The agenda questions whether users can be helped effectively, what organizations should do for them, and whether technology itself can provide an adequate solution.

Questions & Answers

Q: Why should security teams revisit old assumptions?

Security teams should revisit old assumptions because advice depends on the environment in which it was created. A practice may have been sensible under earlier conditions but become ineffective or harmful after technology and behavior change. The steering-wheel example illustrates this clearly: the recommended hand position changed after airbags became widespread. Security habits need the same kind of reassessment through sound risk assessment and risk management.

Q: Why are biographical questions weak for password resets?

Biographical questions are weaker because facts that once seemed known only to close contacts are now discoverable from a distance. People publish personal details through social networks and blogs, while friends or relatives may disclose additional information. Public records that were always available have also become digitized and searchable. These changes erode the usefulness of childhood streets, family occupations, and similar facts as password-reset evidence.

Q: How can percentage increases misrepresent security risk?

A percentage increase can sound alarming without showing whether the underlying event is common or consequential. The presentation uses worldwide shark attacks, which increased from sixty-three to seventy-nine, or twenty-five percent. Although the percentage was substantial, attacks remained extremely rare. Security professionals should therefore examine the baseline, practical impact, and causes before treating a numerical change as evidence of a serious increase in risk.

Q: Why can scarce security metrics lead to poor decisions?

Scarce security metrics can lead practitioners to place excessive confidence in the few measurements they possess. A measured change may be statistically correct but still lack practical importance, especially when it concerns a rare event. The shark-attack example shows how headlines can emphasize a twenty-five percent increase while obscuring the low baseline. Security decisions require context, consequences, and careful risk assessment, not numbers alone.

Q: What security topics stood out at RSA Conference 2012?

The highlighted topics included advanced persistent threats, targeted attacks, hacktivism, embedded-device vulnerabilities, mobile security, unstructured data management, and the growing tendency to push fine-grained security choices onto users. The presentation connected these conference themes with the unusually intense security incidents of twenty eleven and used them to consider what organizations could expect during the remaining months of twenty twelve.

Q: What problem did targeted attacks expose in the security industry?

Targeted attacks exposed the industry's weakness in sharing attack information collaboratively. Advanced persistent threats, advanced threats, and targeted attacks received substantial attention during twenty eleven, especially in the technology press. Their significance was not limited to the attacks themselves. They also revealed a core organizational problem: companies and security professionals were not sufficiently effective at exchanging information that could help others understand attacks.

Q: Why are embedded-device vulnerabilities easy to overlook?

Embedded-device vulnerabilities are easy to overlook because advanced persistent threats and hacktivism generated more prominent headlines during the period discussed. The presentation nevertheless identifies embedded security findings as interesting and important enough to deserve separate attention. This contrast demonstrates that headline visibility is not a complete measure of risk and that security reviews should include less publicized technical areas alongside widely discussed attack categories.

Q: What does increasing user choice mean for security?

Increasing user choice means that more fine-grained security decisions are being transferred to individual users. The presentation treats this as an important trend with consequences for both security and business operations. It raises several practical questions: whether users can be helped, what organizations should do to support them, and whether the underlying problem can be addressed adequately through a technology-based solution.

Summary & Key Takeaways

• Security guidance can become outdated when its surrounding environment changes. The shift in steering-wheel recommendations after airbags became widespread illustrates the principle. Likewise, biographical questions once worked for password resets because personal facts were difficult to obtain, but social networks, blogs, digitized records, friends, and relatives have made people more knowable remotely.

• Risk decisions require context rather than reactions to dramatic statistics. Worldwide shark attacks rose from sixty-three to seventy-nine, a twenty-five percent increase, but remained extremely rare. The example shows how headlines can magnify a numerical change without conveying practical impact, a problem that also affects information security when reliable measurements remain scarce.

• The security discussion reviews major concerns from twenty eleven and expectations for twenty twelve. Its agenda includes advanced persistent threats, hacktivism, embedded-device vulnerabilities, targeted attacks, unstructured data management, mobile security, and user choice. The central forecast is that security professionals must revisit inherited assumptions through disciplined risk assessment and risk management practices.