Predictions for cyber security in 2016

Dear readers,
TEAM:
Editor-in-Chief:
Joanna Kretowicz
joanna.kretowicz@eforensicsmag.com
Editors:
Marta Sienicka
sienicka.marta@hakin9.com
Marta Strzelec
marta.strzelec@eforensicsmag.com
Marta Ziemianowicz
marta.ziemianowicz@eforensicamag.com
Senior Consultant/Publisher:
Paweł Marciniak
CEO:
Joanna Kretowicz
joanna.kretowicz@eforensicsmag.com
Marketing Director:
Joanna Kretowicz
joanna.kretowicz@eforensicsmag.com
DTP:
Marta Strzelec
marta.strzelec@eforensicsmag.com
Cover design:
Marta Sienicka
sienicka.marta@hakin9.org
Art used on the cover by Jack Moreh
Publisher
Software Press Sp. z o.o.
02-676 Warszawa
ul. Postępu 17D
Phone: 1 917 338 3631
www.eforensicsmag.com
www.hakin9.org
All trademarks, trade names, or logos
mentioned or used are the property of
their respective owners.
The techniques described in our articles
may only be used in private, local networks. The editors hold no responsibility
for misuse of the presented techniques or
consequent data loss.
We are approaching the end of the year, so it is time to think
about the future and the year ahead. We are pleased to present
you our very special project created by joint forces of eForensics
and Hakin9 Magazines – “Predictions for cyber security in 2016”.
This special edition was based on interviews with representatives
of companies that had agreed to participate in our project.
We would like to give our most sincere thanks to all the participants of this project. You made this possible and without you
we wouldn’t be able to make this unique edition.
Additional and very special thanks to the Proofreaders who
helped with this issue. Your involvement and support of the
creation of this magazine is invaluable. Thank you.
The cyber security field is evolving at a rapid pace, constantly
changing and influencing our lives unnoticed. Will year 2016
be revolutionary for cyber security? How will recruitment in IT
change, what new threats will appear in the new year, will
Internet of Things influence cyber community? In search of
answers to these questions, our guests went on an unexpected
journey through thirteen different sections. Armed only with their
own experience, they confront the most difficult questions
tormenting experts on cyber security.
Do you want to find out if they succeeded? Uncover secrets
of cyber security and prepare yourself to face new year! Read our
new issue and get all the answers you were looking for!
As this is our last issue in 2015, we would like to thank all of our
readers for their continuous support for both our projects.
Without you we wouldn’t be here, doing all this amazing work to
bring you the best content we can. We hope we will be able to be
even better in 2016, and with that we wish you all the best in the
coming year.
Thank you for all the support.
eForensics and Hakin9 Teams
t
able of contents
Page
Section
Questions
6
Top 2015 events
 What were the most important things that happened this year?
14
Recruitment
 What will change in the talent pool?
 Will talent shortage in the industry continue to grow?
 What new challenges will recruiters have to face in 2016?
 What new challenges will people looking for work in cyber security have to face?
29
Training
 What role will formal education play in 2016?
 Will certification keep its role as the main tool to confirm skill and expertise?
 Will we see a more unified standardization of education and skills?
 Will online courses influence the level of education in security field?
40
Threats
 What threats that emerged in 2015 will remain relevant in the next year?
 Which threat group will see the biggest growth in 2016?
 Can you see any old and forgotten threat coming back in the next year?
 Will threat landscape be affected by international efforts to combat terrorism?
 Will cyber security in healthcare remain a relevant topic?
 Will security in automotive industry keep on causing trouble?
63
Mobile
 Which mobile phone will be the most secure one?
 What kind of vulnerabilities will affect mobile phones in 2016?
 What security measures we should use to protect our mobile phones in the next
year?
 What risks will mobile industry face in 2016?
76
Internet of Things
 Will IoT force the industry to change?
 What kind of challenges will IoT face in the next year?
 How will IoT influence cyber community?
 Will we see the security for IoT emerging along new IoT solutions, or will we have
to wait?
91
Tools of the trade
 How will tools evolve in 2016?
 Will the trend to eliminate passwords continue?
 What new technology will make an impact on cyber security the most?
 What new trends will we see on threat intelligence?
www.hakin9.org
www.eforensicsmag.com
t
able of contents
Page
Section
100
Areas of security
Questions
 What are your predictions for network security in 2016?
 What are your predictions for software security in 2016?
 What are your predictions for hardware security in 2016?
 What are your predictions for cloud security in 2016?
109
Industry
 Will 2016 belong to start-ups or big cyber security corporations?
 Will cyber security events remain an important part of influencing the deve-
lopment of cyber community and companies?
 Will we see more state-level cooperation in 2016?
 In which industry will we observe the biggest demand for cyber security services?
 What do you think will change in the cyber security market in your country?
122
Cyber security awareness
 Will the cyber community influence the level of cyber security awareness?
 How can we work towards improving cyber security awareness in 2016?
 What obstacle in awareness will remain unsolved?
 What role will awareness play in corporate cyber security?
133
Miscellaneous
 Predictions for cybersecurity
140
Advice
 What advice would you give to fellow cybersecurity professionals going into 2016?
143
Contributing companies
www.hakin9.org
www.eforensicsmag.com
C
YBERSECURITY
2015 TOP EVENTS
What were the most important things
that happened this year?
Wade Johansen, CouriTech LLC: C&C Botnets go public - DorkBot and the like have become a business model; they cost only $50 to buy in • The Anthem and EBay hacks - along with Target, Home Depot, JP Morgan,
etc. • The implementation of private peer-to-peer social networking clouds with unbreakable encryption •
TOR has 5% or more of the exit nodes hacked and infiltrated by the NSA • VTechs hack - stealing children’s
identities. C`mon ? This will have consequences we can’t even measure yet.
Amit Serper, Cybereason: We’ve been seeing massive data breaches pretty consistently for the past few
years, so really, 2015 was just more of the same. However, if I had to pick specific breaches that stand out,
the ones that come to mind are, first and foremost, the Hacking Team breach • Aside from the irony of a
“surveillance” company getting hacked (and learning how lax their own internal security was), the fact that
State-of-the-Art hacking tools and several Zero Day attacks were released into the wild have and will continue to have long term consequences. One of the Zero Days effectively killed Flash, and of course, having
all these resources available for consumption lowered the (technical) skills bar for potential cyber criminals
to enter into the game • Next comes the Ashley Madison hack - aside from it being one of the highest profile ransomware attacks, it shows the impact that a data breach can have on people's lives - suicides occurred, jobs were lost, families and reputations were ruined. Most companies approach cyber security
from a cost-benefit perspective - is it cheaper to fix the security problem or deal with the fallout from it? In
this case, how do you quantify the damage done to Ashley Madison customers? Is that something you can
even attach a number to?
Mark Bennet, Blustor: The U.S. Office of Personnel Management (OPM) lost nearly 5.6 million fingerprint
records in a cyber security attack in 2015. While this event went largely unnoticed by the general public, it
highlighted the tremendous risks associated with biometric security when an individual’s biometric templates are not properly protected. For the unfortunate employees impacted by this incident, they can never replace their fingerprints • Just recently reaching the awareness of the mainstream media, hospitals and
medical device manufacturers are being shown to be woefully unprepared. A recent article in Bloomberg
Business, entitled “It’s Way Too Easy to Hack the Hospital”, is one of many articles emerging in recent
months that tells a rather bleak and frightening story related to the vulnerability of medical devices to remote hacking. It is clear that there is a high potential for catastrophic incidences that are likely to result in
serious injury as well as large scale identity theft.
Paul Shomo, Guidance Software: RATs Ran Rampant: (Remote Access Trojans) evolved and proliferated to
the point that they were seen in forensic investigations of some of the most high-profile hacks of the year,
including the Office of Personnel Management (OPM).
www.hakin9.org
www.eforensicsmag.com
-6-
C
YBERSECURITY
2015 TOP EVENTS
What were the most important things
that happened this year?
Leon Kuperman, Zenedge: 2015 RSA Conference where we introduced ZENEDGE to the world •
www.newbingobilly.ag - longest running DDOS campaign that we are aware of, lasting for almost one year;
the attacker has failed at bringing down the site but continues to try on almost a daily basis • ZENEDGE introduces RapidBGP, which allows for sub 60-second DDOS mitigation in the cloud for network protection •
ZENEDGE launches Toronto Mitigation center, the first large scale mitigation center in Canada for customer
adoption • Complex multi-vector attack by Armada Collective, hitting many companies with DDoS for ransom Bitcoin. Our customer was hit with seven attacks in a one day period in Q4, key shopping season including: Chargen, UDP Flood, SSDP Amplification, NTP Amplification and Layer 7 application attacks. We
have now seen Armada Collective on five separate occasions.
Shay Zandani, Cytegic: The OPM breach – because of the consequences to its management and the fact
that it was a direct and public hit on a government entity • Anthem Breach (alongside Premera and BlueCross Blue-Shield) – because of the scale of the attack and how it emphasized the forecasted trend of PII
and medical data theft • Ashley Madison Breach – because it is perhaps the most significant internal
breach since Snowden – it emphasized the importance of the internal threat • The “Cyber-War” between
Iran and Saudi-Arabia over Yemen – because it showed very clearly the correlation between physical wars
and cyber wars, and the mobilization of hackers to support their governments • The US Military Kills the
ISIS Hacker and Recruiter that Attacked Them – because it emphasized the fact that cyber-warriors are valid targets for physical attacks and that they are an integral part of the war.
Mitchell Bezzina, Guidance Software: The Human Perimeter Remained Too Permeable: Human error opens
more doors to hackers than technical shortcomings. Whether clicking on a phishing email, failing to install
security patches on a regular basis, or leaving a laptop with patient healthcare records in a place where it
can be easily stolen, humans regularly hand over the keys to the data kingdom—or leave them lying
around where they can be readily obtained • Following suit is Australia, releasing a draft of the Privacy
Amendment (Notification of Serious Data Breaches) Bill 2015 in December that affects any domestic or foreign organization that deals directly with Australian consumers
Richard De Vere, The AntiSocial Engineer: The TalkTalk Breach! (and discovering it) helped place cyber security on the radar for the average person. Infosec left the boardrooms and had free reign of the TV • Old
issues making a comeback - Crossdomain Abuse, SQLi • BSIDES in London was my favourite event/con •
Software - The release of Kali 2.0 hasn’t changed the world but it’s nice to see the GUI updates • SETOOLKIT - Mr Robot Edition (In fact, Mr Robot was the highlight of my year).
www.hakin9.org
www.eforensicsmag.com
-7-
C
YBERSECURITY
2015 TOP EVENTS
What were the most important things
that happened this year?
Irfan Shakeel, EH Academy: Helped more
than 3000 people to become effective computer forensics examiners; training, certification and relationship with the industry have
been provided to them.
Rajeev Chauhan, Cyber Oxen: Sony Hack and
Retaliation • OPG Hack • Cryptolocker malware • Identity Theft • Cyber Espionage.
Dennis Chow, Millar, Inc : Blue Cross Blue
Shield Anthem Data Breach • New Cyber
Threat Intelligence initiatives • WITCHCOVEN Campaign • Remote Jeep Hack • FTC enforcement of Cyber Security to companies.
Francisco Amato, Infobyte: ekoparty •
troopers • kiwicon • shakacon • chaos communication congress.
Nick Prescot, ZeroDayLab: Talk Talk breach –
an obvious choice, but perhaps more than
any other • Safe Harbour re-alignment • EU
General Data Protection Regulation • Ashley
Madison (mainly for the impact) • Sony Pictures.
BroadTech Security Team: A bit difficult to
limit to five. Google Deceptively Tracks Students’ Internet Browsing • Pentagon Cyber
Attack • Kaspersky Security Breach • Hacking
Team Breach • $1 Billion theft from banks •
Ship Data Records Vulnerability • Kaspersky,
McAfee, AVG vulnerabilities • Industrial System Control Gateway vulnerabilities.
David Clarke, VCiso: Talk Talk Breach • Ransomware • School Breaches • Mobile Vulnerabilities • Mobile Security.
Stephan Conradin: Theft of sensitive data •
Privacy concerns with Windows 10.
Amber Schroader, Paraben Corporation: EnFuse 2016 • PFIC 2016 • Techno • HTCIA
2016.
Przemek (Shem) Radzikowski, Secbüro: Labs:
Ashley Madison Hack • Black Hat USA • First
400+ Gbps NTP reflection DDoS attack •
APT28 • TalkTalk hack by 15yo.
www.hakin9.org
Paul Hoffman, Logical Operations: Two Steps
Ahead - Rochester. December 8th, 2015 •
ISSA Conference, October 2015 • Dispelled
Rumor of MAC OS being safe, as it accounted for the largest proportion of vulnerabilities in first quarter 2015 • The State Dept. is
breached by Russian hackers.
www.eforensicsmag.com
-8-
C
YBERSECURITY
2015 TOP EVENTS
What were the most important things
that happened this year?
Roberto Langdon, Nicolas Orlandini, KPMG: As part of our Security Services to customers, we were dealing
with networks with unappropriated protection, the Internet of Things is leaving really black holes in the
information management and information gathering, people working so far from the existing standards
such as ISO 27001 and ISO 27002 mainly, and the lack of security awareness implemented as a continuous
process inside the organizations. Most of them are still reactive instead of being preventive. And most of
them know nothing about ISO 270037 • Technology considerably helped the business and mainly the users
interacting with it, and as one of the key issues is privacy, it is almost more frequent to find ethics codes
violation and frauds carried out by people who understand that the digital equipment that they use can
“protect” them against these types of investigations. Neither workstations nor smartphones are outside
the scope of investigations, and they have key valuable information. • Increase in amount and depth of
data breaches • Dark web, Mobile forensic, data encryption and IoT as challenges for forensic teams •
Cloud data collections • Black-Hat 2015 Las Vegas • Lack of Cyber Security/Cyber Forensic Investigators
personnel.
Craig McDonald, MailGuard: Anthem. In March, this health insurance company suffered an attack that
compromised 78.8 million customers’ records from December 2014 onwards. Data affected: names, dates
of birth, Social Security numbers, health care ID numbers, home addresses, email addresses, and employment information, including income data. The data was not encrypted, according to reports • Although
smaller than the Anthem attack, the attack on 21.5 million records in the database of the US Office of Personnel Management (OPM) is significant because of the type of data accessed – personal information,
background checks, names and addresses and a million fingerprints of US Government employees. It is believed that Chinese hackers were responsible • UK telecom company, TalkTalk, suffered an attack that compromised four million records, estimated to be the seventh largest attack (to September 2015), apparently
through a third party call centre in India • Australian Bureau of Meteorology breach reported publicly in
December this year. There is no clear picture yet how much the breach will cost to fix or how long it will
take – but insiders estimate years and hundreds of millions of dollars. And the critical nature of the bureau's services means its systems cannot be switched off for repair.
Michael A. Goedeker, Auxilium Cyber Security: OPM Breach • DEASH (ISIL-whatever) using social media for
targeting soldiers • Ukraine Hacks (our story on the „Fire Sale” hack) • The fight for balancing surveillance
and privacy • The Beginning of IoT as mainstream (and additional security holes and lack of it) • Increasing
vulnerabilities and attacks on global and national critical infrastructure
www.hakin9.org
www.eforensicsmag.com
-9-
C
YBERSECURITY
2015 TOP EVENTS
What were the most important things
that happened this year?
Rick Blaisdell: Kaspersky Lab revealed in June that it had discovered an infiltration in several of its internal
systems. The attack, also named Duqu 2.0, was believed to be a nation-state-sponsored attack, whose other victims included events and venues with links to world power meetings, including negotiations for an
Iran nuclear deal. The Moscow-based security vendor said the compromise included information on the
company's newest technologies, such as Kaspersky’s Secure Operating System, Kaspersky Fraud Prevention, Kaspersky Security Network and Anti-APT solutions and services • LastPass got hacked - LastPass is a
very well known provider of cloud-based single sign-on and password manager. Enterprise administrators
around the globe use it to manage and secure passwords across their infrastructure. However, in June,
LastPass CEO Joe Siegrist admitted in a blog post that a network compromise resulted in the theft of customer email addresses and password reminders. Even though the passwords were encrypted, and there
was no evidence of customer data being exposed, LastPass required all customers to change their master
passwords the next time they logged in • Pentagon failed to offer small firms cyber security resources - The
US Department of Defense (DOD)’s Office of Small Business Programs (OSBP) has failed to offer cyber security options to protect the companies it does business with, according to a report from the US Government
Accountability Office (GAO). Small businesses, including those that conduct business with DOD, are vulnerable to cyber threats and may have fewer resources, such as robust cyber security systems, than larger
businesses to counter cyber threats • The breach at Harvard University, following in the footsteps of eight
other education breaches this year, highlighted growing security concerns around the higher-education
market. The breach affected as many as eight schools and administrative offices, though it remains unclear
what information was accessed by the hackers • When it comes to the health-care industry, health insurer
Anthem revealed a breach in February that exposed an astonishing 80 million patient and employee records. Anthem said the breach occurred over several weeks, beginning in December 2014, and could have
exposed names, date of birth, Social Security numbers, health-care ID numbers, home addresses, email
addresses, employment information, income data and more. It said it did not believe banking information
was taken. The Wall Street Journal reported that Anthem had not encrypted the data that was accessed by
hackers.
Kenneth C. Citarella, Guidepost Solutions: In no particular order, we cite these as the most significant cyber
security events in 2015: The Office of Personnel Management intrusion • Cyber security talks between the
U.S. and China, including China’s arrest of several men alleged to have intruded into U.S.-based systems at
the request of the U.S. government • The Third Circuit Court of Appeals upholding the authority of the Federal Trade Commission to sue over cyber security failures under its consumer protection powers. A company may be engaged in an unfair trade practice if it does not live up to its cyber security promises • The beginning of regulatory efforts to mandate cyber security standards in certain industries • Known weaknesses
and poor security habits continue to be major attack vectors.
www.hakin9.org
www.eforensicsmag.com
- 10 -
C
YBERSECURITY
2015 TOP EVENTS
What were the most important things
that happened this year?
Anthony Di Bello, Guidance Software: Breaches Abounded: Almost 90 million healthcare records were
breached causing $272 million worth of losses to leading United States healthcare organizations. The lesson learned is that healthcare records are extremely valuable to cybercriminals • Emergence of Endpoint
Detection and Response (EDR) security technology category — while technologies focused on providing
security visibility and incident response capabilities for endpoint have existed for some time, 2015 marked
a critical mass in both the need for and emergence of several start-up technologies focused on these capabilities. These vendors span established EDR players, such as Guidance Software, legacy security vendors
coming into the space through acquisition, such as Palo Alto, and start up technologies, such as Cylance.
These offerings fill a critical gap at the endpoint left by older technologies, such as anti-virus and hostbased IPS • Data Notification Requirements – The US Government began the first steps in creating one Federal breach notification law with the Data Security and Breach Notification Act of 2015 which received both
public backing and some initial opposition. The US is not alone, the EU Council found common ground with
Members of the European Parliament and put an end to fragmented requirements for minimum security
measures and breach notification requirements across critical service organizations in resources, transport,
finance, and health. This comes after the heavily publicized advancements in the EU General Data Protection Regulation to enhance data protection rights of EU consumers for any organization, worldwide, storing
personal data.
David Coallier, Barricade: VTech's data leak • Ashley Madison's data leak • The iCloud leak • The rise of the
internet of things and the internet of vulnerabilities • Ransomware and boot kits.
There were plenty more very important leaks, during this last year. What we find interesting is most of the
attacks fall into common categories, such as people still using insecure passwords and executives that do
not understand the current technological landscape.
The rise of ransomware and their exponential growth is interesting as it allows us to witness the evolution
of computer viruses and criminal groups in near real-time. A new player in town, the boot kit, is promising
an interesting turn of events for 2016 • Meanwhile, the Internet of Things is left very vulnerable because
efficiency and simplicity of use took priority over security, leaving a lot of early and late majority of the tech
adopters at risk. The so-called advanced persistent threat is still the industry's poster child and as statesponsored attacks and cyber-espionage grows, we'll probably keep hearing a lot about APT in the next year
alongside it's lack of security workforce.
www.hakin9.org
www.eforensicsmag.com
- 11 -
C
YBERSECURITY
2015 TOP EVENTS
What were the most important things
that happened this year?
Wade Lovell, Simpatic: Revenge Porn – Hunter Moore “who operated the Internet’s best-known ‘revenge
porn’ website was sentenced to 30 months in federal prison for hiring another man to hack into e-mail accounts to steal nude photos that were later posted on his website.” This seems a little like sentencing Al
Capone on tax evasion charges, satisfying but incomplete link • Angler is an extremely capable and readily
available exploit kit used by criminals to run choice cuts of the latest Flash, Java, and browser exploits targeting un-patched users. Hackers add exploit kit to article asking 'Is cyber crime out of control? “Hackers
have hosed an article published by The Guardian using the world's nastiest exploit kit Angler to pop the
machines of exposed readers. The attack firmly answers the article's headline, positing the question 'is cybercrime out of control', based on arguments in a book by one Misha Glenny.” link • VTech Breach – accounts of 2.9 million kids hacked. This is the type of hack no one seems to talk about because it doesn’t
directly involve credit card and social security numbers • Georgia’s Secretary of State released confidential
information to a dozen entities on 6 million Georgia voters, including driver’s license information, Social
Security numbers and dates of birth, and didn’t notify anyone, according to a lawsuit. “The Georgia Secretary of State, Brian Kemp’s office is being sued by two Georgia women who claim that the Secretary's office
released personal information that involves 6 million Georgia voters. Mr. Kemp’s office has communicated
that … due to what they are calling a "clerical" error, individual voters personal information was included in
these files… According to the lawsuit, Mr. Kemp’s office never notified individuals regarding the breach,
nor did they contact the consumer reporting agencies.” link • Organized Criminal Hackers stealing $1 billion
directly from banks. “… a gang of international hackers have stolen as much as $1 billion from 100 banks
across 30 countries by installing malware that allowed them to take control of the banks' internal operations link.
Gerald Peng, Mocato: Anonymous taking down ISIS social media profiles, November - December 2015 •
Ashley Madison hack, July - August 2015 • In June 2015, US Office of Personnel Management (OPM) discovered that the background investigation records of current, former, and prospective Federal employees and
contractors had been stolen. OPM and the interagency incident response team have concluded with high
confidence that sensitive information, including the Social Security Numbers (SSNs) of 21.5 million individuals, was stolen from the background investigation databases • Stagefright Bug (all versions) for Android
phones, July 2015 • International Conference on Cybersecurity, January 5 - 8, 2015, New York City, NY,
United States.
www.hakin9.org
www.eforensicsmag.com
- 12 -
W
HO IS
WHO
Amit Serper
Cybereason Lead Mac OS X security
researcher
Michael A. Goedeker
Auxilium Cyber Security
CEO and Founder
Amit is an Information security researcher specializing in embedded
Linux devices. His role at Cybereason is to develop novel methodologies for identifying complex hacking operations. For over a decade
he led security projects for a
government agency in Israel, specializing in the security of embedded systems. Amit is known as for
his "out of the box" thinking and is
renown for his shell popping abilities on embedded devices such as
routers, IP cameras and even home
irrigation systems. He has won
several Blackhat pen-testing challenges.
I am passionate about technology,
teaching and people! My interests,
passion and research includes:
Cyber Security, Operations, Leadership and Training up to DoD/Mil
level (includes every aspect of IT).
Author and researcher at the front
end of Cyber Warfare, Espionage
and Crime, researching in Academia, Press and Security Professionals Globally. Entrepreneur with
solid operations and financial background. Easy to work with, people
person that sees talent, develops it
and can establish rapport with almost anyone.
Irfan Shakeel
EH Academy
CEO and Founder
The founder & CEO of ehacking
group. An engineer, penetration
tester and a security researcher.
He specializes in Network, VoIP
Penetration testing and digital forensics. With more than 7 years of
professional work experience, he is
creating new Infosec ventures and
businesses around the globe.
Richard De Vere
The AntiSocial Engineer Ltd,
Principal Consultant
Richard is the Principal Consultant for The AntiSocial
Engineer Ltd, has an extensive background in penetration testing and social engineering, including
„red team” exercises and information gathering assessments.
www.eforensicsmag.com
www.hakin9.org
- 13 -
R
ECRUITMENT
What will change in the talent pool?
Richard De Vere,The AntiSocial Engineer:
As more and more people fill the shortage
we have across the world for well trained
and experienced security vendors and
testers, we will start to see the number of
inexperienced testers rise.
Kris Rides, Tiro Security: I think we will see
larger companies moving internally / hiring people in alternative IT positions and
cross training them into Security. So
expect to see hiring of Infrastructure and
Development staff to increase further.
Michael A. Goedeker, Auxilium Cyber Security: Skills needed and the way we look
for people for „cyber” security space. Cyber security is dynamic, so we are looking
for people that can think outside the box
and make complex things simple.
Chase Cunningham, Cynja: Unfortunately,
nothing. There will continue to be a vast
lack of resources with respect to real cyber security operations personnel. This
will continue for at least the next five years, probably much longer.
That’s why it’s important to encourage
kids to be safe online and learn about
technology. My hope is that if we start
inspiring kids to join us in fighting the criminals online, that shortage will be nonexistent by the time our kids move out of
the house. Looking 20 years down the
road, if one person says to me they chose
cybersecurity as a profession because of
me, then mission accomplished.
Elizabeth Houser, Praesidio: As more people become aware of the ongoing trends
in cybersecurity and the increasing
opportunities the industry offers, we’ll see
an uptick in people desiring a career shift.
This will especially become noticeable as
expansion of the IoT requires input from
experts in other fields.
Dennis Chow, Millar, Inc: There will be
increased requirements for new skills to
help defend against modern attackers.
Certifications and skills considered
‘advanced’ now will soon become standard in the future, such as malware reverse engineering and exploit creation capabilities.
Wade Johansen, CouriTech LLC: Virtualization skills and multitasking abilities are
(and will continue to be) a „must-have”
talent. The days of specialization in one
service domain alone seem to be rapidly
coming to an end. Mobile device management and maintenance is also a skill every
tech should start getting familiar with.
www.eforensicsmag.com
www.hakin9.org
- 14 -
R
ECRUITMENT
What will change in the talent pool?
Rick Blaisdell: The increasing volume and
detail of information captured by enterprises, the rise of multimedia, social media, and the Internet of Things will fuel
exponential growth in data for the foreseeable future. At the same time, the rising
demand for data scientists and the resulting pressure on the analytics labor market is increasing the need for analytics
talent as more companies with more data
to sift through discover they are trying to
hire the same workers.
Roberto Langdon, Nicolas Orlandini,
KPMG: There is a shortage of professionals who can meet the specific requirements to be an investigator. This will
require professional knowledge about
networking, security, IT infrastructure,
plus “life” experience. And all of the
above, under strictest ethical codes and
confidentiality. A forensic investigator
must be hungry for investigation.
In order to build qualified professionals, it
is required to make more disclosures and
training courses to motivate the IT security professionals to enter in this amazing
world.
Mayur Agnihotri: Talent pool constrained
on cyber security recruitment as cyber
security (Information Security) budgets
expand
rapidly.
“Cyber
security
(Information Security) industry is facing a
new threat: hiring” - Worldwide situation.
Company
faces
cyber
security
(information security) talent costs more
than other IT positions.
Przemek (Shem) Radzikowski, Secbüro
Labs: Given the immediate requirement
for cyber security professionals, many
people will try to reskill and transfer from
their existing professions to fill the gap.
Julie Herold, Kenny Herold-Odin’s Eye:
Colleges are recognizing the value of IT
Security Professionals; eventually we will
see a drastic increase in the number of
qualified personnel. Although there is a
strong belief that acclimation to this type
of profession in the field, it is worrisome
at best.
Andrew Bagrin, My Digital Shield: There is
already a lot of very average security talent in the industry and very few great
talent. We are running this industry somewhat handicapped. I predict it will only
get worse as more talent is desperately
needed and great talent is very hard to
find.
www.eforensicsmag.com
www.hakin9.org
- 15 -
R
ECRUITMENT
What will change in the talent pool?
Paul Hoffman, Logical Operations: As breaches get more serious, companies will
start to pay more for skilled people.
Paul Shomo, Guidance Software: Talent
availability will increase, but be outweighed by demand. Closely related careers,
like computer forensic examiners and network specialists, will seek opportunities
in Security as methodology, concepts and
practices are closely related, however,
they will require in-depth training and
time to gather experience. We’ve seen
this in other high velocity emerging markets and cyber security is still three to six
years away from having a “normal” ratio
of availability vs demand.
Wade Lovell, Simpatic: Some undergraduate programs have picked up the baton
and are offering an emphasis in cyber security. As students matriculate from these
programs, the talent pool will increase at
a pace slightly ahead of the churn rate.
Mitchell Bezzina, Guidance Software: Information security leaders will begin to
see a new generation of fully mobile workers coming into the workplace who have
an instinctive understanding of privacy
issues because of social-media hacks and
problems they’ve all encountered, but
who are not used to being restricted in
their practices within large organizations.
Dotan Bar Noy, Re-Sec Technologies: Cybersecurity workforce shortage is expected to reach 1.5 million by 2019 according
to Michael Brown, Symantec CEO. While
the growth in the need for talented
experts in all sectors will drive an increase
in professionals in the long run, we are
still going to struggle in the next few years.
Einaras Gravrock, Cujo: The demand will
continue to outstretch the supply. An increasing number of IT specialists will repurpose themselves to fit the demand.
Amit Serper, Cybereason: In 2016, the
shortage of skilled security pros will result
in a more diverse workforce.
David Clarke, VCiso: Audit will take a higher priority as more and more cyber services are outsourced.
BroadTech Security Team: More people
are going to go after certification rather
than acquiring necessary knowledge and
skill in hyped up technologies, especially.
www.eforensicsmag.com
www.hakin9.org
- 16 -
R
ECRUITMENT
What will change in the talent pool?
Anthony Di Bello, Guidance Software:
Vendors and industry experts need to
support the efforts of universities to create and deliver the required curriculum for
success in the ever-changing information
security landscape. Through the provisioning of software, assistance in curriculum
development, and support through industry events and competitions the community can give back, and help create the
next generation of infosec pros.
Ondrej Krehel, LIFARS: More talented
people, as well as people going for the
name. Overall, I see a dilution in talent as
companies do not want to spend money
on good resources.
Stephan Conradin: Security becomes more complex because business and technologies change very fast, so real talent pool
will become shorter.
Nick Prescot, ZeroDayLab: Existing consultants • New consultants will start on a
different track-level, following the new
known trends and identifying others in
the emerging world of Internet of Things.
www.eforensicsmag.com
www.hakin9.org
- 17 -
R
ECRUITMENT
Will talent shortage in the industry
continue to grow?
Michael A. Goedeker, Auxilium Cyber Security: I don’t see a talent shortage, just
prices being ruined by big companies that
overcharge for bad work. This does not
allow smaller companies to earn enough
to attract good people because for some
illogical reason, customers „trust” big names without verifying them (bad for security in general).
Elizabeth Houser, Praesidio: Absolutely.
The field is experiencing the same personnel shortage as the medical industry continues to face. Not only is there limited
space in training programs but disparity
also exists in the quality of these programs. Also, a disconnect remains between what IT managers need and what HR is
requiring in job candidates.
Richard De Vere,The AntiSocial Engineer: I
think for the foreseeable future we will
not meet the demand for information security professionals. The need for these
testers is clearly documented with global
rises in cyber crime but we have been
slow with training, especially in youth sectors.
Kris Rides, Tiro Security: I think we will see
an increase in requirements and if the
industry doesn’t make changes to how it
is currently recruiting, then the shortage
will grow.
Wade Johansen, CouriTech LLC : Yes! Recruitment is starting early because there
aren’t enough coders to go around, so
schools that offer it are seeing benefits for
their students.Unfortunately, there is a
shortage of strong teachers, so this is causing a shortage of classes, and students.
This is the case with a lot of technology
fields and not just coding.
Irfan Shakeel, EH Academy: The shortage
of skillful people will increase, because
the community failed to produce skillful
professionals. Organizations are lacking in
terms of training & development programs. It will have a direct impact on security; we will witness the rise of hacking
attacks.
Dennis Chow, Millar, Inc: Yes, even with
new talent graduating with new Information Security focused degrees; many will
lack the skills and experience that positions are in demand will need.
Einaras Gravrock, Cujo: Yes, absolutely.
Given that inventory is growing by multidigit CAGR, it will take a business cycle for
the supply to meet the new demand.
www.eforensicsmag.com
www.hakin9.org
- 18 -
R
ECRUITMENT
Will talent shortage in the industry
continue to grow?
Francisco Amato, Infobyte: I personally
think that there is always talent floating
around, but companies need to go out
and find talented people in different environments, not just in traditional places.
There are a lot of capable people, but it is
necessary to properly promote and nurture them. One interesting way to find young blood is with competitions or challenges like CTFs, which are done in different
events worldwide. Also, the rise of the
hackerspace movement for me is an ideal
training ground to find people with a lot
of skills. Of course, one of the biggest
things for these kinds of people is keeping
them motivated. If IT sec professionals are
only in it for the money and are not really
passionate about what they are doing,
they probably are going to find it hard to
stand out in an intelligent and talented
industry where you have extremely bright
people (who love what they are doing)
and these passionate people are the ones
that are always going to be a step ahead.
Przemek (Shem) Radzikowski, Secbüro
Labs: For the foreseeable future, the talent shortage will continue to grow for
another two to three years (the average
length of an undergraduate degree). Unfortunately, the ripple effect from the
shortage may persist for a longer period
while professionals gain industry experience.
Mayur Agnihotri: Yes, talent shortage in
the industry continues to grow, demand is
high and supply is low. Companies needs
to attract and retain cyber security talent.
Some elements for attract and retain cyber security talent • Provide training for
staff on emerging technology • Companies
must participate in different events, like
hackathons and open-source community
platforms • Companies must collaborate
with universities / colleges in emerging
technology, as well as cyber security talent.
Anthony Di Bello, Guidance Software: The
talent shortage is expected to grow unless
a top-down effort is made to create and
stimulate interest in information security
fields early on in a student’s education.
Mitchell Bezzina, Guidance Software: Yes,
due to the demand generated by the unusual amount of potential business risk associated with failed cyber security practices, the proliferation of media attention,
and time it takes to train security specialists. The talent shortage will continue
until the emergence of the next generation of qualified cyber security specialists.
David Clarke, VCiso: Yes, almost certainly,
as more and more skills other than cyber
technical skills are required.
www.eforensicsmag.com
www.hakin9.org
- 19 -
R
ECRUITMENT
Will talent shortage in the industry
continue to grow?
Andrew Bagrin, My Digital Shield: Great
talent shortage will, but we will see a
bunch of new people in the industry. There are schools now trying to get people in
the industry.
Stephan Conradin: Of course. More complexity, more needs, fewer people with
wide knowledge.
Amit Serper, Cybereason: Yes, but will be
offset by better and more automated
tools.
Dotan Bar Noy, Re-Sec Technologies: Yes,
in the short term we will still have a talent
shortage, and even more important is
attracting the exceptional experts that are
becoming very rare.
Rick Blaisdell: Unfortunately, yes. More
than 209,000 cybersecurity jobs in the
U.S. are unfilled, and postings are up 74%
over the past five years, according to a
Peninsula Press (a project of the Stanford
University Journalism Program) analysis of
numbers from the Bureau of Labor Statistics. The demand for information security
professionals is expected to grow by 53
percent through 2018. According to
a recent report from the job board Dice,
the demand for the (cybersecurity)
workforce is expected to rise to 6 million
(globally) by 2019, with a projected
shortfall of 1.5 million.
Paul Hoffman, Logical Operations: Yes,
there will be a shortage for three to five
more years, as people are trained in the
industry.
BroadTech Security Team: There will be a
shortage of usable people. Talent alone is
not enough. Skill and Experience are also
needed, which needs time to be acquired.
Technology disruption and information
overload is happening in such a rapid rate
that time needed to understand, assimilate, gain skill and experience is getting
even more limited.
At the same time, according to a 451 Research recent study, based on responses
from more than 1,000 IT professionals,
primarily in North America and EMEA,
security managers reported significant
obstacles in implementing desired security projects due to lack of staff expertise
(34.5%) and inadequate staffing (26.4%).
Given this challenge, only 24% of enterprises have 24×7 monitoring in place using
internal resources.
Ondrej Krehel, LIFARS: I believe so. Until
companies become aware they need talent and reward it, I believe people may
not want to enter the field.
www.eforensicsmag.com
www.hakin9.org
- 20 -
R
ECRUITMENT
Will talent shortage in the industry
continue to grow?
Wade Lovell, Simpatic: Yes, while the talent pool is expanding slightly ahead of
the churn rate, the demand continues to
grow.
Nick Prescot, ZeroDayLab: It depends
what talent you’re looking for. Information Security continues to be both.
www.eforensicsmag.com
www.hakin9.org
- 21 -
R
ECRUITMENT
What new challenges will recruiters
have to face in 2016?
Michael A. Goedeker, Auxilium Cyber Security: Becoming more knowledgeable in
what makes a successful „cyber” security
person. Understanding exactly what the
value of certs and experience is. Paying
the right money for demanded positions
instead of pushing them down.
Kris Rides, Tiro Security: Larger companies
will look to hire more niche candidates as
they break down their teams into further
specialties. This will mean your average
generalist IT agency will find it tougher to
fill these people as they will need to be
focused 100% in this area to build relationships. Medium sized businesses will
continue to have to a lot of competition
with companies for their Security people. They will need to show the kind of
flexibility on job requirements and benefits to really differentiate themselves and
allow recruiters to fill their most urgent
requirements. Recruitment companies
will find it even tougher to supply contractors in Cyber Security. High permanent
salaries and the kind of benefits these
people will be offered, matched with (at
least in the US) the high cost of healthcare
mean the benefits of being a contractor
will no longer be worth the risk.
Richard De Vere, The AntiSocial Engineer:
I think sorting the good from the bad will
be harder than ever over the next year.
Recruiters have to step up their game and
rely more on personal bonds and careful
research of their candidates and not just
point and click recruiting.
Irfan Shakeel, EH Academy: The recruiters
will get confused because of the formal
education, infosec certifications without
any central governance body and the
skills. The recruiters have to develop a
methodology to capture the right candidate based on the skills, rather than a piece of paper.
Wade Johansen, CouriTech LLC: There is a
large pool of jobs and many of them just
don’t pay enough, particularly the
Government sectors. There are not
enough highly skilled workers to meet the
demand and private industry pays far
better. Unfortunately, having a good benefits plan isn’t enough now - workers
want work at home VPN options, higher
salaries and employers that provide ongoing training benefits and perks.
Dennis Chow, Millar, Inc Short: Being able
to distinguish ‘paper certified’ professionals compared to ones with true hands-on
experience that happen to have those
same certifications.
www.eforensicsmag.com
www.hakin9.org
- 22 -
R
ECRUITMENT
What new challenges will recruiters
have to face in 2016?
Chase Cunningham, Cynja: The continued
lack of talent will increase the demand for
real cyber operators and the starting salaries for those individuals will continue to
rise. The men and women who are coming out of the military and intelligence
communities will have their pick of private sector jobs and roles and recruiters will
have to outbid each other to win those
candidates.
Ondrej Krehel, LIFARS: They will have to
deal with larger pools of applicants and
finding talent among them.
Stephan Conradin: First; they should see
and understand this growing complexity.
Second: they have to reintroduce good
sense when finding talent, not only check
for some words in CV.
Amit Serper, Cybereason: Having to find
the right soft skills, which will be just as
important as the right technical skills.
Paul Hoffman, Logical Operations: Differentiating between actually skilled workers and ones with puffed-up resumes,
but they may not care as anyone willing to
fight cyber attackers is better than no one.
Rajeev Chauhan: The vanishing line between ethical and unethical behavior in
the infosec community will be a matter of
growing concern.
Wade Lovell, Simpatic: A growing percentage of entrants into the security talent
pool will have absolutely no relevant job
experience.
Mayur Agnihotri : Nothing new recruiters
fail to attract and retain cyber security
talent.
Andrew Bagrin, My Digital Shield: Separating the true talent from the rest.
Przemek (Shem) Radzikowski, Secbüro
Labs: Recruiters will find it tough to sift
through a torrent of opportunistic but
relatively unskilled candidates who want
to jump aboard the rise in pay commanded by quality security experts.
Nick Prescot, ZeroDayLab: Availability of
experienced consultants because none of
them are available.
www.eforensicsmag.com
www.hakin9.org
- 23 -
R
ECRUITMENT
What new challenges will recruiters
have to face in 2016?
Anthony Di Bello, Guidance Software: A
lack of practical experience. While education certainly provides an understanding
of systems and how to secure them, all
bets are off when they experience their
first live cyber-attack.
Dotan Bar Noy, Re-Sec Technologies:
Costs of talents will continue to increase
as demand is high and companies are recruiting less experienced talents and will
need to invest in training etc. According to
a recent report from DICE, a leading IT job
board, the top five IT security salaries are:
No. 1 – lead software security engineer at
$233,333; No. 2 – chief security officer at
$225,000; No. 3 – global information security director at $200,000; No. 4 – chief
information security officer at $192,500;
and No. 5 – director of security at
$178,333.
Mitchell Bezzina, Guidance Software: Those looking to place experienced cyber security specialists will find it difficult moving an individual into a new organization
with career development or ancillary benefits being part of the decision process.
It may well be easier to relocate teams
who have an understanding of each other
and efficient workflows. When looking to
place candidates transitioning into cybersecurity as a solution to talent shortage, a
more rigorous culling process will need to
be defined to ensure there is a great
rapport between manager and the new
candidate, this ensures a faster, more successful transition.
BroadTech Security Team: I cannot say for
large companies. Startups like ours take
freshers guide and train them.
David Clarke, VCiso: Recruitment is a vulnerable 3rd party and they will need to
apply cyber standards, as well as find the
appropriate resources.
Elizabeth Houser, Praesidio: The realities
of the field versus how popular culture
continues to influence the perception of
cybersecurity will continue to be an issue.
CSI:Cyber isn’t likely to have the same
impact on job candidates to the extent
the CSI effect has impacted average citizens but there will be a definite ripple,
regardless of size.
Rick Blaisdell: The need for more cyberworkers also explains why info security is
considered one of the best jobs out there
- for the next seven years. U.S. News and
World Report ranked a career in information security analysis eighth on its list of
the 100 best jobs for 2015. They state the
profession is growing at a rate of 36.5 percent through 2022.
www.eforensicsmag.com
www.hakin9.org
- 24 -
R
ECRUITMENT
What new challenges will people looking
for work in cyber security have to face?
Michael A. Goedeker, Auxilium Cyber Security: Payment expectations vs. reality.
Either you get more money working for a
big company that likely uses you up, or
you work for a startup and gain experience and knowledge to grow. Become lifelong learners or look for another job.
Przemek (Shem) Radzikowski, Secbüro
Labs: There is no substitute for experience. Be prepared to work hard and learn
fast because the security ecosystem is
changing far more quickly than other sectors.
Kris Rides, Tiro Security: It will still be
tough to stand out from the crowd, adverts will attract the masses meaning a
good quality experienced candidates resume will be in the middle of a pile of people trying to move into cyber security.
Expect to see plenty of counter offers, it’s
not a new challenge but there will be a
distinct rise so it’s important to ensure
you have tried your utmost to get the
changes you require in your current job
before you start your search. If it takes
you to get another job before they give
you what you are looking for, you are
working for the wrong company.
It will also be important for candidates to
weigh all the benefits of job offers, expect
to see some good salary increases but
remember, there is a lot more to a job
than that. As Richard Branson was recently quoted, “Time is the new money.”
Richard De Vere,The AntiSocial Engineer:
People new to the industry or people looking to find that new role will have to
strengthen their knowledge of computing
in general and not rely so heavily on automated tools.
Irfan Shakeel, EH Academy: The hiring
criteria, people are more likely to get confused and they will focus on gaining the
certifications rather studying and practicing. This will get them hired but at the
end, the organization will suffer the consequences.
Amit Serper, Cybereason: Not only are
threats and the external landscape changing, but given the rate of technology innovation, security teams need to rethink
how they structure their processes and
activities because perimeter based approaches are obsolete, and penetration is
inevitable.
Anthony Di Bello, Guidance Software: Certainly not a lack of competition in the job
market.
www.eforensicsmag.com
www.hakin9.org
- 25 -
R
ECRUITMENT
What new challenges will people looking
for work in cyber security have to face?
Andrew Bagrin, My Digital Shield: How to
defend against the new threats, how to
simplify and at the same time reduce cost.
We can’t continuously keep spending more and more money on security.
Dotan Bar Noy, Re-Sec Technologies: For
the next few years not much. They need
to keep up-to-date with industry development and solutions.
Julie Herold, Kenny Herold, Odin’s Eye:
Eventually a shortage of jobs and declining wages; cookie cutter vulnerability
assessments and penetration testing
(which really isn’t penetration testing).
We refer to it as hitting the big green “go”
button with automated web application
or vulnerability scanning tools and removing false positives and calling it a penetration test. As a result of this stance
from most IT Security companies, there
will be a lack of opportunities to grow in
this space with breadth and depth of
knowledge and offering additional value
to engagements.
Paul Hoffman, Logical Operations: It is not
new, but on-going; it is defending against
those things that you don’t know. Reducing risk and exposure in areas that are
unknown. Hackers are constantly looking
for new ways to breach security and companies are just trying to patch those
known areas.
Wade Lovell, Simpatic: Entrants will likely
find themselves in the security silo without many non-entrepreneurial opportunities to move to other parts of engineering
and development.
Stephan Conradin: They must open their
eyes and have great interest on what
happens just in left or right of them. We
could not have only one specialization, we
must have several and/or have a generalistic view.
BroadTech Security Team: There are so
many tools and using them is very easy.
But understanding the underlying technology is something lacking in people even
with certifications. People will need to
have more than certification if they need
to get work. People who do not have certification will have to show their experience and credibility in some tangible way.
Ondrej Krehel, LIFARS: New threats and
budgetary challenges as technology emerges.
www.eforensicsmag.com
www.hakin9.org
- 26 -
R
ECRUITMENT
What new challenges will people looking
for work in cyber security have to face?
Nick Prescot, ZeroDayLab: The balance of
qualifications vs. experience. There are
many consultants who are experienced
but don’t have the level of qualifications
and others who are well qualified but
don’t have the experience.
Mitchell Bezzina, Guidance Software: Proving their skillset can easily transition into
cybersecurity would be the main challenge. For those in developing careers, there
will be a steep learning curve which may
involve odd hours and be prepared to
“roll up the sleeves”, as with growing industries, managers rarely manage people
but must also take on work tasks and assist in day-to-day activities.
David Clarke, VCiso: A Cyber Role is a journey and the role has to match where the
client is their cyber maturity and position
it no longer a “finger in the leaking dyke”.
Dennis Chow, Millar, Inc Short: The problem of finding well-paying local security
positions as opposed to ones that require
relocation to high cost of living areas.
Wade Johansen, CouriTech LLC: Employers who look for talent often don’t understand just how talented an individual really is from a resume. Because every resume is filtered through an HR dept, often
by keyword - great prospects are skipped
over. Keyword resume searching has become the norm, often when you do get an
HR person who calls, they don’t understand the technical abilities of the prospective employee, and so they are often
overlooked when in reality they may be a
perfect fit. This is a challenge because IT
techs often are the worst at describing
what they know and do on a daily basis.
www.eforensicsmag.com
www.hakin9.org
- 27 -
W
HO IS
WHO
Kris Rides
TiroSec, CEO and Founder
Elizabeth Houser
Praesidio Security
Engineer
Kris believes that there is no substitute for building long term relationships with clients and you do
that by providing them a great service. This is his 16th year in the
recruitment industry and he has
built and managed both permanent and contract teams over multiple disciplines in both the UK and
all over the USA. Kris is passionate
about recruitment and still keeps in
touch with both people he placed
when he first started his career and
clients he worked with. He has
spent almost all of his working career in Tech recruitment and he
understands his candidates needs
as well as the difficulties clients
have in some of these niche areas.
Security Engineer for Praesidio and
focuses on vulnerability assessments, incident response, and digital forensics. She is a graduate of
the University of Washington and
lives in Seattle. Her additional interests include malware analysis as
well as cyber threat intelligence
and serves on the Computer Information Systems (CIS) Advisory
Committee for Edmonds Community College in Lynnwood, WA.
Roberto Langdon
KPMG Sr Manager,
Forensic Technology
Services Risk Consulting
He has a wide experience in the
Information Security market, as
well as in the Forensic Practices
and Technology. He has 35 years
of experience previous to his position at KPMG, within
national and multinational companies, from IT & Telecomm sector, and 15 years of experience in Information
Security, Physical Security and Urban Security specialization.
Einaras Gravrock
Cujo, CEO
12 years digital commerce experience. Founded / built Modnique.com to $50M in annual sales. Named one of Goldman Sacs
100 most intriguing entrepreneurs
in 2014.
www.eforensicsmag.com
www.hakin9.org
- 28 -
T
RAINING
What role will formal education play in 2016?
Michael A. Goedeker, Auxilium Cyber Security: It always plays an important role in
research based jobs. Teaches how to do
research and work within specific requirements and times. Certification will never
replace a degree (IMHO). A degree is also
not everything either.
Wade Lovell, Simpatic: As the industry
matures, degrees and certifications will
play more of a role. This is a mistake.
Having held a number of certifications
myself, including the CFE (Certified Fraud
Examiner), I have little respect for their
ability to help practitioners stay up to date
and see them more as a gate preventing
some experts, especially young ones without corporate CPE and dues sponsorship, from appearing as competent as some of the corporate dinosaurs.
Irfan Shakeel, EH Academy: Formal education should play an effective role and we
need to make little tweaks in the formal
education. But, the formal education without the required amendments will not
play any notable role.
Chase Cunningham, Cynja: The more education that cyber operations personnel
can attain before they go looking for
work, the higher initial salary they can
garner. Thanks to increased specialized
training in the military and intelligence
communities, the need for actual degrees
is not completely necessary. However,
surveys show that the gap in starting pay
for those with advanced degrees is much
greater, by up to 40%, compared to those
with similar cyber skills but no formal education. In short—it pays to go to school.
Elizabeth Houser, Praesidio: Formal education will continue to be sought after but
the availability of online (especially free)
training resources will increasingly augment the education of individuals at all
skill levels.
Roberto Langdon, Nicolas Orlandini,
KPMG: The education will be very important in 2016, because we need to incorporate already skilled people for this activity
that can be very effective from the very
beginning of his/her job.
Nick Prescot, ZeroDayLab: Education will
become more formalised in 2016 where it
will be a training requirements.
www.eforensicsmag.com
www.hakin9.org
- 29 -
T
RAINING
What role will formal education play in 2016?
Dennis Chow, Millar, Inc Short: There will
be an increase in positions requiring an
undergraduate degree to even apply. However, I do not believe there will be a large increase in requirements for ‘security’
specific degrees. Certification need will
also increase, as well, that teaches handson skills rather than conceptual only.
Stephan Conradin: Crucial, more education for more ability to work with complexity.
Paul Hoffman, Logical Operations: Formal
education will have to step up in some
capacity and in 2016 you will see some do
just that. But it will take time. Those institutions do not move very fast.
Amber Schroader, Paraben Corporation:
We have seen a change in a need for a
base training and understanding of the
principles associated with examination
that comes through formal education.
However, we see a deficiency when it comes to the ethics that are required to be
able to function in the field when it comes
to formal training.
Rajeev Chauhan: There can be no substitute for formal education, the formal
education provides the base for future.
However, exceptions can not be ruled out.
Ondrej Krehel, LIFARS: It’ll be more important, as curriculums are getting better, but
still not where it should be.
BroadTech Security Team: It will be an
important factor but not a deterministic
factor. Skill, experience & passion will win
over nonchalant formal education.
Anthony Di Bello, Guidance Software: This
depends on the ability for universities to
find qualified instructors and develop meaningful curriculum. Given the salaries
associated with skilled cyber pros, I can
see how attracting qualified educators in
the field will be challenging. Perhaps
universities can turn to their own internal
information security teams for assistance
in this area. Universities that offer meaningful cyber programs can be expected
to play a big role.
Wade Johansen, CouriTech LLC: In the U.S.
it is starting to gain more ground now. The
federal Govt has started giving grants to
more colleges to develop Cyber Technology and Security programs and degrees.
For many colleges, this is the first time
they’ve ever had real Cisco or cyber security labs and not just textbooks and desktops. It’s a big leap forward.
www.eforensicsmag.com
www.hakin9.org
- 30 -
T
RAINING
What role will formal education play in 2016?
Andrew Bagrin, My Digital Shield: Just adding head count in the industry. The security industry requires experience and
knowledge about hacking, networking and
coding.
Przemek (Shem) Radzikowski, Secbüro
Labs: It is difficult to see formal education
disappearing completely, but in general, it
has been slow to incorporate cybersecurity trends within their curricula. It’s not
uncommon for university curricula to remain static for many years because of
their reliance on published textbooks.
David Clarke, VCiso: Education needs to
start in schools, the gap between schools
and IT is getting bigger, Cyber Security is
misunderstood.
Julie Herold, Kenny Herold, Odin’s Eye:
We think, based on the previous answers,
we won’t quite yet see the results this
year.
www.eforensicsmag.com
www.hakin9.org
- 31 -
T
RAINING
Will certification keep its role as the main
tool to confirm skill and expertise?
Michael A. Goedeker, Auxilium Cyber Security: They are important but experience
is more important. Certs don’t guarantee
success but combined with experience
through using taught concepts in projects
is an indicator.
Wade Johansen, CouriTech LLC: For now,
yes! Because most college degrees don’t
prove skills in the field, or because the
requirements of the degree may use
outdated resources, there is a tendency
now to look for certified professionals
such as VCP, CCNA, MCSA, C|EH, etc.,
which shows the skills are currently relevant to an architecture or model.
Rick Blaisdell: Yes, that’s for sure. The
2015 CompTIA study HR Perceptions of IT
Training and Certification revealed that:
65 percent of employers use IT certifications to differentiate between equally qualified candidates • 72 percent of employers use IT certifications as a requirement
for certain job roles • 60 percent of organizations often use IT certifications to confirm a candidate's subject matter
knowledge or expertise • 66 percent of
employers consider IT certifications to be
very valuable - a dramatic increase from
the 30 percent in 2011.
Przemek (Shem) Radzikowski, Secbüro
Labs: I’ve met many highly-certified people who have turned out to know very
little. All too frequently, certifications
only test knowledge but not the candidate’s ability to apply the concepts in real
world situations.
Dennis Chow, Millar, Inc: Yes, certifications will complement and evolve to help
maintain the attestation of a certain level
of skill. However, we will see more interviews and other candidate requirements
to prove hands-on experience through
‘practical’ assignments.
Dotan Bar Noy, Re-Sec Technologies: Certification plays an important role ensuring
your team is up to speed with new solutions and encounters other professional
to share ideas and feedbacks on the different solutions.
David Clarke, VCiso: The idea that a five
day training course means we have cyber
skills, anymore than learning to drive from
multimedia training course is valid, we
need the equivalent of medical interns,
Barristers Pupilage.
Rajeev Chauhan: To some extent, certifications are benchmarks for judging capabilities, but there is no substitution for
hands on skills.
www.eforensicsmag.com
www.hakin9.org
- 32 -
T
RAINING
Will certification keep its role as the main
tool to confirm skill and expertise?
Amber Schroader, Paraben Corporation:
Yes, certifications are a necessity as they
allow for the specialization in the industry
that can only be done through specific
certifications.
Paul Hoffman, Logical Operations: Certification will continue to play the primary
role in confirming expertise.
Ondrej Krehel, LIFARS: I think work experience is the real key, certs are more of a
minimum knowledge.
Andrew Bagrin, My Digital Shield: I think
certification has already dated itself and it
won’t get any better. Accomplishments
and understanding of core principles is
what I look at.
Anthony Di Bello, Guidance Software:
I hope not. I believe practical experience
and red/blue team exercises should be
the main tool to confirm skill and expertise in this field.
Stephan Conradin: Yes, but certification
will have to adapt to new complexity.
When I got my CISSP, I had a question
about the height of the fences, It is always
a good question but now our data is more
in the cloud and less protected by fences.
Elizabeth Houser, Praesidio: Likely yes, as
the desire for certifications has been consistent over the years and most people
are comfortable with that benchmark.
Wade Lovell, Simpatic: I hope not. I prefer
directly testing candidates and reviewing
their code and thought process.
Roberto Langdon, Nicolas Orlandini,
KPMG: Certification is a must to provide
calm and confidence to the clients, that
the people involved in the investigations
and data acquisitions, are recognized professionals to do that, keeping the security
triad CIA (Confidentiality, Integrity and
Availability) of all the information gathered and processed.
BroadTech Security Team: Certification
even now is not the main tool to confirm
skill and expertise for CEOs & HRs who
care about business. But vendors will push
for certification since it is another recurring revenue generation market due its
expiry date.
www.eforensicsmag.com
www.hakin9.org
- 33 -
T
RAINING
Will certification keep its role as the main
tool to confirm skill and expertise?
Chase Cunningham, Cynja: New certifications, like those from ISACA’s CSX program, will start to slowly replace some of the “cookie-cutter” certifications that have typically garnered more interest. Recruiters are
hiring personnel and senior managers with active performance based certifications at a higher rate than
before. The old paradigm of studying for a certification and passing it will start to go away. If one can’t actually conduct the task then they won’t get certified. Another way to put it, people prefer doctors who have
practiced their medical skills on patients rather than simply reading books and passing exams. The same is
true in cybersecurity.
Julie Herold, Kenny Herold, Odin’s Eye: We’ve always been jaded with regards to an acronym that states
you can memorize information so we feel that any answer would be biased. Your work experience and end
product should be the proof of your level of expertise as well as your ability to convince your client that A.)
You know what you are talking about and B.) You can execute at that level. For clients that rely on the certifications as a compass to navigate through the many vendors with these types of services, they do have
their place.
www.eforensicsmag.com
www.hakin9.org
- 34 -
T
RAINING
Will we see a more unified
standardization of education and skills?
Michael A. Goedeker, Auxilium Cyber Security: I hope so, everyone has their
„own” standard and it's very hard to judge
one cert from another. However „Cyber”
and security, in general, are very dynamic
which makes standardization extremely
hard to achieve.
Wade Lovell, Simpatic: Yes, but it won’t be
helpful for the reasons discussed above
and because graduates of the new degrees in cyber security seem to be primarily
learning Java and have little time on the
keyboard with other languages.
Przemek (Shem) Radzikowski, Secbüro
Labs: The security ecosystem is becoming
highly specialized and new niche areas are
emerging each year. If anything, we will
see further fragmentation of education.
Stephan Conradin: Not sure. Standardization doesn’t mean quality. We need big
certifications, like those of ISACA or (ISC)2
but we need to use very specific certifications very close to technologies.
David Clarke, VCiso: No, unfortunately,
not for long time.
Julie Herold, Kenny Herold, Odin’s Eye:
We foresee, with the increase in demand,
that education will start at lower stages of
the education systems which would standardize and unify approach and delivery.
Andrew Bagrin, My Digital Shield: I doubt
it. Security changes too often because the
threats continuously change. So it will be
hard to have a standard training that will
last.
Nick Prescot, ZeroDayLab: Not in 2016 but
as a growing trend over the years.
Mitchell Bezzina, Guidance Software: Yes,
as industries mature, standards will emerge across disparate training and larger
cybersecurity training organizations will
devote time to university course curriculum.
Paul Hoffman, Logical Operations: I don’t
believe we will see standardization beyond the NIST and NICE efforts for a while.
Once those standards take hold, we will
move to the next level.
www.eforensicsmag.com
www.hakin9.org
- 35 -
T
RAINING
Will we see a more unified
standardization of education and skills?
BroadTech Security Team: In information
security, it is important to have ground
work in standardization of education to
eliminate gaps in topics. But once the foundation is made, standardization of skills
would be stupid because hackers don't
attack your standard way nor can you ask
a hacker to be certified before he attacks.
Hackers are ( I mean the good ones ) creative ( kaspersky breach ) and after the
standardization of education on fundamentals, InfoSec professionals should be
able to think creatively in order to counter
non standard attacks.
Wade Johansen, CouriTech LLC: Yes, this is
already happening today in the U.S. As the
federal Govt is standardizing its own networks, the skills they are looking for in
high tech field employees has evolved.
Because there has been a lack of qualified
candidates, they have begun to fund colleges and universities to develop those necessary skills in students or offer continuing education courses for workers who
are looking to enhance or upgrade their
skills.
Ondrej Krehel, LIFARS: I think so, but
diversity isn’t bad either.
www.eforensicsmag.com
www.hakin9.org
- 36 -
T
RAINING
Will online courses influence the level of
education in security field?
Michael A. Goedeker, Auxilium Cyber Security: Online courses will grow in importance as we see companies limit travel
expenses. Online training will also let people learn at their own pace.
Paul Hoffman, Logical Operations: To some degree, of course.
Ondrej Krehel, LIFARS: I believe they will
dilute the talent pool. As people who
would go remote could just learn on their
own.
Irfan Shakeel, EH Academy: Yes, online
courses are the rich source to get the basic training & education. Online courses
will influence the infosec education.
Stephan Conradin: Online course are more adapted to time of life, it is easier to
find time to learn online. But presential
courses are important to share with other
professionals.
Wade Johansen, CouriTech LLC: They already are. Most students I know are already
taking online courses. It opens up a world
of opportunity. You can now also get an
accredited degree completely online and
the adoption rate of this model is growing
quickly.
Wade Lovell, Simpatic: Only if there is a
complete change in the way course content is created, curated, and sold. For
example, Cisco or Microsoft could be incredibly influential in the level of education in the security field had they not made education and certification profit centers.
Przemek (Shem) Radzikowski, Secbüro
Labs: Although I have a number of formal
credentials, I think online courses provide
a tremendous service to the industry by
making security education easily and
cheaply obtainable to anyone who wants
it. That’s a positive. The negative aspect
of online courses lies with their clumsy
way of proving that the student has passed the material – it still hinges on an honours system.
Andrew Bagrin, My Digital Shield: Yes it
will, but not the quality of people. The
same reason as above. Security is not something on its own, but security needs to
be applied in all areas. (networking, development, process, etc.)
www.eforensicsmag.com
www.hakin9.org
- 37 -
T
RAINING
Will online courses influence the level of
education in security field?
BroadTech Security Team: Yes, especially
free online courses are going to play a big
part.
Mitchell Bezzina, Guidance Software: Yes,
the base level of knowledge should increase.
Nick Prescot, ZeroDayLab: Not really.
Julie Herold, Kenny Herold, Odin’s Eye:
Yes, as traditional colleges begin to move
more towards the “trade” skill fields, the
hands on training will inevitably be supplemented with online courses.
www.eforensicsmag.com
www.hakin9.org
- 38 -
W
HO IS
WHO
Wade Johansen
CouriTech LL, CEO and Founder
Andrew Bagrin
My Digital Shield (MDS)
Founder and CEO
I’ve worked in the IT industry since
1982 and have been a high level
systems engineer for more than 10
of those years. I also taught as an
IT course instructor for 8 years.
I currently hold CISSP, HCISPP,
C|EH, CHIT, WG-WCSP, CCSP but
have also held over 25 certifications lifetime such as MCSE, CNA,
Server+, Net+, Sec+, SCP, SCNA and
more. I spend much of my time
integrating and merging business
domains and large scale environments, and improving network security. My specialities are Active
Directory migrations for healthcare, banking, and various other industry verticals.
Andrew Bagrin is the Founder and
Chief Executive Officer of My Digital
Shield (MDS), a leading provider of
Security-as-a-Service (SECaaS) for
small businesses. With more than
18 years of experience in the IT security industry, Andrew started
MDS in 2013 to bring cloud-based,
enterprise-level security technology
to small businesses at an affordable
price. Prior to founding MDS,
Andrew served as the Director of
Service Provider Business Development at Fortinet, a network security provider. He held the position from 2008 until 2013, focusing
on new security offerings as well as
gaps in the security market.
Andrew’s career in IT security began in 1997, working for several
network security consulting companies. From 2000 to 2004, he served
as the Director of Network and Security with Regal.
Chase Cunningham
Cynja, CTO
Chase Cunningham serves as CTO
and fights bad guys in cyberspace.
He began his Cynja training serving
in the U.S. Navy, where he worked
as an analyst in the Department of
Defense’s network exploitation
program. He lives in Texas with his
two young cyber warriors Callie
and Caelyn. He earned a B.S. from
the American Military University,
and an M.S. and a Ph.D. in information systems security from Colorado Tech University.
Rajeev Chauhan
C|HFI, C|EH, BSc, BTech IT & Comn, MS Cyber Law and
Cyber Security. Cybersecurity enthusiast, Independent
Researcher, trainer, consultant and blogger at Cyberoxen. Loves golden oldies.
www.eforensicsmag.com
www.hakin9.org
- 39 -
T
HREATS
What threats that emerged in 2015 will
remain relevant in the next year?
Leon Kuperman, Zenedge: Targeted, advanced threats focused on specific organizations (called ATP’s) – threat actors are
well funded, patient and utilize a combination of techniques to infiltrate an organization (including physical, social engineering and standard network and cyber
attacks) • Advanced botnets, using Layer 7
DDOS attacks over HTTPS (hard to mitigate) – this trend will continue in 2016 and
we will see the next iteration of weaponized zombies with near-browser like capabilities. • IoT – Connected devices with
OS’s running on them, with vulnerabilities
exposed at an unprecedented rate. •
DDOS attacks for Bitcoin.
Shay Zandani, Cytegic: Attacks to steal PII,
medical data and sensitive information
will continue to be a major concern – not
only for the “usual” targets but also for
“new types” of targets, such as municipalities, online gaming platforms, tier-2 retailers, production lines, etc. • SCADA and
ICS attacks will continue to grow and become a major threat to critical infrastructure, but also for plants, production lines.
• Ransomware is likely to continue to
evolve and remain mainly a nuisance.
Rajeev Chauhan: Zero-day vunerabilities,
clickjacking and ransomware.
Einaras Gravrock, Cujo: IoT. It’s going to
get worse before it gets better. IoT penetration is growing at a high multi-digit rate
and device makers continue to be unprepared for security challenges.
Michael A. Goedeker, Auxilium Cyber
Security: „Cyber” Espionage, Warfare and
their influence on new technology in
„Cyber” Crime. Increased attacks on personal data in government, increased
attacks on critical infrastructure, increased
corp espionage by nation states, lack of
actionable intel in threat intelligence products
Kris Rides, Tiro Security: As more companies move towards cloud services, the
attack surface is increasing. I think we will
see more sophisticated attacks targeting
cloud service providers. I also think the
assumption made by many companies
that moving to the cloud pushes security
issues to these services providers, alongside with companies running hybrid systems, will leave gaps in their security posture.
Dennis Chow, Millar, Inc: Phishing and
Social Engineering based attacks combined with insider threat based breaches.
www.eforensicsmag.com
www.hakin9.org
- 40 -
T
HREATS
What threats that emerged in 2015 will
remain relevant in the next year?
Mayur Agnihotri: Good Malware Never
Dies, Fidelis in a recent report as a
"reincarnation" of previous malware. Not
only can Java-based JSocket control Linux,
Mac and Windows PC systems remotely,
but the malicious code is also able to
affect mobile devices.
David Clarke, VCiso: Security personnel
reporting lines reporting to IT, Cyber Security is there to protect against bad things
happening, surely this should report to
the highest level.
David Coallier, Barricade: Whilst ransomware will probably continue to be used (as
they are wildly successful for criminals), I
am bullish on the new threat landscape
around the Internet of Things. There are a
lot of devices which access vast amounts
of personal and private information, as
well, becoming more intrinsic to your everyday life (i.e. connected cars) and yet, the
security of most of these devices is fickle
at best.
Dotan Bar Noy, Re-Sec Technologies: Unfortunately, enterprises are still not protected from 2015 threats to worry about
2016 ones. We will still see content based
attacks containing APT, Phishing, Ransomware and many more zero-days. Threats
will continue to use sophisticated delivery
mechanisms that will allow them to perform updates and evolve over time.
Paul Shomo, Guidance Software: Malware
designed primarily for long term command-and-control, such as Remote Access
Trojans (RATs), will continue to be the
bane of incident responders’ existence in
2016. It’s such a simple matter to create a
new version of a RAT in minutes and they
offer the advantage of being unique and
therefore bypass signature and policy based detection methods, relying heavily on
technologies with deep endpoint visibility.
These tools will form the cornerstone of
incident response and security alert triage
and validation.
Rick Blaisdell: Wearables - Although most
wearable devices store a relatively small
amount of personal information, wearable platforms could be targeted by cyber
criminals working to compromise the
smartphones used to manage them. The
industry will work to protect potential
attack surfaces, such as operating system
kernels, networking and Wi-Fi software,
user interfaces, memory, local files and
storage systems, virtual machines, web
apps, and access control and security software.
www.eforensicsmag.com
www.hakin9.org
- 41 -
T
HREATS
What threats that emerged in 2015 will
remain relevant in the next year?
BroadTech Security Team: Threats in the
IoT sector, Compromising Anti-virus to
take over systems, Rogue drone causing
damage. SSL vulnerabilities until OpenSSL
is fully replaced by LibreSSL..
Roberto Langdon, Nicolas Orlandini,
KPMG: Although the Banking and Financing sector is a common practice to search
for suspicious operations, in order to detect money laundering, frauds, etc., in the
rest of the market segments there are no
special organisms with the same responsibility, so the corporate and government
organizations need to find a confident
advisor to help them in this arena. Frauds
are not exclusive for Banking and Financing institutions.
Nick Prescot, ZeroDayLab: As with the MTrends Report, the main APT groups around hacktivism, state-sponsored actors
and organised cybercrime aren’t going to
go away any time soon. The re-publishing
and distribution of open source hacking
tools is a lucrative market for amateur and
veteran threat actors alike, with organised
cybercrime groups utilising younger individuals as smokescreens for larger-scale, indepth attacks (i.e. Talk Talk, Oct. 2015).
Przemek (Shem) Radzikowski, Secbüro
Labs: We saw some interesting reflection
and amplification DDoS attacks this year,
in particular those using Simple Service
Discovery Protocol (SSDP). The SSDP
attack vector was possible as a result of
millions of unsecured home-based Internet-connected devices which use Universal Plug and Play (UPnP). These were
used as SSDP reflectors. Their sheer scale
of numbers and passive availability will
likely continue through 2016.
Andrew Bagrin, My Digital Shield: APT didn’t emerge in 2015 but they will continue
to grow and get worse, and they will start
to overlap with IoT threats as IoT grows.
Kenneth C. Citarella, Guidepost Solutions:
Every threat that emerged in 2015 will
remain relevant. Unless known security
weaknesses are corrected, we will continue to be victimized by the same techniques that have worked previously.
Stephan Conradin: Cybercrime did not
really emerge in 2015 but is is clear now
we are in cyberwar, with a lot of enemies
and no more aliens.
www.eforensicsmag.com
www.hakin9.org
- 42 -
T
HREATS
What threats that emerged in 2015 will
remain relevant in the next year?
Craig McDonald, MailGuard: Ransomware. In 2016, inexperienced cyber criminals will jump onto the ransomware-as-a-service offerings, and accelerate the growth of ransomware. Anonymizing networks and payment methods will continue to fuel ransomware’s rapid growth path • Cloud services. Weak or ignored
corporate security policies make cloud services easy targets for cyber criminals. The payoffs are big -- confidential business information, customer data, organizational business strategies, company portfolio strategies, next-generation innovations, financials, acquisition and divestiture plans, employee data and other
data • Attacks through employee systems. When organizations do improve their security, attackers shift
their focus to their employees, especially insecure home systems, to gain access to corporate networks •
Warehouses of stolen data. Stolen personally identifiable information sets are linked together in big-data
warehouses; combined records are more valuable to cyber attackers. Watch the dark market for stolen personally identifiable information and usernames and passwords boom in the coming year • Hardware. Attacks on all types of hardware and firmware will continue. The market for tools that make them possible will expand and grow. Virtual machines could be targeted with system firmware rootkits • Wearables. Most wearable devices store a small amount of personal information, but they are desirable targets
because of the smartphones used to manage them • Cars. Connected automobile systems that fail to meet
best practice security policies in areas are tempting targets. These include vehicle access system engine
control units (ECUs), engine and transmission ECUs, advanced driver assistance system ECUs, remote key
systems, passive keyless entry, V2X receiver, USBs, OBD IIs, remote link type apps and smartphone access.
Julie Herold, Kenny Herold, Odin’s Eye:
Continued focus on previous assumptions
of lower level security in protocol stacks;
as the theoretical attacks are becoming
more and more probable and exploitable
for nation states and other organizations
with computational power exceeding the
norm. Continued focus on open source
code and taking advantage of a lack of
review on said code.
Gerald Peng, Mocato: Personal Information hacking, Cyberterrorism against
private and public entities, Cloud computing vulnerabilities, Mobile device exploitation, Credit card fraud via card-notpresent (CNP) technology, Phishing, Malware, Ransomware, Connected device
hacking (e.g. medical equipment, cars),
State sponsored hacking, Mobile phone
vulnerabilities.
Ondrej Krehel, LIFARS: Better ransomware.
Wade Lovell, Simpatic: Ransomware, Wire Fraud, Hacking into databases and
offering customized searches on Personally Identifiable Information as one Vietnamese national did who had access to data
on 200 million U.S. Citizens.
Wade Johansen, CouriTech LLC: Botnets & CryptoLocker.
www.eforensicsmag.com
www.hakin9.org
- 43 -
T
HREATS
Which threat group will see
the biggest growth in 2016?
Michael A. Goedeker, Auxilium Cyber Security: Cybercrime that works with nation
states for corp espionage and warfare
(even though it is cyber war and espionage, nations will (hide) behind cyber crime). In addition, depending on how we
resolve terrorism, we could also see Cyber
Terrorism growth as well.
Roberto Langdon, Nicolas Orlandini,
KPMG: The global erosion of values, morals, and responsibility, are affecting
strongly the organizations who suffered
frauds, money deviation, information
theft, manipulation of information in order to obtain personal benefits against
the organization objectives, taking advantage of higher hierarchies or powered positions inside the company.
Dotan Bar Noy, Re-Sec Technologies: Guessing from the past year, ransomware
and specifically cryptolocker are the ones
most of us will encounter this upcoming
year. We will see and hear more about
new targets such as cars, etc.
The dream of easy money is driving people without loyalty and moral values to
take advantage of these “opportunities”.
Seeing packets of 50,000 credit cards stolen information on the Dark Web on sale
for two or three thousand dollars is just
an example.
Besides that, as in some organizations, the
information gathering and storage is not
well addressed when it comes to accomplishing security policies, the rest of the
delinquent eco-system is ready to participate.
Shay Zandani, Cytegic: The tier-2 financial
hacker groups, which now are able to buy
“off the shelf” exploit kits and advanced
attack methods, will continue to evolve.
As such, the proliferation of advanced
tools will continue this year.
Przemek (Shem) Radzikowski, Secbüro
Labs: I think it’s worth keeping in mind
that 300+ Gbps DDoS attacks will become
the norm and may start to see sustained
500+ Gbps attacks. We should also be prepared to see a rise in DDoS attacks which
act as a smokescreen for the “real” or
“secondary” attack and ultimate exfiltration of data.
Rick Blaisdell: I personally worry about the
possibility of U.S. infrastructure becoming
the next major target of cybercriminals.
Attacks on all types of hardware and
firmware will likely continue, and the market for tools that make them possible will
expand and grow. Virtual machines could
be targeted with system firmware
rootkits.
www.eforensicsmag.com
www.hakin9.org
- 44 -
T
HREATS
Which threat group will see
the biggest growth in 2016?
Kenneth C. Citarella, Guidepost Solutions:
It is impossible to predict which threat
group will be most prominent in 2016.
There are too many variables, such as
“who” they target, what vulnerabilities
that target has and what kind of data is
accessed. But the sophistication of many
attackers is steadily growing, so we should
not be surprised by continuing reports of
successful intrusions.
Craig McDonald, MailGuard: Spear phishing. Targeted, specific email phishing
scams whereby the sender is impersonated, rendering the email content to be
more compelling to the recipient who
knows the ‘purported’ sender. Staff within
an organisation will wire transfer large
sums of money for instance, believing the
CEO or CFO has asked directly for this
transaction to occur.
Integrity attacks. Stealthy, selective compromises to the integrity of systems and
data are on the rise. Attackers seize and
modify transactions or data for their own
purposes, such as changing a victim’s direct deposit settings and having their paycheck deposited into a different account.
BroadTech Security Team: IoT in health
care, oil plants, power grids, nuclear facilities, etc.
Wade Johansen, CouriTech LLC: Mobile
device security.
Andrew Bagrin, My Digital Shield: IOT because the industry is really growing without any defenses.
Julie Herold, Kenny Herold, Odin’s Eye:
Divulgers of dox attacks or pro-privacy
groups based on anti-government, anticorporation, anti-organization, anti-X motivations for smear campaigns or proprivacy groups.
Gerald Peng, Mocato: I believe that personal information, especially located on
mobile phones and social media channels,
will continue to be the main targets for
cyber attack and cyber fraud.
Nick Prescot, ZeroDayLab: Phishing and
malware.
Stephan Conradin: Theft of sensitive data.
www.eforensicsmag.com
www.hakin9.org
- 45 -
T
HREATS
Which threat group will see
the biggest growth in 2016?
Wade Lovell, Simpatic: Spear phishing,
which is an email phishing attack customized with your information so that it appears legitimate.
Paul Hoffman, Logical Operations: Health
Care. Vital records about a person that
never change are the most valuable information being sold.
Ondrej Krehel, LIFARS: As always, phishing.
Leon Kuperman, Zenedge: IoT Device Vulnerabilities.
David Clarke, VCiso: The threat group that
is the biggest already is inadvertent human error “PWC” 95% of all incidents.
www.eforensicsmag.com
www.hakin9.org
- 46 -
T
HREATS
Can you see any old and forgotten
threat coming back in the next year?
Michael A. Goedeker, Auxilium Cyber Security: Always, many attacks come back
after people forget them, or they are repurposed and updated.
Stephan Conradin: We have cloud, IoT,
BYOD questions and people are thinking
the virus front is safe now, but they are
still there, more and more polymorphics
and hard to detect.
Leon Kuperman, Zenedge: Potentially; for
example, there are still many implementations of SSLV3 running, and those are susceptible to POODLE. Old attacks could
come back in a slightly modified form.
Craig McDonald, MailGuard: New malware but the same old tactics Social engineering and malware infection are the most
common tactics used by cyber criminals.
Survey scams on social networking sites,
phishing and spear phishing emails for
corporate employees, and fake links on
search results are successful at the moment.
Cybercriminals are constantly
morphing their malware and their social
tricks – faster than victims can identify
them and protect themselves.
Rick Blaisdell: Phishing is not new, but it
remains a top threat in the coming year.
The Global Phishing Survey of the AntiPhishing Working Group (APWG) found
that in the last six months of 2014 alone,
there were approximately 124,000 unique
phishing attacks worldwide, which occurred on more than 95,000 unique domain
names.
Dotan Bar Noy, Re-Sec Technologies: No.
I believe traditional security measures
offer a sufficient protection from old threats. The challenge will be to battle new
types of malware and techniques.
Alina Stancu, Titania: Heartbleed, Poodle
and other critical vulnerabilities will resurface as recycled code is being used in
other applications.
Mayur Agnihotri: HACKTIVISM with more
dangerous faces, and in the present scenario, we see most of the attacks are under Hacktivism, like LulzSec and one more
name is added #ISIS.
Dennis Chow, Millar, Inc: Stego and Covert
Channel Signaling.
www.eforensicsmag.com
www.hakin9.org
- 47 -
T
HREATS
Can you see any old and forgotten
threat coming back in the next year?
Przemek (Shem) Radzikowski, Secbüro
Labs: Brute force attacks have virtually
disappeared, but with the proliferation of
cloud applications, “Low and Slow” Brute
Force attacks have been gaining popularity. The dispersed nature and scale of
cloud resources makes possible their use
to launch distributed “low and slow” brute force attacks without triggering alert
thresholds.
Mitchell Bezzina, Guidance Software: Physical attacks will make a come-back in
2017, where a combination of physical
presence will be the easiest entry into an
organization. 2016 will focus on individual
awareness and closing gaps in cybersecurity strategies.
Wade Johansen, CouriTech LLC: PKI trusts
- inherently trusted and ultimately insecure.
Richard De Vere, The AntiSocial Engineer:
Without doubt, the largest rise will be seen in social engineering techniques. A lot
of security has evolved now to the point
that only the very smartest and determined criminals hack anything worth hacking. Social engineering techniques will
help criminals to get the access they desire.
Anthony Di Bello, Guidance Software: Certainly. There are already old and forgotten
threats still prolific throughout the world;
see Conficker. The cybersecurity industry
ebbs and flows with technology from both
the attackers and defenders, this year saw
proliferation in POS intrusions and Phishing, while these attack types remain
“easy”, they will continue, however, new
defense technologies of these attack types will force attackers to pivot and define
other entry types.
Ondrej Krehel, LIFARS: I don’t think there
are any really forgotten techniques, as
hackers keep a large toolbelt. Maybe more into COBOL and Fortran as NASA put it
back into the limelight.
Wade Lovell, Simpatic: Yes, EXE injections, for example, are making a comeback and many advanced persistent threats likely remain undiscovered. Macro
malware in MS Office documents attached
to emails are also on the rise as an attack
vector.
Einaras Gravrock, Cujo: The nature of
threats has not changed over the last couple of decades; devices and networks
have. We will continue seeing old attack
methods aimed at new device types.
www.eforensicsmag.com
www.hakin9.org
- 48 -
T
HREATS
Can you see any old and forgotten
threat coming back in the next year?
Andrew Bagrin, My Digital Shield: I don’t
think so. I think the threats have grown up
quite a bit.
David Clarke, VCiso: Yes. Inadvertent human error, been around for ever, Enigma
was cracked because of this.
www.eforensicsmag.com
www.hakin9.org
- 49 -
T
HREATS
Will threat landscape be affected
by international efforts to combat terrorism?
Mark Bennet, Blustor: The debate between the need for intelligence agencies to
decrypt data being communicated between potential terrorists and the public’s
right to privacy will continue to rage.
Overreaching government agencies have
abused their ability to collect data on citizens with little oversight by legislatures or
the judiciary. Restricting the transfer or
development of encryption technology
will have little impact on a terrorist organization to illegally obtain those capabilities but it will significantly restrict the ability of law abiding citizens to protect their
own privacy. The proposed “backdoors”
that some officials are calling for to enable
intelligence agencies to covertly access
encrypted communications will also make
those same devices vulnerable to hackers.
There is no such thing as a “backdoor”
that only the good guys can use.
Nick Prescot, ZeroDayLab: Governmental
supervision via traffic analysis, etc., has
become more prevalent in the public eye,
and – as with recent proposed surveillance legislation – may only continue to further public perception of ‘state snooping’
of their online activities. As such, encrypted / obfuscated networks such as The
Onion Router (TOR) may be utilised more
by the general public who may not know
the ramifications of using such tools, making them vulnerable to malware attacks
and vulnerabilities as yet unknown to signature-based anti-virus systems (i.e.
OnionDuke).
Dotan Bar Noy, Re-Sec Technologies: Cyber terrorism becomes the new frontier
and terror organizations. The growing impact of cyber space on recruitment and
public opinion will mean that much of the
war against terrorism will take place in
the cyber space.
Einaras Gravrock, Cujo: Yes. I think
governments all over the world have made cyber security among their top priorities. Their funding has trickled down to
the private sector. This sort of positive
attention from the government will fuel
the private sector.
Leon Kuperman, Zenedge: Yes, terrorists
will use all means possible to achieve their
objectives, including cyber-security vulnerabilities. Right now, terrorists are focused
on physical targets for the most part,
using technology as an enabler. In 2016
and forward, targets will include cyberassets as the primary goal of terrorist
campaigns.
Stephan Conradin: I think the war is already here and due to our growing cyberdependencies, it is clear cyberterrorism is
a good weapon.
www.eforensicsmag.com
www.hakin9.org
- 50 -
T
HREATS
Will threat landscape be affected
by international efforts to combat terrorism?
Craig McDonald, MailGuard: Although
this was a hot topic two or three years
ago, it’s no longer attracting a lot of attention. The internet and social media are
used as a recruitment tool and a weapons
development training ground. Two key
areas of cybercrime will be affected by the
war on terror: • A market for false identities • Criminals use stolen or false identities to perpetrate frauds and establish
business structures and companies to
launder money. Identity crime is also used
to commit welfare, tax and other fraud
against government agencies, to gain
unauthorised access to sensitive information or facilities, to conceal other criminal
activities such as drug trafficking and procuring child exploitation material, and
even to facilitate the commission of terrorist acts. • Rise of data mining • Increasing
commercialisation of data from Twitter,
Facebook and LinkedIn for data miners for
all purposes including terrorism.
Ondrej Krehel, LIFARS: I don’t think so.
Nationstates and terrorist groups make up
a small minority of breaches. It’s really
people out for the money.
Alina Stancu, Titania: If legislation is passed in the wake of terrorist provoked tragedies, there will be significant changes in
how future threats will be delivered. It will
probably drive the criminals underground
and there will be more channelling
through Virtual Private Networks, proxy
servers, and Tor.
Michael A. Goedeker, Auxilium Cyber Security: Yes, they will likely increase hacktivism and cyber terrorism before they
reduce them. Terrorism will show the weaknesses of How? When groups do not
work in a coordinated way, they will be
disorganized and this disorganization
could be used to hack certain countries. In
addition, we could see the dawn of a new
job title Anti-Cyber Terrorism Consultant/
Analyst. Weaknesses in the way security
people are trained will show here as we
will see a need for more hacking skills in
all computer security related jobs in the
future. Security teams can only protect
what they know will be attacked and how
it will be attacked.
David Clarke, VCiso: Yes it may speed up
legislation to make IT Safe.
BroadTech Security Team: The international effort to combat terrorism will be controlled by politics, fear, greed and national
interests. So how the landscape will change is not predictable. More than technology, the above mentioned factors will
dominate in shaping it.
www.eforensicsmag.com
www.hakin9.org
- 51 -
T
HREATS
Will threat landscape be affected
by international efforts to combat terrorism?
Kenneth C. Citarella, Guidepost Solutions:
Terrorist attacks and counter-terrorism
will continue to engage in cyberspace.
Terrorists will try hard to move past mere
website defacing and to create the same
type of physical harm through compromising systems that they attempt through
kinetic attacks. We cannot assume they
will lack the initiative or capabilities to
attempt infrastructure intrusions, especially if they are not succeeding through
conventional efforts.
Shay Zandani, Cytegic: Yes, the international efforts to combat terrorism and cyberterrorism is equivalent to a “whack-amole” game – with every hit, the attackers
pop back in a different location. The
efforts to control encryption and to hunt
down terrorists will demand innovation
on the terrorist and hacker side, as we see
these days.
Wade Lovell, Simpatic: Yes, it will. Nation
States are becoming bigger players in cybercrime, although they call it something
else. Under “the ends justifies the means”
argument, countries have recorded all
content, required they be allowed top
level certificates, etc. If countries cooperate in their data gathering and analysis,
there could be a decrease in terrorism
funding and mobility while the freedom of
the non-terrorists are eroded in lockstep.
Andrew Bagrin, My Digital Shield: I believe
so. In any type of battle, resources such as
communications and supplies are always
hit first to reduce the power of the enemy. Misinformation is also a strategy.
Wade Johansen, CouriTech LLC: Definitely,
the landscape evolves to new levels every
day. How? Anonymity is still a key. Terrorist networks no longer require social media from the typical resources to operate
efficiently, although recruitment will continue to happen across these mediums.
Once an individual is involved in the social
aspect, they will be able to use a completely new private version of Facebook,
Twitter, etc., which is non-dependent on
the current world's social media
platforms. Independence for these
platforms will evolve.
Roberto Langdon, Nicolas Orlandini,
KPMG: Cyberterrorism is becoming more
equipped and informed, to help their objectives be carried out, no matter where
or in which country it can be done. Cyberspace is the new war scenario where we
are almost in a new world war. And Forensic services needs to be a must to be
covered by all the Army Forces and Security Forces. If they are not self-sufficient,
KPMG is ready to help, worldwide.
www.eforensicsmag.com
www.hakin9.org
- 52 -
T
HREATS
Will threat landscape be affected
by international efforts to combat terrorism?
Gerald Peng, Mocato: Absolutely. Firstly,
nation states are exploring options for
tactical cyber response or offense. This
adds a complexity which will impact strategies developed and resources deployed
to fighting terrorism. Secondly, terrorists
use mobile and social media technology
to recruit, organize themselves and to
intimidate others. The efforts used to
combat those domestic and international
threats may result in a decline in personal
freedoms and an increase in investigations of citizens, thereby diluting counterterrorism resources.
Julie Herold, Kenny Herold, Odin’s Eye:
Not any more than it already has been,
everything is in motion already.
www.eforensicsmag.com
www.hakin9.org
- 53 -
T
HREATS
Will cyber security in healthcare
remain a relevant topic?
Elizabeth Houser, Praesidio: Definitely.
Several high profile breaches within the
healthcare industry during 2015 indicate
that the adoption of necessary tools and
practices isn’t occurring quickly enough.
Dennis Chow, Millar, Inc: Yes, PHI is worth
more than PCI data at present on the
black market. Additionally, any compromise or damage of patient care based systems could potentially affect lives. There
is increasing evidence of terrorism linked
with cyber related crime.
Roberto Langdon, Nicolas Orlandini,
KPMG: And related to healthcare information protection, this market segment was
identified as one not making the necessary investment in information technology
security, and most of healthcare service
providers are in a high risk to be attacked.
This was advised by the FBI at least three
or four years ago. We are seeing the healthcare sector as one of the most illprepared to prevent, detect and respond
to a cybersecurity incident, such as a data
breach. Considering they store tons of
sensitive information such as PII and PHI,
this becomes (and it is happening right
now) a perfect storm situation.
Kenneth C. Citarella, Guidepost Solutions:
Cyber security in healthcare systems will
be a most relevant topic to both industries. Health care networks contain all
the data necessary to steal identities for
economic fraud as well as to obtain unwarranted health care services by assuming the identity of an insured party. The
continuing adoption of electronic health
records will only contribute to this problem unless adequate security is built into
the records system from the ground up.
In addition, more and more medical devices will be accessible online, yet they
often continue to operate with outdated
and insecure software. The possibility for
online tampering to target a patient’s health or life must be anticipated and addressed.
David Clarke, VCiso: Yes. Healthcare, councils and charities still top the list for
breaches.
Nick Prescot, ZeroDayLab: This will grow
as the implementation of the Data Protection Act will come into force.
Shay Zandani, Cytegic: Healthcare will
continue to be a lucrative target for attackers, targeting PII and medical information.
www.eforensicsmag.com
www.hakin9.org
- 54 -
T
HREATS
Will cyber security in healthcare
remain a relevant topic?
Leon Kuperman, Zenedge: Yes – It’s a critical data asset that remains exposed,
exploitable and monetizable (from an
attacker’s perspective).
Wade Johansen, CouriTech LLC: Absolutely, health care is a big target since records
contain not only geographical data about
a person, it also contains medical information which can be used to exploit benefits
systems and ongoing retirement information.
BroadTech Security Team: Of course! A
few hours ago I sent a mail to the CEO of a
chain of hospitals asking her if she is prepared for the statistics “Cyber Attacks will
compromise 1 -in -3 healthcare records
next year”. Our company will be actively
involved in spreading awareness in the
healthcare sector and providing necessary
consultation for them. Security should be
a main concern for people who write health care IoT operating systems, too. Instead of starting from scratch, they should
port tested and proven operating systems,
like NetBSD and OpenBSD.
Mark Bennet, Blustor: Cyber security in
the healthcare industry will not only remain relevant but it will grow as a major
concern. Due to decades of kicking the
can down the road, the healthcare infrastructure is woefully unprepared to protect itself from well equipped hackers seeking to steal patient medical records, ransoming critical healthcare data, etc. The
costs of addressing these vulnerabilities
mean that many healthcare organizations
and medical device manufacturers will be
slow to respond unless legislatures mandate a more rapid response. Unfortunately, legislatures rarely take action until
AFTER a major cyber security incident forces the issue into the mainstream awareness of the voters that put them into office.
Wade Lovell, Simpatic: As long as there
are trillions of dollars in healthcare and
big pharma and billions of dollars in tabloids, cyber security will be relevant in healthcare.
Michael A. Goedeker, Auxilium Cyber Security: Yes, because of the lack of money
and enforcement.
Mayur Agnihotri: Yes. As cyber threats in
healthcare continue to skyrocket, security
remains a top priority.
www.eforensicsmag.com
www.hakin9.org
- 55 -
T
HREATS
Will cyber security in healthcare
remain a relevant topic?
Einaras Gravrock, Cujo: Next year and
beyond, absolutely. These are two of the
most trying challenges we’re facing in our
generation.
Andrew Bagrin, My Digital Shield: Yes, it
will for a long time. Patient records are a
very private thing. It’s one thing to get
your credit card stolen, but to steal identity or medical information is much worse.
Alina Stancu, Titania: Yes. As the use of
new technologies grows in the healthcare
market, the need for security and stronger
regulations over use of private patient
data will be more poignant. For the time
being, HIPAA is the only legislation to address these issues, however the problem
with HIPAA is that it is not yet properly
monitored and enforced.
Gerald Peng, Mocato: Yes. Healthcare data theft and the hacking of IP-based devices present threats to the well-being of
patients and institutions.
Anthony Di Bello, Guidance Software: It
will be an even bigger topic next near as
we hear about breaches that are occurring in 2015 as we speak. Healthcare companies are a virtual treasure trove of personal information… PII, credit card data
and more!
Julie Herold, Kenny Herold, Odin’s Eye:
Yes, and increasingly so; this is an area
where there is a wealth of information for
differing agendas attackers may have as
well as the industry being a lot further
behind in relation to security in comparison to other industries. Much of this will
be a result of the increased utilization of
SaaS and the industry’s lack of security
mindset/maturity and the usual growing
pains/adoption rate of industry best practices in other sectors.
Dotan Bar Noy, Re-Sec Technologies: Yes,
definitely.
David Coallier, Barricade: Most definitely.
We have healthcare practitioners now
recommending the use of mobile apps as
well as using more sophisticated and interconnected gadgetry. The combination
of legislation, market uncertainty and fear
as well as the need to protect the customer data has never been more prevalent.
Ondrej Krehel, LIFARS: I don’t think so.
Nationstates and terrorist groups make up
a small minority of breaches. It’s really
people out for the money.
www.eforensicsmag.com
www.hakin9.org
- 56 -
T
HREATS
Will cyber security in healthcare
remain a relevant topic?
Rick Blaisdell: Unfortunately, yes. In August, the FDA and the Department of Homeland Security advised health-care facilities to stop using Hospira's Symbiq infusion pump after learning that the device,
which administers medication to a patient
over time, is vulnerable to hackers. Mick
Coady, health information privacy and
security partner at PricewaterhouseCoopers, believes that this type of cybercrime
will become more prevalent in 2016.
Stephan Conradin: Yes. First it is very sensitive for people. And with this kind of security we speak of human life, not only
cash.
The newest threat for medical devices will
be “ransomware / Stuxnet” attacks, where
hackers can tap into the administrative
privilege capabilities of medical devices,
which are typically restricted to manufacturers or hospital administrators. We will
especially see an uptick in exploitation of
medical devices that have moved to more
modern types of interconnectivity with
mobile devices.
Craig McDonald, MailGuard: Cyber Criminals love to target healthcare records –
they contain so much sensitive information all in one place. The biggest cyber
security attack of 2015 – Anthem –
involved the medical records of 78.8 million people. It’s difficult for IT and security
professionals working in healthcare to
improve data protection without impeding access to potentially life-saving patient information. At the same time, the
sheer size and complexity of many hospital IT environments means that cyber security in healthcare remains a hot topic.
www.eforensicsmag.com
www.hakin9.org
- 57 -
T
HREATS
Will security in automotive industry
keep on causing trouble?
Wade Johansen, CouriTech LLC: Cars don’t
drive themselves… wait they actually do
now! By using peer to peer traffic information for apps like Waze, you’ll have
hackers that will take advantage. Also, as
cars begin to develop capabilities to observe traffic patterns and manage the car's
capability to brake even when a driver is
unaware of a potential incident ahead,
this technology could be used illicitly to
instead push a gas pedal down instead of
brake pedal.
Gerald Peng, Mocato: Yes. As cars become increasingly programmable, IPshareable and automated, the possibility
of hacking a vehicle will erode consumer
confidence if the auto manufacturers do
not address this issue head on.
Rick Blaisdell: As more and more cars connect to the Internet for such functions as
GPS, they become more vulnerable. Hackers can connect to a car over a cellular
network and, conceivably, turn off the
engine while the car is speeding down a
crowded highway, or cut the brakes, or
cause any number of nightmarish
circumstances.
Security researchers will continue to focus
on potential exploit scenarios for connected automobile systems that fail to meet
best practice security policies. IT security
vendors and automakers will develop guidance, standards and technical solutions
to protect attack surfaces such as vehicle
access system engine control units (ECUs),
engine and transmission ECUs, advanced
driver assistance system ECUs, remote key
systems, passive keyless entry, V2X receiver, USBs, OBD IIs, remote link type
apps and smartphone access.
David Coallier, Barricade: Not unlike any
other industry, the automotive industry is
trying to adapt to this modern connected
world and they aren't unaffected. They
will need to take the same steps as everyone else to prepare themselves and be
ready to respond to incidents. The only
difference is cars are directly handling
people's lives and will have to make a decision between convenience and safety.
BroadTech Security Team: There will be
trouble here and there, but overall, things
should improve and be moving towards
being comfortably and sufficiently secure.
Paul Hoffman, Logical Operations: Yes,
especially as we move to automation in
driving.
Nick Prescot, ZeroDayLab: Yes, and the
hacks will get worse.
www.eforensicsmag.com
www.hakin9.org
- 58 -
T
HREATS
Will security in automotive industry
keep on causing trouble?
Michael A. Goedeker, Auxilium Cyber Security: Any industry or product that does
not integrate security and doesn’t see security as business critical will experience
problems.
Amit Serper, Cybereason: In 2015, we saw
a rise in attacks using fileless malware.
We expect this to continue, and believe
that it is the most important thing to watch moving forward. In fact, we think 2016
will be the year of “malware-less attacks.”
While Microsoft is re-architecting Windows to be more secure, it will be quite
some time before those efforts will hit the
mainstream. Until then, built in tools,
such as WMI and Powershell, will continue to be very popular attack vectors until
newer versions of Windows become more
ubiquitous.
David Clarke, VCiso: Yes, but I suspect the
automotive industry will respond quickly
to safety issues like they did in the 60’s,
partly due to
Ralph Nader’s book
“Unsafe at any speed”.
Additionally, we expect to see more
attacks targeting the Mac platform. The
more pervasive it is, the more popular
target it becomes.
Mitchell Bezzina, Guidance Software: Absolutely, the growth of electronics and
lack of standardization means minimal
attention to security, no car buyer asks
how much R&D went into ensuring the
data connection installed in the car they
are purchasing has been secured. It’s a
secondary concern and a production cost
which means minimum viable security.
2015 was also a key year in the evolution
of ransomware. Not only have we seen
new business models around it, such as
the SaaS model we discovered with Operation Kofer, but in November, we saw
the first case of Linux-based ransomware
targeting websites (see Krebs’ story on it),
we expect to see more new permutations
of ransomware coming in 2016.
Mayur Agnihotri: According to a survey
from McKinsey & Co., 45% of new-car owners are unwilling to use connected services because of privacy concerns.
Dennis Chow, Millar, Inc: Yes, kinetic
attacks are on the rise and transportation
like automobiles will be a prime target for
whitehats and blackhats alike.
Ondrej Krehel, LIFARS: Hopefully only until
self driving cars are safe.
www.eforensicsmag.com
www.hakin9.org
- 59 -
T
HREATS
Will security in automotive industry
keep on causing trouble?
Wade Lovell, Simpatic: Absolutely! As
early adopters move toward more and
more automated driving features, whether it is proximity alerts or self-driving
cars, the ability to commandeer controls
of vehicles will be an important attack
vector. Imagine going in for a safety recall
and having the technician install a backdoor unwittingly, on behalf of a nation
state, as part of a cyber crime ring, or any
other reason.
Craig McDonald, MailGuard: Automotive
cyber crime is in its infancy as is evidenced
by the acceleration of the US Automobile
Industry Accelerates into security, and its
recent initiatives to enhance cyber Security.
Cyber criminals will target vehicle access
system engine control units (ECUs), engine and transmission ECUs, advanced
driver assistance system ECUs, remote key
systems, passive keyless entry, V2X receiver, USBs, OBD IIs, remote link type
apps and smartphone access.
Leon Kuperman, Zenedge: Potentially –
This falls into the category of IoT devices.
Car manufacturers will need to treat security as first-class citizens as opposed to
add-on technology components. As connected technology modules start influencing core driving / safety features, automotive will go through a transformation
period where issues may occur.
Stephan Conradin: Perhaps not in 2016 or
2017, but it is a big concern for future as
vehicles become more and more dependent on data and telecom.
Alina Stancu, Titania: The advent of IoT
means that automotive, just like everything else inter-connected, is a source of
worry. The responsibility of car manufacturers is perhaps higher than for many
other technological gadget providers, as it
must ensure the safety of its passengers.
The Jeep Cherokee hacking has been an
eye-opener for drivers, just as much as it
was for the industry. Fiat Chrysler recalled
1.4 m vehicles to patch the vulnerability
that allowed two security researchers to
disable the brakes on a car and sliding it
into a ditch.
Einaras Gravrock, Cujo: Well… we expect
cars to increasingly integrate with other
services using online technologies. When
cars become computers interconnected
with apps, services, and features… when
cars become another IoT, they will naturally be exposed to cyber security threats.
That being said, we don’t expect people to
be in serious physical danger in the very
near future.
www.eforensicsmag.com
www.hakin9.org
- 60 -
T
HREATS
Will security in automotive industry
keep on causing trouble?
Kenneth C. Citarella, Guidepost Solutions:
The increasing computerization of cars
and their connection to the Internet of
Things heralds a wide array of potential
harm. Can the digital record of a car’s
activities be altered to impact litigation
arising from an accident, or remove evidence that might lead to a criminal charge? Can a car be remotely commandeered to threaten the life of its occupants?
Such risks are highly predictable; the time
for the security-related discussion and
analysis is now.
Andrew Bagrin, My Digital Shield: I hope
not, but I suspect that it will. It is just
another IoT and won’t be taken seriously
until a disaster happens.
Julie Herold, Kenny Herold, Odin’s Eye:
Not in our opinion; not enough gains.
Roberto Langdon, Nicolas Orlandini,
KPMG: Regarding the issues we are seeing
in the automotive industry, as long as the
new cars are incorporating more and more computer-based components and technology, as in any other aspect of the market, this fact is attracting not only private
researchers, but also curious people and
the bad guys. Hacking vehicles, to find
and demonstrate their vulnerabilities and
bad security designs or implementations,
are only a few of the reasons for this to
happen. Automakers need to invest more
in assessing their internal processes in
regards to cyber security for their computer components, and also to assess the
components they get from their third parties. In response to this transformation
process, KPMG has already created a strategic and technical Vehicle Forensics team
well prepared to assist the automakers in
preventing, detecting and responding to
cyber security issues.
www.eforensicsmag.com
www.hakin9.org
- 61 -
W
HO IS
WHO
Mitchell Bezzina
Guidance Software
Security Strategist
Anthony Di Bello
Guidance Software
Senior Director
Security Practice
Mitchell Bezzina is a technology team leader with over 15
years' experience in information security and endpoint
forensics. With hands-on
experience in security and
digital investigations of every
kind, he has designed, developed, and implemented operational and procedural policies for digital forensics, ediscovery, and security departments to gain production
efficiencies and comply with
business requirements. Mitchell is now focused on security product strategy for Guidance software having
previously managed forensic and e-discovery services in
support of investigations centered on intellectual property theft, employee misconduct, fraud investigations,
cross-border investigations, court orders, and regulatory inquiries.
Anthony Di Bello is
responsible for providing in-depth insight
into the advanced
threat landscape for
Guidance
Software
and its customers. Since joining the company in 2005, Di Bello
has been instrumental
in defining the company’s suite of security
products, introducing
new products and successfully driving market adoption with Fortune 500
companies and federal government agencies. Prior to
joining Guidance Software, Di Bello spent seven years
with Towers Perrin, a global professional services firm
specializing in risk and financial management. He is a
frequent speaker and quoted regularly in security industry publications.
Paul Shomo
Guidance Software, Sr. Technical Manager
Paul Shomo has over 15 years of R&D experience, having begun his career writing firmware for IP routers and satellite networks. Paul joined Guidance Software’s new product research group in 2006, which launched the industry’s
first incident response solution. Paul has managed and architected cybersecurity and forensic products for many years. He now manages integrations with
the EnCase open security platform, and in his free time works to educate the
cybersecurity industry.
www.eforensicsmag.com
www.hakin9.org
- 62 -
M
OBILE
Which mobile phone will be
the most secure one?
Chase Cunningham, Cynja: Silent Circle’s
Blackphone 2 is far and away the best and
most secure phone anyone can use but it
isn’t for the masses. Most people will stick
with what they know. The Android based
phones will continue to be the preferred
phones for exploitation because of how
readily available exploits are for that OS in
the cyber underground.
Elizabeth Houser, Praesidio: The iPhone,
especially if U.S. Congress does not pass
legislation requiring Apple and other phone makers to decrypt phones for law enforcement purposes.
Leon Kuperman, Zenedge: Systems that
are cost closed will have the best security
posture – iPhone / iOS .
Michael A. Goedeker, Auxilium Security:
There is no such thing as a „secure” mobile phone. We created a secure handset
with hardened OS, blocked known malware and spyware apps but we can not repair the broken communications systems
like SS7 that people use to track your position. The only real „secure” phone to
have would be based on its own coms
system and network (regardless of what
others are selling you…).
Richard De Vere,The AntiSocial Engineer:
Taking a look at the recent release of prices from zerodium (0day reseller) which
offers bounties of 500,000 for iOS and
100,000 for Android… It’s plain to see
which phone is more secure. It’s 0days
that hurt this market and with iOS 0days
fetching 5 times as much as Android says
it all.
Mark Bennet, Blustor: Apple IOS devices
will continue to be the most secure widely
used smartphone in the industry, primarily due to the more restrictive and controlling ecosystem that Apple has built around their products. While the use of niche
smartphones designed for enterprises
with the need for high-levels of security
will continue to grow, the price and flexibility of these devices will likely keep
them out of the hands of the average consumer.
Wade Johansen, CouriTech LLC: The iPhone will evolve to be the most secure phone I believe, but it will probably only be
because it is hacked “less often” than Android and Windows phones.
Rajeev Chauhan: The one with cloud storage and having active app scanner.
www.eforensicsmag.com
www.hakin9.org
- 63 -
M
OBILE
Which mobile phone will be
the most secure one?
Mayur Agnihotri: No phone will be the
most secure one in my view. This is the
wrong question. The right question is
which mobile phone company is more
concerned about its user’s security and
privacy.
Anthony Di Bello, Guidance Software:
BlackBerry Priv and Blackphone seem
pretty well thought out from a security
perspective. Only time will tell.
Julie Herold, Kenny Herold, Odin’s Eye:
BlackPhone – sole purpose of the solution
is for security and privacy. Other phones
are catering to end users for usability as
the focal point.
Roberto Langdon, Nicolas Orlandini,
KPMG: We cannot identify which mobile
phone will be the most secure one, due to
the direct interaction and criteria of its
user. And again, the factor Security Awareness comes again over the table. Almost
all of the mobile phone users are going
through their lives careless of what can
happen to their mobile phones, and mainly with the information inside them.
Ondrej Krehel, LIFARS: One that’s turned
off.
Stephan Conradin: Android? No it’s a joke,
iPhone will remain the least bad.
Andrew Bagrin, My Digital Shield: The one
that is properly protected. If you take all
phones without any protection, probably
the old flip phones or blackberry on the
older RIM OS (not Android).
Wade Lovell, Simpatic: Blackphone 2.
Amber Schroader, Paraben Corporation:
In looking at the security of mobile devices, there is really not one that is considered to be more secure than any other as it
all depends on how you use the device.
From cloud access to desktop backup,
most devices have a risk associated with
them when it comes to security.
Gerald Peng, Mocato: All mobile phones
can be hacked with enough time and resources. Ideally, you want a phone that
will protect you against casual hacks and
persistent online behavioral tracking. Good options on the market are Silent Circle's Blackphone 2 or the BlackBerry Priv.
www.eforensicsmag.com
www.hakin9.org
- 64 -
M
OBILE
Which mobile phone will be
the most secure one?
BroadTech Security Team: I have no Idea.
I don’t use a smartphone (or no phone
you can say).
Nick Prescot, ZeroDayLab: Blackphone
Blackberry.
David Clarke, VCiso: Android with Customised for security are currently in the lead, there are no IOS customised versions
for security.
Dotan Bar Noy, Re-Sec Technologies: Phone will not be more secured than your
regular home computer as users are freely downloading programs, plugging the
devices and connecting to random hotspots as they travel. The “PwC 2015 Information Security Breaches Study on UK
Corporations” reports that 15 percent of
organizations suffered from a breach caused by use of a smartphone or tablet device, more than doubling last year’s figure
of 7 percent. This is a great challenge and
opportunity for the industry.
Mitchell Bezzina, Guidance Software: My
1997 Nokia 6210.
www.eforensicsmag.com
www.hakin9.org
- 65 -
M
OBILE
What kind of vulnerabilities will affect
mobile phones in 2016?
Michael A. Goedeker, Auxilium Cyber Security: The same ones as now. In addition,
the false sense of security that „secure”
phone manufacturers sell you will lead to
more hacked phones. The system is broken, no phone would change that…
Richard De Vere, The AntiSocial Engineer:
Social Engineering using the mobile telephone has seen a rise over the past few
years based on the percentage of us now
spending large amounts of time on our
smartphones. I think criminals have paid
more attention to this field. Noting phishing sites that are mobile friendly!
Mark Bennet, Blustor: As biometrics continue to grow as a mainstream security mechanism for accessing mobile devices and
related applications, consumers will see
an increase in malware that specifically
targets biometric identity theft. The unfortunate reality is that the identities of
many consumers are going to be compromised for life due to their own unawareness of how serious this issue will become
over the next few years. Once your biometrics have been compromised, they can
never be replaced short of visiting a plastic surgeon.
Amber Schroader, Paraben Corporation:
We believe there will be an increase in
security risks that come from 3rd party
Apps. With a poor vetting procedure in
place for 3rd party Apps, we have seen an
increase in the data being collected and
used by 3rd party Apps.
Rick Blaisdell: According to the mobile
security firm NowSecure, 43 percent of
"bring your own device" (BYOD)
smartphones used by U.S. workers don't
have a password, a personal identification
number or pattern lock. Fifty percent use
these devices to connect to unsecured Wi
-Fi at least once a month, and nearly half
of mobile apps on any given mobile device have at least one major security flaw.
Cybercriminals can easily exploit vulnerabilities in your mobile phone to obtain
private data. These vulnerabilities sometimes come from the apps you use or
within your smartphone itself. Mobile
phones are also vulnerable to malware,
which can log keystrokes and capture
screenshots.
Elizabeth Houser, Praesidio: Malware for
mobile devices is on the rise especially
since people habitually download free
apps and use jailbroken phones.
Wade Johansen, CouriTech LLC: GPS vulnerabilities and apps that require too
much permissions (already an issue) with
little company security knowledge about
locking apps done before publishing.
www.eforensicsmag.com
www.hakin9.org
- 66 -
M
OBILE
What kind of vulnerabilities will affect
mobile phones in 2016?
Mayur Agnihotri: Malware because “Good
Malware Never Dies”. Some underground
hackers built this type of malware which
does not need any type of permission
(“root" or "jailbreak") to access the mobile phone to affect the mobile phone.
Wade Lovell, Simpatic: I am primarily concerned about altered variants of apps,
especially games, being disseminated
through legitimate app stores. I am also
concerned about apps with expanded capabilities for analytics, etc. being downloaded without users paying attention to
the terms and conditions.
Julie Herold, Kenny Herold, Odin’s Eye:
We think there will be a breakthrough
outside of the usual delivery of malware
via stores. We think until an R&D department within a security company commits
the time to explore this area further, there won’t be much change in the realized
versus perceived attack surface and vectors for exploitation.
Gerald Peng, Mocato: As the majority of
phones are Android based, my answer is
confined to those devices. The vulnerabilities of the Android OS are exposure to
cloning, data leakage, weak malicious application detection and ability to use the
device as a microphone. These vulnerabilities facilitate identity theft and financial
fraud.
Ondrej Krehel, LIFARS: Many of the same
ones, from malwaretising to phishing
texts/emails and unvalidated apps.
Paul Hoffman, Logical Operations: Location, financial information (Apple Pay),
Stephan Conradin: We have a great dependence on geolocation and disturbation
of GPS data could be serious.
Roberto Langdon, Nicolas Orlandini,
KPMG: Malware addressed to steal information, to make calls or messages deviation, to get private photos or videos, is
totally easy. Think that the people are
carrying all their emails, access credentials
to portals, to mail servers, to home banking sites, etc. It is as easy as taking candy
from a little child. Almost no one cares
about this, unfortunately.
David Clarke, VCiso: Mobiles are similar to
PCs 15 Years ago, almost everything is
vulnerable from text and data transmission to the OS.
www.eforensicsmag.com
www.hakin9.org
- 67 -
M
OBILE
What kind of vulnerabilities will affect
mobile phones in 2016?
BroadTech Security Team: Theo deRaadt,
founder of OpenBSD and Co-founder of
NetBSD, said, “Low code quality keeps
haunting our entire industry. That, and
sloppy programmers who don't understand the frameworks they work within.
They're like plumbers high on glue.” I
think everything starts there, adding to it
is poor hardware design, infectable
firmware, malware apps, etc. Again, user
discretion and spreading security awareness, I believe, can contain a lot of problems and keep them from blowing up.
Before you get a smartphone, it is good to
list out what purposes it should serve you
and then get just the ones that have only
those features and install only necessary
apps. Don’t root the phone because someone else did it. If you go feature chasing, you will end up in trouble because
one day you will find that feature was a
trap.
Nick Prescot, ZeroDayLab: Malware that's
executed by user unluckiness.
Andrew Bagrin, My Digital Shield: I think
they will be used as a method for hackers
to sneak malware into companies.
www.eforensicsmag.com
www.hakin9.org
- 68 -
M
OBILE
What security measures we should use to protect
our mobile phones in the next year?
Chase Cunningham, Cynja: Just like your
laptop, be sure that your phone is patched and your OS is always up to date.
Use two-factor authentication. If you
don’t need an app or don’t need a particular function…turn it off. Bottom line—
don’t suck at patching.
Mark Bennet, Blustor: Consumers and
enterprises alike need to separate the
keys of an individual’s digital identity from
the devices they require for access. One
analogy is that you wouldn’t secure your
car by leaving the keys in the ignition and
neither should you store your biometric
identity on your smartphone. While powerful devices, smartphones are inherently vulnerable to attack due to the ubiquitous and always connected nature. A
better solution, such as BluStor’s CyberGate platform, that allows users to seamlessly separate the digital keys (e.g., biometrics) needed to access their phone or
other mobile devices, is critical to addressing this vulnerability.
Michael A. Goedeker, Auxilium Cyber Security: Don’t use a phone for secure stuff!
Limit the usage for important calls and
functions, only use apps that are tested
and proven backdoor and spyware free.
Don’t trust any phone manufacturer, test
and verify your Sim card, phone hardware, OS and Apps are secure. Recognize
that the underlying communication system is flawed. Anyone and everyone can
track you down, so if you don’t want that,
then limit phone use. Use a computer or
electronic device that can use encrypted
signals and never needs the SS7 based
infrastructure.
Wade Johansen, CouriTech LLC: Apps like
Cerberus to encrypt phones, detect GPS
locations (if on), and ability to take pics of
users attempting too many passwords are
a plus! Remote wipe capability is also handy.
Elizabeth Houser, Praesidio: Users need to
take responsibility for the apps s/he is
downloading and be aware of what
exactly is being loaded onto the device.
Mobile devices have been around long
enough that the current usage mentality
should be maturing. For most people,
smart phones are now a vital, integrated
tool in the daily operations of our lives
and should be protected as such.
Richard De Vere,The AntiSocial Engineer:
I’d like to think every last person who
uses the internet should be aware of two
factor authentication available for all mobile platforms, this should help form the
basis of your security - But with our phones becoming the master key for all our
digital lives, the need for secure 8+ digit
lock screen passwords and mobile disk
encryption is more so than ever.
www.eforensicsmag.com
www.hakin9.org
- 69 -
M
OBILE
What security measures we should use to protect
our mobile phones in the next year?
Amber Schroader, Paraben Corporation:
The best security is to be aware of what
your device is doing and what you have
granted access to with the device use policies and with 3rd party apps. We have to
find the line between being secure and
being accessible.
Mayur Agnihotri: Endpoint protection software must be used on every mobile
device. • Sharply analyze cloud services
for their ability to resist threats and
attacks. For this, we should terminate
third-party security vendor conduct
testing and instead, start checking the
cloud provider's certificate which should
indicate that third-party security vendor
has already tested its applications. •
When choosing a mobile phone, first
check its security features. • Before you
store information on your mobile phone,
ask yourself “Is this TMI?” TMI – Too
Much Information. • Do not "root" or
"jailbreak" the mobile phone.
Rick Blaisdell: Knowing your vulnerabilities and making sure that you protect
them will stand you in good stead for
2016. Other precautionary steps include:
- Use strong passwords for your accounts
that include numbers, lower case and capitalized letters, and are not easy to guess, e.g. password, 12345, etc. Don't open
suspicious emails requesting that you reenter sensitive data - Destroy sensitive
documents—Use a VPN to secure your
Internet connection if you need to use
public Wi-Fi—Keep your antivirus software up to date.
Roberto Langdon, Nicolas Orlandini,
KPMG: Mobile phones must be protected
by antivirus, firewall, intrusion prevention
systems, and backup policies as well. They
are IT equipment! Phishing techniques
will be as frequent as during 2015, and
Android is still showing a lot of security
hack opportunities.
By the way, a lot of people think that the
mobile phone is more private than a
workstation or notebook, and sometimes
there are important discoveries not imagined by the people involved in a fraud.
Julie Herold, Kenny Herold, Odin’s Eye:
Unfortunately,
the
anti-virus/antimalware maturity of software for phones
is very immature. This is as a result of the
lack of a need for it, we are barely into the
pattern based detection on mobile programs designed to protect an end user
against threats. This lack of maturity is
due, in part, to the lack of realistic threat
scenarios outside of the so-called
“vetting” of applications before they are
available in a store.
Stephan Conradin: Keep in mind it is a
smart device, open and not very secure.
Awareness!
www.eforensicsmag.com
www.hakin9.org
- 70 -
M
OBILE
What security measures we should use to protect
our mobile phones in the next year?
Ondrej Krehel, LIFARS: Be aware and read
the fine print on permissions.
David Clarke, VCiso: As many security software apps as you can get on your phone. I use at least four.
Paul Hoffman, Logical Operations: Use
Two Factor authentication wherever possible. Change passwords to be more secure. Use Bio where possible.
Gerald Peng, Mocato: This is a nonexhaustive list of security precautions you
can take: Check your device’s security features before you buy, such as file encryption, device wiping capacity, and authentication features. • Secure the device
using locking, enabling encryption and
antivirus software. • Configure web accounts using encrypted connections in account options such as HTTPS or SSL. • Avoid
clicking links sent in suspicious emails or
text messages. • Do not reveal your mobile phone number on social networking
websites.• Consider what personal information you will store on your device. •
Vet applications before installing them on
your phone by researching them first. •
Disable Bluetooth, infrared and Wi-Fi interfaces when not in use and in public
places.
Wade Lovell, Simpatic: Establish a company-wide approved apps list for “bring your
own devices” (BYOD). • Have IT set up an
internal app store so IT can determine
whether the checksums match with the
publishers’ source files, test updates before they are deployed, etc. • Turn off wi-fi
outside the office and route everything
through cellular data except while in the
office.
Anthony Di Bello, Guidance Software: Same measures we would take with any
other device. Encryption, password protection, turn off Bluetooth/wifi/gps when
in questionable locations such as Defcon.
BroadTech Security Team: I will have to
write a paper on it so I will let someone
else answer it. What I do is simple I don’t
have a smartphone ( I don’t use the old
mobile phone which can only make calls
and SMS unless there is a prior appointment or to call family ). In my current capacity, a smartphone is a liability and risk.
Andrew Bagrin, My Digital Shield: There
isn’t much out there that is very accessible, but I think having something simple
to at least identify if something is wrong
or your configuration is not ideal is very
necessary. Something like NowSecure.
www.eforensicsmag.com
www.hakin9.org
- 71 -
M
OBILE
What security measures we should use to protect
our mobile phones in the next year?
Nick Prescot, ZeroDayLab: For companies,
the MDM sandboxing is a good idea but
for personal users, they are safer than
desktop systems.
Einaras Gravrock, Cujo: For starters, you
should secure your home network. Often
times, home hackers get access to our cell
phones by penetrating your home network. Secondly, do not use public Internet networks.
www.eforensicsmag.com
www.hakin9.org
- 72 -
M
OBILE
What risks will mobile industry face in 2016?
Michael A. Goedeker, Auxilium Cyber Security: Increased usage as a cyber war and
espionage tool. Data leakage and theft.
Roberto Langdon, Nicolas Orlandini,
KPMG: Using phishing techniques, the bad
guys made several devices contamination
oriented to steal information, mainly financials (username, PIN, credit card information, etc.), as well as personal information. All the stuff with value at the black
market. Also, it cannot be left out what it
is related to spy at political level or industrial secrets as well.
Wade Johansen, CouriTech LLC: Bluetooth
security problems currently plague the
mobile phone industry. Users who link to
their cars (remote start), Pandora radios,
GPS mapping, etc., are highly exploitable.
Rajeev Chauhan, Cyber Oxen: Identity
theft and personal data security.
Andrew Bagrin, My Digital Shield: More
features means more vulnerabilities, and
ability to control everything that you can
control from you phone (car, house, etc.).
Einaras Gravrock, Cujo: The challenge is
that companies will need to continue shifting their budgets away from features
and onto security which will slow down
overall product improvements as well as
profitability.
David Clarke, VCiso: Marketing apps maybe too invasive, exploits exposing more
personal data.
Mayur Agnihotri: Ransomware • Encrypted Penetration • No endpoint protection
software • Application-Based Threats.
Wade Lovell, Simpatic: As payments move
to the smartphone, so will attacks. • Biometrics, as currently implemented, are a
dangerous way to validate users to devices and once a fingerprint is collected or
stolen, the device and ALL FUTURE DEVICES where the user registers that fingerprint are compromised. This is disastrous
for BYOD. • Nation States requiring backdoors or compromising component manufacturers.
Gerald Peng, Mocato: The increasing popularity of mobile shopping and mobile
beacons will make mobile phones likelier
fraud targets. The ability to fight mobile
platform fraud will be influenced by innovations in data protection, intuitive security compliance protocols and user authentication.
www.eforensicsmag.com
www.hakin9.org
- 73 -
M
OBILE
What risks will mobile industry face in 2016?
Ondrej Krehel, LIFARS: Users. They are
always the weakest link, especially in mobile.
BroadTech Security Team: I don’t know
but vulnerabilities are surely going to increase rather than decrease if vendors are
going to enchant people with features
and jargons instead of working more on
testing the quality of their product before
release.
Nick Prescot, ZeroDayLab: Bluetooth jacking.
www.eforensicsmag.com
www.hakin9.org
- 74 -
W
HO IS
WHO
Leon Kuperman
Zenedge, CTO & Co-founder
Mark W. Bennett
Blustor, COO
Leon Kuperman is a successful founder and CTO of multiple ecommerce organizations with 18+
years of experience in product management, software design and
development all the way through to
production deployment. He is an
authority on Payment Card Industry
Data Security Standard (PCI DSS), ecommerce, online marketplaces /
auctions, data center deployment,
cloud deployment and web application architecture. He is also a
holder of a patent relating to ecommerce caching systems which
he worked on while at IBM.
Mark is the Chief Operating
Office of BluStor PMC, Inc.
and is a trailblazing executive more than 20 years of
experience in the IT industry
delivering strong competitive advantages through
technology innovation and
organizational transformation. He brings a unique perspective to the world of cyber security that is a combination of years of work in areas that require high-level
of information security including the aerospace defense
sector and financial services.
Mayur Agnihotri
Przemek Radzikowski
Secbüro Labs
Chief Security Researcher
I've done Bachelors of Engineering
from Information Technology and
having certifications under my belt
like C|EH - Certified Ethical Hacker,
Cyber Security for Industrial Control Systems, Operational Security
for Control Systems, Advanced Security In The Field, Basic Security In
The Field. I have 3+ years of experience and love to spend time find
bugs and vulnerabilities.
An Information Security Enthusiast,
Who believes in Security and Not
Just Compliance.
Przemek (Shem) is the Chief Security Researcher at Secbüro Labs. For
over two decades he has worked
on key assignments with government, military, telecommunications, banking, finance and large
multinational clients across the
Americas, Middle East, Africa, Europe and Asia Pacific, where he
headed the technical delivery and
governance of highly complex
Cloud, Data Center and Security
projects worth in excess of $65
million.
www.eforensicsmag.com
www.hakin9.org
- 75 -
I
NTERNET OF THINGS
Will IoT force the industry
to change?
Shay Zandani, Cytegic: The inherent interconnectivity of IoT already forces changes
in the security industry, and will continue
to do so. This fact demands multi-device
endpoint detection tools, cross-device
honeypots and much stricter MDM rules
and practices in the office space.
Dennis Chow, Millar, Inc: Not alone, as
history shows, it will probably require more breaches related to IoT and high visibility catastrophes before vendors will be
forced to make changes.
Mitchell Bezzina, Guidance Software: Not
until it’s too late. Just like all other goods,
security concerns are production costs to
the vendor and rarely factor in consumer
buying decisions. It will take a major breach before standards are implemented
across IoT manufacturers and this will be
a 2020 concern.
Kenneth C. Citarella, Guidepost Solutions:
The Internet of Things will not force any
industry to change, not the auto industry,
not the appliance industry, not the home
security industry not the computer industry. A demand for security and privacy
pushed jointly by consumers, the government, politicians and security experts will.
Dotan Bar Noy, Re-Sec Technologies: Yes.
But it is still a long process that is in its
early stages.
Stephan Conradin: Before changing the
industry, understand what we can or
should do with all this data from these
sensors.
David Clarke, VCiso: Cyber security that
can be managed will need to be built in.
Paul Hoffman, Logical Operations: It already has.
Gerald Peng, Mocato: Gartner Inc. has
predicted that 6.4 billion connected things
will be in use worldwide in 2016, up 30
percent from 2015, and will reach 20.8
billion by 2020. The increase in interconnected devices will mean that cyberattacks can be massively scaled up.
Nick Prescot, ZeroDayLab: Not really in
2016, the regulation as part of EU GDPR
will make people think.
www.eforensicsmag.com
www.hakin9.org
- 76 -
I
NTERNET OF THINGS
Will IoT force the industry
to change?
Michael A. Goedeker, Auxilium Cyber Security: Yes, as in all new technology, we,
for some reason, always forget to integrate security right from the start. This is a
dangerous way of creating new services
and products. Since IoT connects systems
previously not connected, we will only get
to see the „new” hacking vectors as it becomes more mainstream.
David Coallier, Barricade: The providers of
security products need to understand that
we have new computing capabilities available to us nowadays that allow for leaps
in pattern discovery. Continuing to develop products that are doing heavy processing on the devices is no longer an
option and the democratisation of computing Amazon is leading will force many
incumbents to change how they do things.
Amit Serper, Cybereason: While I think IoT
might have jump started a culture-shift
towards security in some industries - such
as automotive - for the most part, I don’t
think people care enough about security
to make IoT systems inherently more secure than what we have now. Unfortunately, I don’t think there will be much of a
groundswell towards building secure IoT
systems until people and businesses start
experiencing consequences for themselves.
Mark Bennet, Blustor: Despite the efforts
of many organizations to get in front of
IoT related security issues, the drive to get
to market first with these products is going to result in numerous vulnerabilities
that can scarcely be understood yet. This
means a long and painful road ahead for
IoT but it will ultimately drive significant
changes in the industry. Unfortunately, I
suspect we have many years of learning
from the “school of hard knocks” in front
of us.
Roberto Langdon, Nicolas Orlandini,
KPMG: IoT is becoming an amazing advantage for people’s wellness, but if we consider this with the little responsibility by
mobile phone users in terms of protection
and security, this will become a funny war
between users and delinquents. I cannot
imagine a toaster firewall but we can have
security on the other side.
Andrew Bagrin, My Digital Shield: Very
much so. We can no longer expect to have
a security endpoint client on every piece
of hardware out there that has an IP.
www.eforensicsmag.com
www.hakin9.org
- 77 -
I
NTERNET OF THINGS
Will IoT force the industry
to change?
Amber Schroader, Paraben Corporation:
IoT has caused a lot of changes in how we
look at digital evidence and access of digital devices in our daily life. IoT will make
huge changes to where we see our information spread out to, as well as where it
can be collected from.
BroadTech Security Team: YES, I wrote
about a particular scenario a few months
back but it was not received then but now
people have started appreciating it after
reality started striking. IoT is going to
bring a deluge of data for processing,
which traditional Big Data processing
techniques, Internet bandwidth, cloud
storage should be able to handle for a
long time without breaking down. We will
see more and more of Proximity Cloud or
Intelligent Sensor Cloud that will throw
away irrelevant data right from the start
and send only what is needed to be processed and stores. Data Flow ( Realtime
Big Data Analysis ) may not be a viable or
preferable option without Intelligent Sensor Cloud ( I coined the term while researching AI ) no matter how big your infrastructure is, someday someone is going to
question processing and storing all data
because ultimately it all translates to cost
incurred. I know I will get mocked on this
but let us see :-).
Anthony Di Bello, Guidance Software: Yes,
in today’s climate of privacy concerns,
security will be critical to mass market
adoption of IoT devices. It’s already forced
the industry to change. Take a look at
what Intel/McAfee is talking about lately.
Wade Lovell, Simpatic: Yes, IoT provides a
new attack vector. The Internet of Things
is a nightmare for security. Think of each
one of those devices as a small computer
transmitting personal information about
you. What time are you out of the house?
Did you turn on the burglar alarm? How
do you remotely unlock the back door? At
the moment, all that data is poorly secured.
Wade Johansen, CouriTech LLC: Will IoT
force the industry to change? Yes, NEST is
already making an impact. People want to
be in touch with their homes, children,
and PCs at all times. The world's technology industries will need to accommodate
this to remain profitable.
Julie Herold, Kenny Herold, Odin’s Eye:
No, this area is too new and not profitable
yet as a result of the lack of presence.
www.eforensicsmag.com
www.hakin9.org
- 78 -
I
NTERNET OF THINGS
Will IoT force the industry
to change?
Craig McDonald, MailGuard: A study presented in October 2015 by the IT research
company, Gartner, predicts a transformation in the world of cybersecurity within
the next two years, thanks to the Internet
of Things.
Ondrej Krehel, LIFARS: A bit, but not really.
Rajeev Chauhan: Yes, in a big way.
By the end of 2017, more than 20% of businesses will be using security services
dedicated to protecting businesses initiatives, and that use devices and services
based on the Internet of Things.
Two examples: A sensor that detects and
adjusts the temperature in a room automatically; another that adjusts the dosage
of medication for a patient in their hospital bed according to new data on their
medical records.
Threat intelligence sharing among enterprises and security vendors will grow and
mature. Legislative steps may be taken,
making it possible for companies and
governments to share threat intelligence.
The development of best practices in this
area will accelerate.
Einaras Gravrock, Cujo: IoT is about to
magnify the issues of cyber security with
billions of new devices entering the market – devices that are largely unsecured. I
think it’s relatively easy to make an argument that IoT represents the biggest cyber security challenge yet. They are easy
targets with potential for limitless damage.
www.eforensicsmag.com
www.hakin9.org
- 79 -
I
NTERNET OF THINGS
What kind of challenges will
IoT face in the next year?
Michael A. Goedeker, Auxilium Cyber Security: Incorporating the correct levels of
security into software, menus, commands
and integrating open source protection
into all IoT devices from the start. At
Davos, I discussed and showed how gas
heaters can be turned into bombs because the lack of firewall and security verification technology in FPGA units. This is just
one example, SCADA is also „still” an issue.
Craig McDonald, MailGuard: Currently,
more things are connected to the Internet
than people, according to technology
company, Cisco, which also predicts that
25 billion devices will be connected by
2015 and 50 billion by 2020. All things
that connect to the Internet expand the
attack surface for hackers and enemies. A
recent study released by Hewlett Packard showed that 70 percent of IoT devices contain serious vulnerabilities.
Mark Bennet, Blustor: The slow adoption
of standards and commercial competitiveness will continue to challenge the IoT
industry to really solve some of the more
serious security vulnerabilities inherent in
these devices.
Nick Prescot, ZeroDayLab: Same as mobiles.
Mayur Agnihotri: Lack of data protocol
standards • There is currently no agreement/ standard on how to implement security in IoT • Upgradability And Patchability Of IoT regularly.
Irfan Shakeel, EH Academy: The security
issues are expected to rise; security researchers might challenge the existing infrastructure. This will open the door for the
organizations to spend on R&D, they will
spend more on finding the vulnerabilities.
Wade Johansen, CouriTech LLC: Bandwidth, security and reliability. Bandwidth
is already an issue, more fiber and more
competition between global bvs local carriers needs to be emphasised. Security
and reliability also go hand in hand, our
phones, PCs, laptops, tablets, handhelds,
watches, security systems, building systems, all the way up to electrical grids,
require better security and protection.
Stephan Conradin: IoT should be treated
in parallel with Big Data. IoT must integrate safety and security from the design.
www.eforensicsmag.com
www.hakin9.org
- 80 -
I
NTERNET OF THINGS
What kind of challenges will
IoT face in the next year?
Dennis Chow, Millar, Inc: Possibly weak
passwords, backdoors, and injection based attacks.
BroadTech Security Team: I will have to
write a book but here are few: (1) non
standardization of hardware and software
will create confusion but let us hope they
all follow standard transfer formats and
standard APIs for data transfer, talking of
the ones with same use but from different
vendors. (2) Serious security incidents are
going to happen due to vulnerable hardware, firmware and software and for a
long time, vendors are not going to take it
seriously because they don’t understand.
We have IoT startups with people who are
highly creative but quite naive in security,
so they are going to make highly useful
stuff but insecure, thus undermining the
product’s credibility.
Amber Schroader, Paraben Corporation:
IoT has a lot of risk in just being new and
not having the advantage of already being
broken. Once technology is broken, we
find better and better means to fix it. With
IoT, it is giving us a completely new perspective that is causing issues in gaining
access or even securing access.
Dotan Bar Noy, Re-Sec Technologies: The
lack of a standard protocol and the need
to incorporate many different patched
systems will be the main challenge and
not only for the next year. In addition, the
IoT by design is built with lightweight security and relies heavily on shared libraries and a short development cycle.
Paul Hoffman, Logical Operations: Securing networks that use IoT.
Roberto Langdon, Nicolas Orlandini,
KPMG: The key actions will be addressed
to enter into the mobile phones, facilitated by the direct connection with the IoT.
David Coallier, Barricade: For us, the challenge isn't in security as much as it is in
usability. We are a design-led security
company and we spend a lot of time thinking about how to make security more
accessible to businesses. Providers of IoT
devices face the same challenge. Keeping
a high level of convenience of use with
intrinsic, transparent and non-adversarial
security.
www.eforensicsmag.com
www.hakin9.org
- 81 -
I
NTERNET OF THINGS
What kind of challenges will
IoT face in the next year?
Rick Blaisdell: As we become increasingly reliant on intelligent, interconnected devices in every aspect of
our lives, security is very much a central issue for the Internet of Things. Despite the opportunities of IoT,
there are many risks that must be considered. Here are five of the many risks that will be essential in an
Internet of Things world:
Understanding the complexity - Imagine Nuclear power plants and data centers using IoT devices to automate their controls and being compromised. Understanding the complexity of vulnerabilities, and how serious of a threat they pose is going to become a huge challenge. Because these devices will have hardware
platforms and software that enterprises may never have had insight into before, the types of vulnerabilities
may be unlike anything organizations have dealt with previously. This is why it's critical not to underestimate the elevated risks of many IoT devices.
Vulnerability management - Another big challenge for enterprises into an IoT environment will be learning
how to quickly patch IoT device vulnerabilities and how to prioritize them. Because most IoT devices require a firmware update in order to patch the vulnerability, the task can be hard to accomplish in real time.
Identifying security controls - In the IT world, redundancy is critical. If one product fails, another is there to
take over. The concept of layered security works similarly, but we still have to see how well enterprises can
layer security and redundancy to manage IoT risk. The challenge will be identifying where security controls
are needed for Internet-connected devices, and then implementing effective controls. Given the diversity
that will exist among these devices, organizations will need to conduct customized risk assessments, often
relying on third-party expertise, to identify what the risks are and how best to contain them.
Disruption and denial-of-service attacks - Disruptive cyber attacks, such as distributed denial-of-service
attacks, could have bad consequences for an enterprise. If thousands of IoT devices try to access a corporate website or data service feed that isn't available, a company’s happy customers will become frustrated,
resulting in revenue loss, customer dissatisfaction and potentially poor reception in the market. Capabilities
for managing lost or stolen devices will also be critical for dealing with compromised IoT devices, so having
an enterprise strategy in place will help mitigate the risks of corporate data ending up in the wrong hands.
Security analytics capabilities - The variety of new devices connecting to the Internet will create a flood of
data for enterprises to collect, process and analyze. While certainly organizations will identify new business
opportunities based on this data, new risks emerge as well.
www.eforensicsmag.com
www.hakin9.org
- 82 -
I
NTERNET OF THINGS
What kind of challenges will
IoT face in the next year?
Wade Lovell, Simpatic: IoT designers will
have to convert to a security-centric design methodology. So far, security has mostly been an afterthought.
Andrew Bagrin, My Digital Shield: The biggest challenge will be security.
Ondrej Krehel, LIFARS: Staying secure as
they grow in capabilities. It’s all about service management and usability vs. security.
Gerald Peng, Mocato: The surge in IPconnected devices increase cyber threat
risks within the corporate and domestic
environments, specifically with respect to
IT infrastructure and device vulnerabilities.
David Clarke, VCiso: Managing Cyber security on a large scale.
Anthony Di Bello, Guidance Software: Really the challenge of mass-market adoption, convincing the market that it is security. News of hacked Barbie Dolls and baby monitors is not helping here.
Kenneth C. Citarella, Guidepost Solutions:
The greatest risk is that we will not anticipate the connections that will be made
possible by the Internet of Things. One
device may be designed to talk to
another, but where the second one leads
may only be understood once it is too late. For example, many devices can be
accessed via a smartphone. If one device
is compromised and that leads to vulnerability in the smartphone app, the risks for
the user can escalate to involve every
function and every app the phone
supports.
www.eforensicsmag.com
www.hakin9.org
- 83 -
I
NTERNET OF THINGS
How will IoT influence
cyber community?
Michael A. Goedeker, Auxilium Cyber Security: We need to be faster, teach more,
work on creating security products that
protect everyday functions and people
from dedicated and nasty attacks on whatever the IoT industry brings out. It's a
new area that we need to protect fast.
Time is ticking (tick-tock).
BroadTech Security Team: Will mention
just one part that could be missed by
others. “More Information Overload“ causing the brains to be rewired for
“continuous partial attention” thus degrading the brain’s ability to reflect and contemplate and thus losing creativity. IoT
devices will rule over us.
Rick Blaisdell: The Internet of Things has
the potential to bring together every
aspect of different networks. Therefore,
security at both the device and network
levels is critical to the operation of IoT.
The same intelligence that enables devices to perform their tasks must also enable them to recognize and counteract
threats.
David Clarke, VCiso: Another very specialist niche is developing.
Kenneth C. Citarella, Guidepost Solutions:
Hopefully, the Internet of Things will galvanize the cyber community to talk about
the ever growing advocacy for thorough
evaluations of all aspects of security for all
connected devices.
Gerald Peng, Mocato: I hope that IoT will
help people think about cyber security
more holistically and with an eye on proactive, forensically sound measures and
protocols. Addressing IoT cyber threats by
securing a single device here and there is
inadequate.
Leon Kuperman, Zenedge: IoT is a top
concern to most security executives, because of the massive scale and potential
of the “armada” of computers out there
that can affect an organization.
Nick Prescot, ZeroDayLab: The use of SSO
solution and the interoperability of information.
Irfan Shakeel, EH Academy: IoT will have a
great impact on Infosec community, it will
be in the spotlight along with BYOD and
cloud security.
www.eforensicsmag.com
www.hakin9.org
- 84 -
I
NTERNET OF THINGS
How will IoT influence
cyber community?
Wade Lovell, Simpatic: It may make the
community more cautious, which would
be a good thing. It certainly exposes data
on previously private acts such as making
love in a room with a SmartTV or temperature sensor.
Stephan Conradin: Emerging standards for
communication.
Ondrej Krehel, LIFARS: It’ll take time. Once
the first major breach happens, it’ll explode.
Dotan Bar Noy, Re-Sec Technologies:
McKinsey estimates that the IoT has a total potential economic impact of $3.9 trillion to $11.1 trillion a year by 2025. This
growth by itself has the potential to increase dramatically the security research done and create power shift to new emerging vendors.
Mayur Agnihotri: As the IoT continues to
skyrocket, internet enabled devices will
become a more attractive target for cyber
attacks. I remember last year hackers gained access to US retail chain which led to
the theft of 40 million credit card numbers. Some points why IoT will influence
cyber community: IoT devices present
multiple points of vulnerability. • Connected devices need to be upgraded and patched regularly. • IoT will increase complexity of the entire internet. It’s directly
related to the increased complexity of the
information infrastructure.
Amber Schroader, Paraben Corporation:
IoT will cause a lot of changes in the
review of connection in the community
and how that level of cross connection
can really affect the data we have on our
devices. We expect to see a lot of new
cases come into play with a focus on nontraditional storage devices.
Julie Herold, Kenny Herold, Odin’s Eye:
Negligible, at this time it appears to be a
novelty in discussion.
David Coallier, Barricade: I truly believe
the industry will start realising the importance of de-expertizing the field and allowing different types of people to join the
security field. We go as far as saying security shouldn't be its own discipline but
normal part of operations in Barricade.
www.eforensicsmag.com
www.hakin9.org
- 85 -
I
NTERNET OF THINGS
How will IoT influence
cyber community?
Wade Johansen, CouriTech LLC: A lot of white hats will go gray, but not for all the wrong reasons! The continuous evolvement of global threats to peace and prosperity are affecting so many people that many have
decided the only way to fight crime is by operating outside the framework of laws as they currently stand.
Governments tend to be behind in technical advancements, and IoT is one of the things they aren’t
equipped to govern yet. They are slow to tackle emerging threats, and are behind on daily advances to
technology of IoT. Gray hats, on the other hand, can easily move in and out of systems without much fear,
and remain anonymous while having quite a large impact without causing system disruptions. They expose
and report vulnerabilities without exploiting them. It’s not about glory, it’s about getting the job done efficiently and building security around devices.
Craig McDonald, MailGuard: Information technology security experts have been warning the public about
cyber threats for years, but users seem not to pay attention to these alerts -- they either don’t understand
the threats or they do not care.
The cybersecurity industry needs to get better at communicating.
One new initiative is the Open Web Application Security Project’s (OWASP) Internet of Things Top 10 Project, which is attempting to educate users on the main facets of IoT security and help vendors make common appliances and gadgets network- and Internet-accessible. The project identifies the top 10 security
problems seen with IoT devices, and discusses how to prevent them on its website. Its list is as follows: Insecure Web interface; Insufficient authentication or authorization; Insecure network services; Lack of transport encryption; Privacy concerns; Insecure cloud interface; Insecure mobile interface; Insufficient security
configuration; Insecure software or firmware; Poor physical security.
The Internet of Things will redraw the lines of responsibilities for the enterprise – security policies will open
to different profiles of employees and updating protocols, as happened with the introduction of BYOD
or cloud computing, but on a much larger scale, and with a far more visible impact.
Technology research company Gartner believes that securing the IoT will be so complex that CISOs will use
a blend of approaches from mobile and cloud architectures, combined with industrial control, automation
and physical security.
www.eforensicsmag.com
www.hakin9.org
- 86 -
I
NTERNET OF THINGS
Will we see the security for IoT emerging
along new IoT solutions, or will we have to wait?
Chase Cunningham, Cynja: IoT security
isn’t really even a thought right now.
What we are seeing is the emergence of
the “next” Internet. With new protocols,
communication mediums and applications
but no consideration for security. Sadly,
we are seeing kids become the first victims of IoT exploits. In the past few weeks,
we’ve learned that Barbie isn’t just a plastic doll with a house of your dreams anymore. Instead, she’s a vector of attack
that hits kids right in their own home. And
parents who gave their child a Kidizoom
smartwatch or a VTech InnoTab tablet
may have exposed their kids to identity
theft after VTech reported hackers stole
the personal information of more than 6
million children. That’s why I believe we
need to protect our kids in this emerging
world of IoT and build systems that allow
families to better control their family’s
data, allow parents to see what data IoT
devices are collecting and alert them
when those data are stolen. What we’ve
learned this year is when it comes to IoT
toys, trusting a company's "reasonable
measures" isn't enough. As a dad, I’m doing something about this and building
better protocols for kids’ digital lives. They
deserve better than what we’re using today.
Wade Johansen, CouriTech LLC: Security is
already paramount, but it will not grow as
quickly as IoT itself. Products often are
rushed to market just to get brand recognition, this often means security is left
behind. In this case, you’ll see security
follow after breaches, etc., and when it
becomes a regulation concern. For a while, though, it will be the wild-wild west,
just like the early dot-com days.
BroadTech Security Team: Definitely, we
will have to wait because as I said earlier,
many new startup vendors have no idea
what it is. Wait, even Lockheed Martin
could not figure it out while making $37
billion fleet of littoral combat ships for US
Navy. Those new to IoT especially would
need some time to figure it out :-).
Gerald Peng, Mocato: I am an optimist,
and with IoT developing so quickly, I believe that consumers and corporations will
drive the need for increased security
options and tools.
Ondrej Krehel, LIFARS: It’ll take time. Once
the first major breach happens, it’ll explode.
Leon Kuperman, Zenedge: Yes, companies
like CUJO are making waves by protecting
both IoT and mobile devices on home and
SMB networks.
www.eforensicsmag.com
www.hakin9.org
- 87 -
I
NTERNET OF THINGS
Will we see the security for IoT emerging
along new IoT solutions, or will we have to wait?
Michael A. Goedeker, Auxilium Cyber Security: We have to see security for IoT. We
have answered that call by discussing existing hacks today, at Davos and any other
conference we are invited to speak at.
Waiting for security and processes, procedures to catch up to new tech is the same
issue as previously, only now we are inviting attacks into our homes and family
members. This is a totally new ball-game.
Craig McDonald, MailGuard: The cyber
security industry needs to work with innovators from the get-go with partnerships that change the way products are
designed.
Elizabeth Houser, Praesidio: Both. Firstattempt security for the IoT will emerge
along with new IoT solutions, otherwise
manufacturers won’t gain confidence and
purchases from consumers. There will, of
course, be vulnerabilities discovered and
privacy mishaps, most likely on a large
scale in some cases, and security standards will have to adapt accordingly as the
IoT expands and evolves.
Mitchell Bezzina, Guidance Software: Some vendors are already making claims to
be able to help with IoT security, but they
have the advantage of being first-tomarket and attempting to define IoT security based on what they have to offer.
While more robust tools and technologies
evolve to meet the challenge, the majority
of IoT security efforts in 2016 are likely to
revolve around testing, testing, and more
testing. Take a look at Intel/McAfee for
the current leaders in IoT security thought
-leadership.
Alina Stancu, Titania: It is predicted that
over 200 billion devices will be connected
by 2020. This sheer explosion of devices
attached to the network will lead to an
increased threat surface. Security monitoring will become essential and solutions
will have to adapt at managing the numbers. The silver lining is that IoT is still at a
young stage and it appeared in a context
where users are slightly more aware of
security and privacy issues. This means
there are calls for the industry to secure
things before it can spin out of control,
which means ultimately that the framework will be safer by default.
Wade Lovell, Simpatic: Fortunately, security will emerge alongside new IoT solutions and offerings. No manufacturer
wants to be in the news as the attack vector allowing the theft of confidential information or images.
www.eforensicsmag.com
www.hakin9.org
- 88 -
I
NTERNET OF THINGS
Will we see the security for IoT emerging
along new IoT solutions, or will we have to wait?
David Clarke, VCiso: IoT will move from
becoming unsafe to manageable security,
the technology is there already.
Stephan Conradin: We have to wait. Too
many devices exist with poor security or
no security at all. It’s impossible to change
all devices and components very fast. Remember migration from IPv4 to IPv6, not
months or years, but decades.
The industry needs to learn from its mistakes as it builds devices that connect via
the Internet. Best practices security, such
as using secure protocols for communication or installing the latest updates, fixes
and patches, are the starting point. Innovators must consider that future security will be managed automatically by the
system instead of users, and designing
secure technology will require a new
approach and mind-set.
Kenneth C. Citarella, Guidepost Solutions:
We must include new security with new
developments. Waiting is too great of a
risk.
Amber Schroader, Paraben Corporation:
We, as an organization, have been focusing on it for over a year now and will continue to do so. IoT is here to stay and will
only grow in popularity and connectivity
which causes each individual's digital fingerprint to grow. There is also a great
deal of interest from governments to safeguard new connections and warn business
and home users of the increased risks that
arrive with connecting new devices.
David Coallier, Barricade: Most definitely.
The SaaS tech-model wherein a platform
that processes large amounts of data to
come up with decisions will start emerging.
Irfan Shakeel, EH Academy: We will not
have to wait; we will see the direct impact
in the year 2016. We will see the research
papers, findings /solutions, products to
secure the IoT. It will change the business
dynamics and the education as well.
Roberto Langdon, Nicolas Orlandini,
KPMG: Again, Security Awareness is a
must.
Andrew Bagrin, My Digital Shield: Usually
we have to wait because we need to know
what it is we are securing and what the
vulnerabilities are.
www.eforensicsmag.com
www.hakin9.org
- 89 -
W
HO IS
WHO
Amber Schroader
Paraben Corporation
CEO & Founder
Kenneth Citarella
Guidepost Solutions
Senior Managing Director
Throughout the past two
decades Ms Schroader
has been a driving force
for innovation in digital
forensics. Ms. Schroader
has developed over twodozen software programs
designed for the purposes
of recovering digital data
from mobile phones, computer hard drives, email,
and live monitoring services. Ms. Schroader has
taught and designed the
established protocols for the seizure and processing of
digital evidence that have been used by numerous organizations throughout the world. Ms. Schroader has
coined the concept of the “360-degree approach to digital forensics” as well as started the momentum and
push to the “Forensics of Everything-FoE” with her focus to unique problems in digital evidence and solutions.
Kenneth Citarella is a senior managing director
for the Investigations and
Cyber Forensics practice.
He joined Guidepost Solutions in 2010 as a project manager to investigate fraudulent claims
for the Gulf Coast Claims
Facility in its administration of the $20 billion BP
compensation fund. In
that capacity, Mr. Citarella supervised 300 professionals, including more than 200 field investigators.
Nearly 18,000 claims were referred for investigation;
many involved the financial analysis of a claimant’s business operations, including numerous constructionrelated entities. The project team wrote thousands of
fraud reports which were described by an official of the
U.S. Department of Justice as the finest body of investigative work he had ever seen.
David Clarke
David has experience across Finance, Telecoms, Public Sector including developing CERT on a Financial Intranet trading $3.5 Trillion a day , Managed Security
Services with a $400 million dollar Global install base, including Leading edge
Product Selection ,implementation and architecture. In these sectors David
has built Secure operations capabilities often from scratch, developed full Cyber incident response expertise , created , maintained and improved regulatory and compliance commitments including PCI-DSS, ISO 27001.
www.eforensicsmag.com
www.hakin9.org
- 90 -
T
OOLS OF THE TRADE
How will tools evolve in 2016?
Michael A. Goedeker, Auxilium Cyber Security: They will become easier and faster
to use. There will be more emphasis on
the value a tool has to security and where
it obtains that information from.
David Coallier, Barricade: Businesses deserve security that isn't adversarial, complicated and confusing. The job of a security professional shouldn't be to stare at a
screen all day but rather promote and
encourage good security procedures and
behaviour across the organisation. Both
emerging and new tools are helping in
solving that problem.
Shay Zandani, Cytegic: The main evolvement will be in the cybersecurity management solutions field, due to the fact that
already CISOs and other security personnel are overwhelmed with the abundance
of defenses, policies and procedures, and
they must have a management system
that they can use as a vehicle to streamline and update operations and policies.
Wade Johansen, CouriTech LLC: More will
focus on geographical information and
isolation as well as virtual distribution models.
Julie Herold, Kenny Herold, Odin’s Eye:
Increased reliance on existing automated
tools to help companies achieve compliance to avoid financial penalties and
less investment and focus on manual assessments. As a result, automated tools
that typically scratched the surface will
mature as the compliance and regulatory
demands increase. The increase in demand will force vendors coding tools to
be more and more sophisticated and accurate and easier for anyone to utilize.
Andrew Bagrin, My Digital Shield: I believe
endpoint will become less effective and
will eventually go away.
Dennis Chow, Millar, Inc: We will probably
see more advancements in prediction vs.
detection based tools with the addition of
complementing tools that augment existing gaps in things like access control,
social engineering attack detection, and of
course, more 0-day detection.
Stephan Conradin: No real changes as
tools are not designed with security at the
design. We’ll have nicer interfaces and
still 50 security patches per year.
Ondrej Krehel, LIFARS: They will try to make things easier, adding more usability for
untrained staff.
www.eforensicsmag.com
www.hakin9.org
- 91 -
T
OOLS OF THE TRADE
How will tools evolve in 2016?
Alina Stancu, Titania: There will be a boost
in automation, in order to keep up with
the sheer amount of data. As connectivity
has surpassed security, the number of
vulnerabilities and back doors has increased as well. Complex, interconnected systems require complex security tools. While there is no single tool that can successfully secure everything, there are certainly an array of solutions that can be
used together to minimise threats. The
key is not a bulk buy of the newest consoles. The key here is an intelligent risk assessment of the risks and capabilities of
individual organisations, in order to apply
tools and tactics in an efficient, costeffective manner.
Mitchell Bezzina, Guidance Software:
Tools will continue to diversify for customer types, in most industries there are
experienced and new users who have vastly different requirements and job functions, solutions will adapt to cater for larger audiences and aim to create operational efficiency.
Roberto Langdon, Nicolas Orlandini,
KPMG: Forensic technologies and Data
Analytics will be the drivers to push the
investigation activity all over the world.
Data Analytics tools are focused on bringing more versatility to users, in order to
help them optimize the information filtering, identify potential irregular patterns in
huge volumes of information and select
the tagged pieces of evidence, the most
sustainable and specific ones. Cross information with other sources will help to
obtain a wider scope to the investigators,
because besides local equipment, pen
drives, CDs, DVD, tablets, notebooks, and
smartphones, there is a lot of information
inside Cloud Services.
Wade Lovell, Simpatic: Scanning tools, e.g.
NMap and ZenMap, will become even
more important and move into consumer
products. More tools will be deployed in
real time environments. Intelligent
pattern recognition will continue to develop and will be at least partially capable of
stopping bad actors, e.g. shutting down
ports under attack.
David Clarke, VCiso: Vendors with the
most R&D budget will dominate the market place, most tools will need to be managed by 3rd parties due to complexity.
www.eforensicsmag.com
www.hakin9.org
- 92 -
T
OOLS OF THE TRADE
Will the trend to eliminate passwords continue?
Michael A. Goedeker, Auxilium Cyber Security: Not sure about passwords but the
way we authenticate will evolve.
Andrew Bagrin, My Digital Shield: Yes, no
one likes passwords, but a standard solution is needed.
Mark Bennet, Blustor: The trend to eliminate passwords will continue and will likely accelerate as more devices support biometric authentication. We will see the
emergence of new two-factor authentication solutions as they incorporate the security benefits of biometrics.
Stephan Conradin: The password is often
still the least bad solution and with SSO it
remains comprehensible to the user without being too restrictive.
Paul Hoffman, Logical Operations: Yes, it
is tough to change the habits of people
and making secure passwords and changing them often is not easy. The quickest
way to affect security is to have a new
authentication method that is personal.
Wade Johansen, CouriTech LLC: Not yet, it
is still far too common and there are not
enough options to remove this as a staple
method of identification and authorization. However, you will see more dual factor authentication requirements in 2016
as well as chip technology taking a strong
foothold.
Mitchell Bezzina, Guidance Software: Yes,
biometric scanning will be household and
the use of passwords will be limited, however, the wide adoption will take years
for manufacturers to standardize so that
applications can make connections to hardware.
Dennis Chow, Millar, Inc Short: There will
be efforts, but unfortunately, it’s not going away anytime soon. Passwords are
still the most wide spread, easiest, and
most affordable method of access so far.
BroadTech Security Team: I think yes, and
I think we should do away with passwords
altogether. It is not secure at all these
days, even the conference rooms have
surveillance cameras that can suck up your password. But a one size fit all parallel
implementation won’t be possible.
Einaras Gravrock, Cujo: Absolutely. However, expect 2016 to be the year of new
proposed solutions and not yet a solution
for what will actually be adopted.
www.eforensicsmag.com
www.hakin9.org
- 93 -
T
OOLS OF THE TRADE
Will the trend to eliminate passwords continue?
Dotan Bar Noy, Re-Sec Technologies: I
think the trend will continue but there is
still a very long way before biometric measures could replace old style passwords.
This is true both for large enterprises as
well as for SMBs. The rise of biometrics
identification measures we saw in mobiles
will take a very long time before it will
make the move to desktop computers.
David Clarke, VCiso: Yes. Strong authentication may need to be legislated to remove passwords.
Ondrej Krehel, LIFARS: Passwords are great. We just need more factors beyond it.
Wade Lovell, Simpatic: Yes. People are
fundamentally lazy and the standard 8
character password can be cracked in ten
seconds. 59% of adult users in one recent
survey said they use a single password for
every site. While password managers are
breathing new life into passwords, they
won’t stem the tide.
Julie Herold, Kenny Herold, Odin’s Eye:
No, many attempts have been made to
eliminate the need for passwords and
most of them have failed. The only successful ones are smart cards/HSMs for
nation state and the financial industry and
this is too costly to implement and has a
high learning curve and maintenance cost
associated with it that organizations and
companies will deem unnecessary as a
result of the impact to end users.
www.eforensicsmag.com
www.hakin9.org
- 94 -
T
OOLS OF THE TRADE
What new technology will make an impact
on cyber security the most?
Michael A. Goedeker, Auxilium Cyber Security: We believe ours! Dark Energy is
the first framework of its kind aimed at
using components from open source,
being open system and not telling a customer or partner what threat feed to use,
AV, ITAM, etc. It simply makes all that info
and systems finally actionable. We would
hope that AV companies, SIEM, VA and
other security companies discuss and help
us create the world's first unified threat
intelligence framework!
Roberto Langdon, Nicolas Orlandini,
KPMG: Organizations need to invest in the
right tools, as well as the right people.
They need visibility first and foremost, to
know if they are being attacked. Without
visibility, it’s impossible to identify holes
in the security arsenal and weaknesses in
infrastructure. There are organizations
that have been compromised for years
before they discovered the damage.
Przemek (Shem) Radzikowski, Secbüro
Labs: Attackers and criminal organizations
have been cooperating together for many
years, and in many respects are a decade
ahead of the rest in terms of their effectiveness. However, the adoption of cloud
technologies has had a positive effect on
our threat intelligence. By funnelling large
data segments through relatively few
cloud platforms, we have been able to
collect valuable intelligence on the techniques, attack vectors and origin of
attacks. Correlating these across regional
and organizational boundaries gives us
even more intelligence. This plus a push
from industry players to share such intel
freely, will only improve our ability to deploy proactive countermeasures.
Wade Johansen, CouriTech LLC:
Encryption. It is now available to everyone
for everything - so governments will no
longer have the intelligence gathering
capabilities they once were privy to and
that will impact every person on the planet.
David Coallier, Barricade: As a company
working hard on leveraging machine learning and artificial intelligence we believe
large-scale analysis will play a major role
in changing how the security industry
works. We want to eliminate the concept
of rules and integrate the concept of behaviours.
Wade Lovell, Simpatic:
Simply secure
communications will have the greatest
impact in coming years because 91% of all
hacks start with email.
BroadTech Security Team: It may not be
technology but awareness and a more
discerning use of available technology.
www.eforensicsmag.com
www.hakin9.org
- 95 -
T
OOLS OF THE TRADE
What new technology will make an impact
on cyber security the most?
Andrew Bagrin, My Digital Shield: Definitely IOT.
David Clarke, VCiso: Secure mobile phones, and technologies that replace password technology.
Mitchell Bezzina, Guidance Software: Moving to a completely cloud based office
where laptops only store temporary data
worked on offline, or “checked-out”. This
will force us to redefine all security rather
than segments.
Ondrej Krehel, LIFARS: One that can take
all the devices and manage them in a single place.
Rick Blaisdell: The IoT makes every
"smart" device susceptible to hacks. Many
of these devices will be interconnected,
which will make machine-to-machine
trust increasingly more important. It's not
just the channel they use to communicate
that needs to be trusted (TLS encryption),
but also whether the devices at the other
end should be trusted at all. This issue will
become even more relevant when selfdriving cars begin to communicate with
each other. They will need to be able to
identify illogical commands or spoofed
communications, and they will need to do
that automatically without human intervention.
Julie Herold, Kenny Herold, Odin’s Eye:
Technology that is developed to share
intel across companies in different industries. The attackers are already sharing
their intel for profit; we are just behind
and need to adopt their methods to keep
up.
Stephan Conradin: The human factor, but
it is not a technology. The first line of defense should remain the intelligence of
the human, his understanding of the risks,
his awareness of his actions,
Rajeev Chauhan: Two factor authentication including dna matching.
Dotan Bar Noy, Re-Sec Technologies:
Within enterprises big data analytics and
machine learning looking for patterns will
make the life of the hackers harder. Additional gate solution that can ensure content introduced to the users are free from
any threats (known and unknown).
www.eforensicsmag.com
www.hakin9.org
- 96 -
T
OOLS OF THE TRADE
What new trends will we see on threat
intelligence?
Michael A. Goedeker, Auxilium Cyber Security: It’s doing its job! There are many
companies that have feeds but the question is always about value. Fancy maps
are nice but what good does the information in that map do really? How is the data collection any different than using a
RasberryPi2 with Snort, etc? We build our
own network of sensors (Pi2’s, DMZ sensors, etc) and use this information to find
differences and turn that information into
actionable intel. But we also use other
areas of data collection (all legal!). OSINT
is something surprisingly missing in all
threat intelligence feeds so we created
our own system that also includes that.
Wade Johansen, CouriTech LLC: Creating
virtual peer to peer networks (ready made) and selling them as being darknet ops.
Continued infiltration of current botnets,
and C&C centers as well as placement of
compromised servers into anonymous
systems.
Mark Bennet, Blustor: The continued
growth and use of biometric authentication will have a profound impact on cyber
security – both improving security as well
as creating a new set of vulnerabilities
that are not being effectively addressed
by the mobile device industry.
Stephan Conradin: More collaborative
work to share knowledge.
Anthony Di Bello, Guidance Software: Likely a standardization of one or two formats. We will see a Betamax/VHS situation emerging between the many
“standards” that currently exist such as
STIX and YARA.
Dennis Chow, Millar, Inc: Possibly the inclusion of other threat vectors for true intelligence such as physical, signaling, and
other disciplines that can be combined
into cyber.
Mitchell Bezzina, Guidance Software: Intelligence platforms will emerge to
converge threat intelligence providers
into one connectivity source, cost of threat intelligence will lower due to commoditization
Shay Zandani, Cytegic: Geographic and
Industry-specific trend analysis and automatic pattern recognition will be mandatory for large organizations who want to
be able to take informed preemptive decisions in cybersecurity
www.eforensicsmag.com
www.hakin9.org
- 97 -
T
OOLS OF THE TRADE
What new trends will we see on threat
intelligence?
Roberto Langdon, Nicolas Orlandini,
KPMG: One way companies can expand
their expertise is by bringing in security
intelligence to pinpoint problems, identify
anomalies and highlight unusual or suspicious activity. Intelligence can help in two
ways. First, an “early-warning-as-aservice” can reduce the vulnerability threat window: the time between the detection and the remediation of an attack.
Intelligence can also provide a broader
picture of global threats than any one organization could gather on its own. Security is an ecosystem; organizations need
to know what is going on externally as
well as internally. Organizations can
expand their own intelligence by using
Threat Intelligence tools for consolidating,
analyzing and sharing information about
their own security threats with peers and
competitors. While this is a sound idea in
theory, sharing information with competitors is not something many organizations
are willing to do—yet. Understanding the
threat landscape and knowing your enemy with security intelligence is another.
What you can’t prevent, you should try to
detect. And what you can’t detect, you
should be prepared to respond to quickly.
Ondrej Krehel, LIFARS: Better integration
and multiple source management.
Wade Lovell, Simpatic: Threat modeling
for real-time response will become the
new norm even in small organizations.
David Clarke, VCiso: Threat Intelligence
may be the catalyst to make IT safe.
Andrew Bagrin, My Digital Shield: Simplification as opposed to flexibility. Security
needs to start making a stand and force
software developers to start following
standards when they communicate across
the network.
www.eforensicsmag.com
www.hakin9.org
- 98 -
W
HO IS
WHO
Shay Zandani
Cytegic, Co-founder and
CEO
Rick Blaisdell
Experienced CTO, creating
technical strategies which
reduce IT operational costs
and improve efficiency. Rick
has 20 years of product, business development and high
-tech experience with Fortune 500 companies, developing innovative technology
strategies, with particular
expertise in cloud computing integration, delivering
cost effective IT services, strategic planning and development for Information Systems, and creating innovative businesses
Shay’s entrance into cyber
security was on the nationstate cyber battlefield
when he founded the Information Warfare Department at the Israeli Air Force. Under his leadership,
the IWD pioneered the use
of data manipulation for
cyber offense. He then
spent more than a decade
as CEO of Kesselman Global Risk Management Solutions (GRMS), a subsidiary
of PwC focused on conducting risk and cyber security
maturity assessments for
large enterprises. Prior to
PwC, Shay participated in
establishing the first TTP Certificate Authority in Israel.Shay’s unique blend of private and public sector
experience and deep understanding of how cyber risk
evolves and impacts an organization’s bottom line helped crystallize his vision for Cytegic. He received his
bachelors and masters degrees in computer science
from the Open University of Israel, and his Executive
MBA from Northwestern University and Tel-Aviv
University, upon graduating from Mamram, the IDF
(Israeli Defense Forces) technical elite unit in 1990.
Wade Lovell
Simpatic, CEO
Wade Lovell has founded
eight companies with $200+
million in stakeholder returns. Wade began his career at Goldman Sachs and
Arthur Andersen. He has an
MBA from Columbia Business School and is a financial services expert. He is a
CPA, former CFE, EA, and has held Series 3, 7, 63 & 24
designations.
Dotan Bar Noy
Re-Sec Technologies Ltd, CEO and Co-Founder
Lt. Commander Israel Navy has more than 10 years of management experience in several leading
companies and startups in Israel and US.
www.eforensicsmag.com
www.hakin9.org
- 99 -
A
REAS OF SECURITY
What are your predictions
for network security in 2016?
Michael A. Goedeker, Auxilium Cyber Security: The push for more automation will
eventually happen. We have started this
process by being the first company to introduce our copyrighted concept of the
„Self Protecting Network”.
Wade Johansen, CouriTech LLC: It will
continue to grow as a field, and businesses will be required meet new standards if
they want to trade at global levels.
Wade Lovell, Simpatic: I anticipate a rise
in the adoption of security appliances and
air-gapped internal networks in 2016
(similar to the structure of the 1970’s and
early 1980’s when each company had its
own mainframe that did not communicate with the outside world).
Mark Bennet, Blustor: As more employees
telecommute and the workforce continues to become more mobile, network security will continue to evolve to better
support granting secure and remote access to enterprise networks. A key concern is positively identifying that a remote
employee is, in fact, who they claim to be
at the point of entry into the network. We
will see the incorporation of biometrics as
one of the key solutions. Companies will
also discover that storing an employee’s
biometrics in a centralized location comes
with tremendous liability in the event that
data ever becomes compromised. Solutions such as BluStor’s CyberGate
platform are uniquely positioned to help
address those types of risks.
Julie Herold, Kenny Herold, Odin’s Eye:
“All your eggs in one basket” – We see
SaaS, PaaS, IaaS, with many tenants becoming a target for network pivoting between organizations and/or the presence of
malicious faux companies establishing
presence to increase the proximity to targeted organizations.
Mitchell Bezzina, Guidance Software:
Expect more breaches where organizations had detected compromise long before data theft, but mishandled the original response. This trend will continue to
drive changes in incident response process, and the depth of forensic investigation.
Leon Kuperman, Zenedge: Increased
DDOS attacks in both size and complexity.
Increased penetration into corporate networks, where threat actors wait and stay
longer without detection. New attack
methods for hiding command / control
communication.
www.eforensicsmag.com
www.hakin9.org
- 100 -
A
REAS OF SECURITY
What are your predictions
for network security in 2016?
Alina Stancu, Titania: Network function
virtualisation (NFV) is a rapidly evolving
aspect of virtualisation which was created
in an effort to speed up deployment of
network services. NFV is great for streamlining specialised network tasks onto a
single platform, but it is significantly more
complex and makes attacks harder to
identify, in its multi-layered form. Software defined networks (SDNs) have been
created on campuses and developed in
cloud data centres. Used in combination
with NFV, they can offer greater value to
existing services, making it more scalable
and fully-automated. Further risks come
in the shape of open source software that
these new technologies are based on and
larger attack surfaces. Auditing and penetration services will rise as more industryled standards become ingrained in business practices. From PCI-DSS to SANS, HIPAA or FISMA businesses are more under
pressure to comply with policies specific
to the country they operate in, or the industry sector they cater to.
Anthony Di Bello, Guidance Software:
Attackers will remain undetected for longer as evasion methods become more
complex.
Stephan Conradin: Still a lot of DDOS.
Ondrej Krehel, LIFARS: I think network
taps will be more common.
Roberto Langdon, Nicolas Orlandini,
KPMG: Our predictions on network security depend on the extent at which the
people responsible for technological
platforms, recognize all the tools, policies
and procedures that must be added to the
existing ones. Different surveys conclude
that about 40% of the market did not implement Intrusion Prevention Systems
(other vendors call them Next Generation
Firewalls) to protect the application level
in the OSI model. If this is true, and on the
other hand the Top 10 OWASP recommendations are not followed and assured
in the organizations, the cyber delinquents still have a lot of work to do.
David Clarke, VCiso: Software defined networks, legislation and password technology replacement.
Andrew Bagrin, My Digital Shield: I predict that there will be more pre-filter, trying to deliver a prescrubbed internet service, as opposed to giving more tools to
try and scrub it themselves.
Paul Shomo, Guidance Software: Variants
of malware will increase to limit the ability for indicators of compromise being easily defined.
www.eforensicsmag.com
www.hakin9.org
- 101 -
A
REAS OF SECURITY
What are your predictions
for software security in 2016?
Michael A. Goedeker, Auxilium Cyber Security: Secure coding will continue to be a
vital part of any security methodology.
OS’s with integrated spyware will be less
and less acceptable and will see business
revenue drop. This will push Open Source
OS’s for the second time.
Mitchell Bezzina, Guidance Software:
Endpoint technologies will be the main
focus for 2016, redefining the replacement for antivirus. This allows networks
to be understood and secured from the
inside out and provides a means of detection and response to all threats.
Einaras Gravrock, Cujo: We will see many
new solutions focused on network traffic
patterns, big data, and machine learning.
Stephan Conradin: Still 50 security patches per year for each software because
software have no security by design,
OWASP will continue their very good job
of explaining how to avoid SQL Injection
and we’ll see SQL injection
Julie Herold, Kenny Herold, Odin’s Eye:
The heavier we move code reliance on the
client for storage and processing, the more attacks that will be developed in server
response and client-side code tampering
versus the more traditional and more secure server side attacks in client requests.
Paul Hoffman, Logical Operations: Move
to secure coding. Patching holes before
launching software.
Rick Blaisdell: Backup and recovery will
become synonymous with security. With
the explosive growth of structured and
unstructured data, improving backup and
recovery time will be a big hurdle for the
enterprise. Vendors will rely on automated tiered solutions and data deduplication to address the challenges of
heterogeneity of technology. Encrypted
data backups and agentless cloud-based
replication will become the norm for data
security.
Ondrej Krehel, LIFARS: Hopefully, the
SDLC will include more security, hopefully
being sent to a security specialist and not
a dev.
Wade Johansen, CouriTech LLC: Much of
it will become platform independent and
include focus on mobility and portability.
Dennis Chow, Millar, Inc Short: More focus and demand in SSL/TLS based decryption.
www.eforensicsmag.com
www.hakin9.org
- 102 -
A
REAS OF SECURITY
What are your predictions
for software security in 2016?
David Clarke, VCiso: Self contained security in software, vulnerability management
designed in as part of software maintenance, password technology replacement.
Wade Lovell, Simpatic: Apps – corporations will start controlling the approved
and therefore available apps on BYODs.
Antivirus – consumer antivirus programs
will move up market in order to remain
viable. AVG, for example, is struggling under the weight of its free model and has
moved to freemium offerings and addons.
Andrew Bagrin, My Digital Shield: It will
continue to struggle to keep up. I’m assuming this is referring to endpoint.
www.eforensicsmag.com
www.hakin9.org
- 103 -
A
REAS OF SECURITY
What are your predictions
for hardware security in 2016?
Michael A. Goedeker, Auxilium Cyber Security: We already train our partners and
customers in „hardware hacking”. Many
instances have shown that hardware and
the associated firmware is a valid attacking vector. We are no longer just dealing
with software viruses and malware, we
are also dealing with firmware, side channels and newer aversion techniques to
hide protocols and suspicious traffic and
activities.
Wade Lovell, Simpatic: Manufacturers
will continue to be plagued by their own
errors and government demands for backdoors. They will also be compelled to offer
economic incentives for successful hacks
against their hardware, e.g. Cisco routers,
in order to attract a real mining effort on
the part of the white hat community.
Einaras Gravrock, Cujo: We will see an
increasing amount of hardware makers
who will rely on third party platforms to
build software for their hardware. Those
third party platforms, a combination of
hardware security and software security,
will help IoT makers build less vulnerable
devices.
Julie Herold, Kenny Herold, Odin’s Eye:
We think there will be an increased focus
on uncovering intentionally placed holes/
gaps within the hardware space that are
baked into the solution at low levels.
Ondrej Krehel, LIFARS: More 2+ factor
tools for access.
David Clarke, VCiso: Hardware security
appliances may make a comeback as virtualisation may still be very vulnerable to
skill shortages and software exposures.
Stephan Conradin: Perhaps more concerns with corrupted devices by firmware,
and questions like How to trust manufacturers.
Paul Hoffman, Logical Operations: More
use of built-in BIO security.
Andrew Bagrin, My Digital Shield: Hardware security is fine, but it doesn’t need
to be on specialized hardware. For 2016, I
don’t believe there will be much change.
Wade Johansen, CouriTech LLC: TPM will
make a larger impact, and we will continue to make smaller, faster IOPs capable
data devices for the data center.
www.eforensicsmag.com
www.hakin9.org
- 104 -
A
REAS OF SECURITY
What are your predictions
for cloud security in 2016?
Michael A. Goedeker, Auxilium Cyber Security: National and International Privacy
will continue to shape this industry and
how products are hosted to international
customers and partners. As more services
and resources are put into the cloud, so
too will the regulations and audits needed
to verify compliance evolve. As more services are hosted in the cloud, it then becomes an even bigger target.
Rajeev Chauhan, Cyber Oxen: IOT will
dictate the security in cyber space scenario including all the areas of security mentioned above. The boundaries between
hardware and software security will merge.
Wade Johansen, CouriTech LLC: AWS and
Azure will make cloud security a priority
this year. There appears to be a lull in the
adoption of more cloud based services,
and in large part, it’s because the security
has been behind. That will be rectified this
year.
Ondrej Krehel, LIFARS: I hope the providers will be more secure in their deployments.
Mark Bennet, Blustor: There is an interesting growth trend in the number of
whitepapers and articles that have been
published over the past year that espouse
the increased security of cloud based solutions. While these claims are partially
true, a close examination of many of the
articles reveals that they are often sponsored by companies that provide cloud
based solutions or related services. The
reality is that the cyber security in the
cloud is still largely immature, unproven,
and there are ample examples of failures.
Like the growth of mobile devices, the
cloud is a tremendously powerful tool but
carries with it the risks of what is still a
young and rapidly evolving industry. Enterprises need to carefully examine how
access to cloud based data and applications are effectively controlled.
Leon Kuperman, Zenedge: Cloud is an
area where the industry is behind. There
are no solid security standards for multicloud deployments / implementations.
New solutions will need to be introduced
to close the gap between on-prem
(mature) security and cloud infrastructure.
Wade Lovell, Simpatic: More companies
will move to universal two factor authentication. True secure end to end encrypted email and chat will start replacing insecure desktop and mobile email in particular. Companies will force https connections to all web sites accessed from within
their organization and eventually move to
white lists.
www.eforensicsmag.com
www.hakin9.org
- 105 -
A
REAS OF SECURITY
What are your predictions
for cloud security in 2016?
David Coallier, Barricade: Huge year for
cloud security. More companies are becoming aware that "the cloud" is not a silver
bullet but also not completely insecure.
Tools who are born on the cloud will
prevail as it is clear that incumbents who
are retroactively adapting their tools for
cloud products are simply not good at it.
The pricing models for the security industry, which has traditionally been contract
-based, has to change to reflect how people use the cloud. The SaaS model for security will grow.
Stephan Conradin: With cloud we delegate our security without strong controls.
Sooner or later, there will be a serious
incident.
Dennis Chow, Millar, Inc: Many more vendors and startups coming to complement
access controls and data discovery/data
control.
Mitchell Bezzina, Guidance Software: Large Cloud Vendors will be forced to make
virtual machines of computer systems
available to security teams for incident
response investigations in response to
new data breach notification regulations.
Without access to full machines, response
teams are limited in their ability to acquire all data quickly, this may also affect
SaaS providers and will likely lead to instrumental case between a breached organization and its cloud provider.
Paul Hoffman, Logical Operations: More
security controls.
Andrew Bagrin, My Digital Shield: Security
in the cloud and securing the cloud are
two different things. I believe there will be
a much bigger move to providing security
in the cloud (pre-scrubbing).
Julie Herold, Kenny Herold, Odin’s Eye:
We think technologies like Chef, Puppet,
Ansible, SaltStack and Docker will be targeted by attackers to proliferate backdoors, misconfigurations with the intention of abuse, and malware. Of course,
this would also include any other patch
management, centralized security appliances/solutions etc.
Rick Blaisdell: Cloud security will increase
in scale, and decrease in complexity. In
2016, we’ll see cloud security evolve into
simpler, virtualized controls and solutions
that will have embedded security processes to help map current IT systems. Heavy
protective layers that have difficulty scaling in the cloud will stay behind, and next
year will have lighter, scalable cloud security solutions.
www.eforensicsmag.com
www.hakin9.org
- 106 -
A
REAS OF SECURITY
What are your predictions
for cloud security in 2016?
Craig McDonald, MailGuard: 2016 will be
the first year cloud services will be chosen
because of their enhanced security. People are at risk of physical harm as nextgeneration technologies are targeted. Cyber attackers will fund unpatched vulnerabilities in smart-connected home devices
as a way to stage a full-blown attack. There are no signs of a wide scale attack coming but this scenario is highly probable.
Attacks on next generation payment methods – from EMV credit cards to mobile
wallets – will increase. Mobile malware is
expected to grow exponentially with
much of this originating in China. Hacktivists will use data breaches to systematically destroy their targets. Businesses will
also fall for elaborate tricks that use new
social engineering lures. Expect a big increase in ploys that persuade employees
to transfer money to cybercriminalcontrolled bank accounts. Their first step
is to become familiar with the target’s
ongoing business activities, so their malicious schemes are camouflage. This is typically done by intercepting communications between business partners.
David Clarke, VCiso: Cloud availability and
a minimum of dual (maybe internet and
private) connectivity. Cloud services will
help mitigate skills shortage in cyber security.
Irfan Shakeel, EH Academy: Cloud security
will face new challenges; hackers are more likely to exploit the human vulnerabilities. Organizations have to invest in training programs; the certification providers
will also create the cloud specific certificate and training to capture the market need. Over all, the business will grow.
www.eforensicsmag.com
www.hakin9.org
- 107 -
W
HO IS
WHO
Ondrej Krehel
Lifars, CEO and Founder
Julie Herold
Odin’s Eye
Senior Security Consultant
He is the CEO and Founder of LIFARS LLC, an
international Cybersecurity Intelligence, Digital
Forensics, and Incident
Response firm. Ondrej
also leads the Digital
Forensics team at LIFARS. He’s the former
Chief Information Security Officer of Identity
Theft 911, the nation’s
premier identity theft
recovery and data breach management service. He previously conducted forensics investigations and cyber security consulting at Stroz
Friedberg. With two decades of experience in
computer security and forensics, he conducted a wide
range of investigations, including data breached
through computer intrusions, theft of intellectual property, massive deletions, defragmentation, file carvings,
anti-money laundering, financial fraud, mathematical
modeling and computer hacking. Ondrej’s experience
also includes advanced network penetration testing using various tools and technologies, database security
testing, physical security assessments, logical security
audits, wireless network penetration testing, and providing recommendations for operational efficiency of
approaches.
Strong eleven year development
background for a Fortune 10 company and 2 years of penetration
Kenny Herold
Odin’s Eye
Principal Security Consultant
4 years of experience as a service
lead for anti-spam/anti-malware/
anti-virus working for a Fortune 10
company at a global scale as well
as 2 years of general application
security background and 5 years of
penetration testing in aforementioned company and an additional 2 years of penetration
testing for Odin’s Eye, LLC.
Alina Stancu
Titania Marketing Coordinator
She is Marketing Coordinator at
Titania and has spent the past two
years, learning, talking and writing
about information security. She is
also a contributor to The Analogies
Project.
www.eforensicsmag.com
www.hakin9.org
- 108 -
T
HE INDUSTRY
Will 2016 belong to start-ups or big cyber security
corporations?
Chase Cunningham, Cynja: Startups will
continue to be the real infosec innovators.
I predict large companies will pick up their
pace of acquisition of these smaller firms.
From where I sit, the large companies
aren’t concerned or even working towards much innovation in the space as it
is cheaper to simply buy the little guys
out. This “trend” is basically leading to the
establishment of a market wherein anyone can start a company, come up with
something 1% better than someone else
and get bought for a lot of money, then
go off and do it again.
Irfan Shakeel, EH Academy: 2016 will belong to the start-ups of the infosec companies. Startups will focus on vulnerability
research, threat intelligence & monitoring
tools. The infosec service sector will likely
to grow, as more organizations are looking for services.
Leon Kuperman, Zenedge: Disruptive Startups.
Einaras Gravrock, Cujo: The tide’s going to
be growing for all types of companies.
New sectors within cyber security will create new giants from startups. Overall, this
is growing so fast… with such a huge demand for products and sectors within cyber security the space will continue booming in 2016 and beyond.
Michael A. Goedeker, Auxilium Cyber Security: Hard to say really. Start-ups will
happen, the question is if big cyber corps
will start to get more pressure to think
dynamically like start-ups do.
Wade Johansen, CouriTech LLC: Startups
will be less of an influence in 2016 as the
market becomes more global, they just
don’t have the capability of tapping
worldwide systems for the intelligence
gathering in an increasingly hostile environment.
Mark Bennet, Blustor: In 2016, the growth
of IoT, increased public awareness of cyber security issues, and the global expansion of Internet access will provide tremendous opportunities for cyber security
start-ups. As typical of most industries,
disruptive innovation is largely driven by
small start-ups. We will see continued
innovation in the cyber security space as
well as consolidation as larger companies
acquire start-ups with promising technology.
Elizabeth Houser, Praesidio: Startups. Larger cybersecurity corporations don’t offer
the agility or innovation that startups
bring to table.
www.eforensicsmag.com
www.hakin9.org
- 109 -
T
HE INDUSTRY
Will 2016 belong to start-ups or big cyber security
corporations?
David Coallier, Barricade: Startups. The
tech world moves so fast that the incumbents are stuck in the innovator's dilemma and only the smaller, more agile companies are able to move at the pace at
which the security industry should be
operating.
Stephan Conradin: Neither one nor the
other. Good ideas are emerging in small
entities but great entities have the ability
to act. They have to collaborate.
Wade Lovell, Simpatic: 2016 is a year for
start-ups to show their agility.
Alina Stancu, Titania: Mergers and acquisitions in the industry will continue to take
place. Small cyber security boutique-style
companies, which have the flexibility to
develop innovative solutions at a fast pace, will be acquired by bigger, more established companies. Something which big
enterprises find more difficult. However,
as demand for more than one solution
addressing different needs increases, big
corporations choose to increase their
portfolio of in-house solutions.
Craig McDonald, MailGuard: The big security players are at risk of being disrupted by agile emerging competitors.
Their challenge is to start delivering the
next generation of security solutions for
the cloud, where they lag behind. Expect
to see the big players courting and buying
small vendors – unless they can finally
achieve some innovation in their current
product offerings. As Microsoft’s Azure and AWS compete for business, they
will focus on new and improved security
features, in particular, helping customers
to have greater control and visibility into their cloud. As they reach ‘feature parity’ in the IaaS (Infrastructure-as-a-Service)
space, rich security capabilities will become their differentiators, either through
additional platform features or third-party
offerings.
Paul Hoffman, Logical Operations: There is
room for both. The big companies’ will
have it easier because they already have
customers, but startups will have innovative technology that will make them
relevant.
Ondrej Krehel, LIFARS: New players will
always be great, but they can be bought
out.
Rajeev Chauhan: There is ample space for
startups as not all industries can afford
highly expensive services of corporations.
www.eforensicsmag.com
www.hakin9.org
- 110 -
T
HE INDUSTRY
Will 2016 belong to start-ups or big cyber security
corporations?
Dotan Bar Noy, Re-Sec Technologies: We
are at time where the big vendors dominate the more conservative solution and
reinventing themselves by acquiring innovative new technologies. The startups
are the ones that will introduce the disruptive technologies that will be necessary in order to combat new types of malware.
Nick Prescot, ZeroDayLab: Clients are looking for the right company to do the right
job, the benefits won't change.
David Clarke, VCiso: Both as the bigger
ones will buy the start-ups.
Gerald Peng, Mocato: Start-ups. In the
first half of 2015, venture firms invested
$1.2 billion into cybersecurity start-ups
(CB Insights). Corporate customers want
to avoid destructive attacks that can hurt
their brand names and consumers are
trying to protect their private information.
These firms are finding innovative ways to
capitalize on that need.
Anthony Di Bello, Guidance Software: I
think the question is more will 2016 belong to broad security vendors (such as
Palo Alto, McAfee) or niche best-of-breed
vendors (such as Blue Coat, Guidance software). I believe we will see a focus on
integrated best-of-breed solutions, the
mix of which being different at each enterprise based on their unique environment and threat types.
Andrew Bagrin, My Digital Shield: Definitely startups!
BroadTech Security Team: Nothing will
hinder startups though some will fail. Many of the products of cyber security corporations will become a public disgrace.
Julie Herold, Kenny Herold, Odin’s Eye:
Larger security corporations because of
the increased demand, lack of consumer
knowledge in what they need as far as
breadth and depth for defensive or proactive offensive testing and mitigation
and/or remediation advice.
www.eforensicsmag.com
www.hakin9.org
- 111 -
T
HE INDUSTRY
Will cyber security events (like BlackHat or
DEFCON) remain an important part of influencing
the development of cyber community and companies?
Chase Cunningham, Cynja: The larger
CONS are already basically viewed by
most security operations personnel as not
much more than a reason to go to Vegas
and perhaps participate in shenanigans.
It’s smaller CONS where really interesting
and really innovative solutions are being
shown. The large CONS will continue but
are slowly becoming nothing more than a
giant sales convention for companies to
network and pitch things.
Ondrej Krehel, LIFARS: I think the focus is
changing from them. They’ve grown too
big.
Michael A. Goedeker, Auxilium Cyber Security: It’s getting to the point where the
investment for attending and the value
are starting to be questioned for some
conferences. In my opinion, events like
Bsides are becoming more important and
attended by more people due to the lower costs involved with attending. I am by
no means saying Blackhat is not valuable
but people are starting to feel real pain
when paying thousands of dollars or euros to attend a conference in the US. There has to be a balance and not a „we are
talking all the money from all sides” just
so you attend our show. Security lives
from teaching and not being so egotistical
with conferences.
Rajeev Chauhan: Yes, they may become
prominent as recruiters for govt agencies
as well as “Contract Agreement” hunting
ground.
Leon Kuperman, Zenedge: These events
are overly commercialized at this point
and used as announcement platforms for
the most part.
Stephan Conradin: Yes. Experts should
meet experts to share knowledges.
Julie Herold, Kenny Herold, Odin’s Eye:
We think these events are becoming more and more about networking and vendors which will continue on the upward
trend.
Paul Hoffman, Logical Operations: Yes, for
a while.
BroadTech Security Team: Yes, of course,
such events are the life and blood of cyber security. There will be many more
such local events, too, which may not get
much press.
www.eforensicsmag.com
www.hakin9.org
- 112 -
T
HE INDUSTRY
Will cyber security events (like BlackHat or
DEFCON) remain an important part of influencing
the development of cyber community and companies?
Craig McDonald, MailGuard: Yes, and there will be more of them. Education and
communication is a key priority in 2016.
Cybersecurity can no longer be seen by
businesses as optional, nor half-baked
solutions accepted.
Wade Johansen, CouriTech LLC: Yes, unfortunately they still will not be a target of
many companies for sending their cyber
employees, as it’s still seen by too many
as a non-essential training experience.
Andrew Bagrin, My Digital Shield: Yes,
that is where all is exposed.
Anthony Di Bello, Guidance Software: Certainly. They should (and are) be leveraged
as recruitment events. In addition I think
we will see more involvement by industry
in collegiate cyber security events such as
www.nationalccdc.org and niche security
events such as guidancesoftware.com/
enfuse, bringing together like specialist
communities to a common cause.
Dotan Bar Noy, Re-Sec Technologies: Yes.
It is harder to get noticed at those events
due to the overall noise. But those events
play a significant opportunity to meet professionals, exchange ideas and meet decision makers.
Wade Lovell, Simpatic: Yes, if they don’t
get too expensive for small bleeding edge
companies to justify attending and if they
keep attracting new talented speakers.
www.eforensicsmag.com
www.hakin9.org
- 113 -
T
HE INDUSTRY
Will we see more state-level cooperation in 2016?
Chase Cunningham, Cynja: Local and state
governments in the U.S. are so far behind
the curve in cyberspace they don’t even
have an idea on how to get involved. Without a coalition that can guide local and
regional entities and help them gain traction in solving their own specific cyber
problems, they will continue to lag and
exploits will rapidly expand.
Andrew Bagrin, My Digital Shield: Less
cooperation and more regulation I think,
which is a mistake, but that is how our
government thinks when it comes to security.
Rick Blaisdell: 2016 will be a very significant year for both sides of the cybercrime
equation. Governments and enterprises
will begin to see the benefit of cybersecurity foresight, with changes in legislation
and the increasing addition of cybersecurity officers within enterprises. In addition, as users become more aware of online threats, attackers will react by developing sophisticated, personalized schemes
to target individuals and corporations alike.
Dennis Chow, Millar, Inc: We will see more attempts at information sharing and
incident response assistance.
Michael A. Goedeker, Auxilium Cyber Security: Certainly and this is a good thing!
We need to discuss privacy, protecting
people, critical infrastructure.
Paul Hoffman, Logical Operations: Yes
they will have to.
Leon Kuperman, Zenedge: Yes, it’s a musthave shift.
Julie Herold, Kenny Herold, Odin’s Eye:
No, there is too much on their plate to be
able to assist the private sector unless it is
in the best interest of the state or nation.
Funding for security on the lowest levels
of defense is lower in government agencies than the private sector. If anything,
threat intel shared from the private sector, which is capitalist driven, may assist
at the state or national level.
Wade Johansen, CouriTech LLC: Yes and
No? As the world becomes smaller electronically, states are beginning to realize
that being part of larger and slower
government system can be crippling, but
when it comes to sharing data about its
citizens or immigrants then I think yes,
they’ll share a lot more this year than last
year?
www.eforensicsmag.com
www.hakin9.org
- 114 -
T
HE INDUSTRY
Will we see more state-level cooperation in 2016?
Anthony Di Bello, Guidance Software: To
some degree. Will it be effective? Depends on the degree of sharing, accuracy
of what is being shared, and the controls
various states will demand on the data
they are sharing.
BroadTech Security Team: Yes, but each
state taking into its own national interest
first.
Stephan Conradin: I hope. We are in cyberwar and some aliens are always welcome.
Einaras Gravrock, Cujo: We are seeing it
already. For example, the recently announced Department of Homeland Security
initiative to secure IoT devices. We can
expect many more initiatives like that simply because the government alone cannot
combat this problem.
David Clarke, VCiso: Yes already happening, and needs to be at a business level.
Wade Lovell, Simpatic: No. Nation states
have their own agendas and huge budgets
as well as some of the brightest minds in
white hats. The so-called cooperation we
have seen so far has allowed them to
tamper with standards and implementations down to the level of the NSA allegedly recommending elliptic curves it has
the means to break.
www.eforensicsmag.com
www.hakin9.org
- 115 -
T
HE INDUSTRY
In which industry will we observe the biggest
demand for cyber security services?
Michael A. Goedeker, Auxilium Cyber Security: Critical Infrastructure, Defense and
anything Big Data.
Przemek (Shem) Radzikowski, Secbüro
Labs: Akami’s statistics for 2015 show that
Media & Entertainment (48%), High Technology (11%), Retail (9%) and Public Sector (5%) collectively accounted for 65% of
attacks. I’d put my money on this trend
and say that these four segments will
drive demand.
Mark Bennet, Blustor: The healthcare and
related industries are already under tremendous pressure to address the tremendous vulnerabilities in their legacy infrastructure, medical devices, and data protection solutions. This is an area that is
gaining public awareness and will drive
the demand for innovative solutions that
can help solve some of the industry problems without breaking the bank.
Kenneth C. Citarella, Guidepost Solutions:
Government, banking and healthcare will
fuel the demand for cyber security.
Andrew Bagrin, My Digital Shield: Probably retail and healthcare.
Wade Johansen, CouriTech LLC: Travel
and immigration services such as VISA
programs.
Wade Lovell, Simpatic: The security spent
in healthcare is expected to rise more
than 20% but I think the biggest demand
will be among money center banks.
(Symphony, which serves a coalition of 19
banks, just raised another $100 million
this Fall.)
David Coallier, Barricade: Strange answer
to this one but fashion and e-commerce
to us have strong signs of interest and
growth. Many companies in these industries do not traditionally have a strong
security culture and new products will
come in and help them achieve that, grow
with security awareness at the very least.
Mayur Agnihotri: Cyber security services /
solution is one of the alarming concerns in
many critical industryies, such as BFSI:
aerospace, defense, and intelligence, because the biggest challenges of cyber security are education and training in 2015.
Roberto Langdon, Nicolas Orlandini,
KPMG: Cyber Security is a challenge for
the entire “Government-Private Corporations, SMB organizations, and professionals” ecosystem. It requires to stay informed, well equipped, conscious about the
subject, and with policies and procedures
to let the people know how to do the
things right, and how to react to a security
issue or incident.
www.eforensicsmag.com
www.hakin9.org
- 116 -
T
HE INDUSTRY
In which industry will we observe the biggest
demand for cyber security services?
Alina Stancu, Titania: Possibly healthcare.
Although the financial sector, as well as
various governments, are stepping up security efforts, due to the threat levels.
Financial crime is not disappearing,
though it is becoming more targeted, while state-sponsored attacks, through their
complexity and persistence, require significant resources and a wide range of specialised skills. The most stealthy attack
campaigns known to date (Stuxnet, Duqu,
Flame, The Mask) have been from statesponsored actors.
Anthony Di Bello, Guidance Software: Healthcare, retail, government and finance.
A problem here is financial and consulting
(PWC, ATOS, Optiv, etc) industries have
the cash to corner much of the existing
talent.
Gerald Peng, Mocato: Retail, healthcare,
finance, and device manufacturing. The
first two will demand it due to the IP, consumer data and communications they
want to protect. Companies that process
electronic payments or produce IP-sharing
devices will also want protection against
cyber threats in order to maintain consumer confidence and brand reputation.
Stephan Conradin: SCADA, critical infrastructures.
Dotan Bar Noy, Re-Sec Technologies: According to the “Banking & Financial Services Cybersecurity: U.S. Market 2015-2020
Report”, by Homeland Security Research
Corp. (HSRC), the 2015 U.S. financial services cybersecurity market will reach $9.5
billion, making it the largest nongovernment cybersecurity market. In addition, the report concludes that this market will be the fastest growing nongovernment cybersecurity market, exceeding $77 billion in cumulative 2015-2020
revenues. This is driven by an increase in
regulation and the demand for zero breaches, shutdown time and information leak
systems.
David Clarke, VCiso: Demand is big, the
ability to pay isn’t, government, finance,
pharmaceutical, legal.
BroadTech Security Team: Defence, health care, power...
Paul Hoffman, Logical Operations: Healthcare, they are so far behind. It will take
years to get them off this list.
www.eforensicsmag.com
www.hakin9.org
- 117 -
T
HE INDUSTRY
In which industry will we observe the biggest
demand for cyber security services?
Leon Kuperman, Zenedge: Banking, Insurance, Financial, Health Care, Retail.
Julie Herold, Kenny Herold, Odin’s Eye:
The health industry as a result of the
upward trend in data breaches and the
lack of security maturity in this space.
Ondrej Krehel, LIFARS: Manufacturing.
www.eforensicsmag.com
www.hakin9.org
- 118 -
T
HE INDUSTRY
What do you think will change in the cyber
security market in your country?
Michael A. Goedeker, Auxilium Cyber Security, Germany: I hope that there will be
better rates for experienced security people. Right now many big customers pay
little for much, this is unbalanced and really unfair as „cyber” security experts do a
lot of learning and gain experience that is
not paid. This experience „SHOULD” be
paid but currently isn’t. At some point, we
will refuse to be undersold and not work
for minimal wages comparable to low paid jobs that do not require special training, certifications or degrees in addition
to real world experience.
Wade Johansen, CouriTech LLC, US: The
push for BYOD will drastically drop this
year in the US because of inherently insecure devices that are not corporate controlled, which could compromise entire
networks.
Dennis Chow, Millar, Inc Short: Advances
in Threat Intelligence and Automatic Response in Systems.
Alina Stancu, Titania, UK: UK remains a
hotspot for disruption and advancements
in technology. But where recent years
have been explosive with new start-ups
and cutting-edge developments, 2016 is
converging towards a more consolidated,
mature market. More defined classifications of security services are starting to
emerge. Export was a priority to the UK
government in 2015 and that was illustrated best with the visit of Prime Minister
David Cameron to US at the beginning of
this year, where he invited a trade delegation of cyber security companies.
Andrew Bagrin, My Digital Shield, US: More complexity and higher process.
Dotan Bar Noy, Re-Sec Technologies, Israel: The latest data from Israel’s National
Cyber Bureau indicates cyber exports increased from $3 billion (USD) in 2013 to
$6 billion in 2014, that constitutes about
10 percent of the global cyber market.
Israel is second only to the United States
as the largest exporter of cyber products.
This is made possible by the increasing
amount of highly skilled professionals.
Israel’s unique security needs created a
focus on cyber security education in
schools, army service, and dedicated collages. Hopefully, we will see additional
Israeli vendors take their place as world
leaders, such as Check Point, CyberArk,
etc.
Julie Herold, Kenny Herold, Odin’s Eye,
US: We think the days of charging absurd
amounts of money for IT Security services
will be controlled as a result of the number of competitors and it will put an end
to the exorbitant and unfair pricing many
of the leading IT Security companies charge.
www.eforensicsmag.com
www.hakin9.org
- 119 -
T
HE INDUSTRY
What do you think will change in the cyber
security market in your country?
Mayur Agnihotri, India: Yes, one of the
biggest changes because of Prime Minister’s vision for India to take leadership in
this critical and emerging space. Indian
digital security market to grow at 8.3% to
$1.1 bn in 2015, says Gartner, Indian IT
security market reaches 1.2 billion next
year I expect. Main components contributing to the growth of the Indian cyber security market include: increased penetration testing of IT services in the telecom,
banking and insurance industries; the vulnerability of Indian IT infrastructure to
hackers; National Association of Software
and Services Companies (NASSCOM) and
Data Security Council of India launch the
NASSCOM Cyber Security Task Force that
aims to build India as a global hub for providing cyber security solutions, developing
cyber security R&D.
Anthony Di Bello, Guidance Software, US:
Tough one to answer, depends on what
the next high-profile breaches have to
offer.
Wade Lovell, Simpatic, US: In the United
States, there is a decent chance the federal government will weaken encryption,
leaving a broader attack surface.
Roberto Langdon, Nicolas Orlandini,
KPMG, Argentina: Checking really quickly
the site http://map.norsecorp.com/ and
then you can see the online status of cyber-attacks around the globe in real time.
What are we waiting to put our hands on
to just leave to be an observer, and be a
protagonist?
David Clarke, VCiso, UK: Legislation as per
other industries.
Gerald Peng, Mocato, Canada: Proliferation of fraudulent electronic payments, in
conjunction with an increasing number of
public corporate security breaches.
BroadTech Security Team, India: People
will be willing to pay external agencies to
conduct security audits and not just blindly leave it to network/system administrators.
www.eforensicsmag.com
www.hakin9.org
- 120 -
W
HO IS
WHO
Craig McDonald
David Coallier
MailGuard, CEO and Founder
Barricade, CEO
David Coallier is the chief executive
officer of Barricade. David is a technologist, an avid learner, and a serial entrepreneur with a passion for
artificial intelligence.
In 2001 I started MailGuard
Pty Ltd (MailGuard). I saw a
world where online security
was going to be a growing
concern. A key to solving
that problem was the need
for a simple and inexpensive way to manage unwanted
email and website content. MailGuard, in response to
that need, has pioneered a range of cloud security solutions to provide complete protection against online
threats such as malware, spyware, viruses and spam.
My key focus for the moment is to support businesses
who continue to struggle with IT security. I want to continue growing through technology and allied partnerships.
Nick Prescot
ZeroDayLab
Senior Information
Security Manager
As Head of GRC and incident response , I am responsible for the
development and delivery of these
services to our clients. Whether
you need an assessment, review, audit and/or a consultation with your people,policies, procedures and processes ZeroDayLab's award winning consulting services
can ensure that you are protected with the very best
advice; if you are unfortunate to be at the receiving
end of a breach, you can be assured that the very best
people in the business are there to keep the hackers at
Stephan Conradin
I am an independant consultant with more than 30 years of activities in information security as well as information systems. I have hold CISSP, CISM, CRISC, ISO
27001, COBIT and ITIL certifications and a Master in
Information Security.
www.eforensicsmag.com
www.hakin9.org
- 121 -
C
YBER SECURITY
AWARENESS
Will the cyber community influence the level
of cyber security awareness?
Chase Cunningham, Cynja: How can we work towards improving cyber security awareness in 2016? Cyberspace isn’t the Magic Kingdom. It’s the Wild West—only worse, as it’s a place where it’s really difficult to
observe people as they make choices and experience the consequences. So corporate social responsibility
programs try to drive a consciousness-raising dialogue among young people to fill the void. Sadly, what
they deliver is often hopelessly lame and condescending. They miss that creating cybersecurity awareness,
especially among kids, takes serious effort—and that in the case of our digital lives today, one that has to
be backed by the creative vision necessary to set out and define this new frontier. This is something new—
something we never experienced before.
Instead, many large companies who have the revenues to do this simply don’t. They justify their limited
efforts by claiming to only have a “limited budget” for guiding kids on how to protect their future. Some
corporations just want to tick a box to show that they are “helping the children” and move on. And so kids
are shown silly dogs, flying saucers, or the occasional cyber kitty—accompanied by bullet point guidance
more suitable for corporate PowerPoint presentations. Seriously, how are we as an industry going to inspire kids to want to make smart choices online with PowerPoint and clip art?
Our kids and our children’s children are going to be the ones who will see new technologies and methods
of compromise we haven’t even considered. As an industry, we must take this responsibility seriously rather than treat it like an optional line item to be squeezed by our finance departments. We need to educate and train kids to be cyber smart and involve more kids in our industry. Today, too many companies focus
on the now, rather than the later. That behavior simply means our industry is shorting an entire generation
of children’s digital future. It’s very sad to watch.
Mark Bennet, Blustor: The cyber community can have a tremendous influence on
public awareness by evangelizing and
working with the media to bring serious
issues to surface. This requires a level and
style of communication that “mere mortals” can understand and using examples
that clearly show the potential consequences. As a community, we need to encourage and support cyber security experts
to share their stories, concerns, and potential solutions with the rest of the
world.
Ondrej Krehel, LIFARS: Lawmakers and
corporations are the big movers. Money
makes people do things.
Elizabeth Houser, Praesidio: Yes, but in a
reactive manner. The level of cybersecurity awareness is most greatly influenced by
the publicizing of breaches and litigious
actions that follow.
www.eforensicsmag.com
www.hakin9.org
- 122 -
C
YBER SECURITY
AWARENESS
Will the cyber community influence the level
of cyber security awareness?
Richard De Vere,The AntiSocial Engineer:
In the UK, we are starting to form smaller
clusters of computer security experts, this
is designed to give smaller businesses around us access to good sound advice. Soon,
all the UK will have a network of talent to
lean upon.
Roberto Langdon, Nicolas Orlandini,
KPMG: Awareness is one of the most important (if not the most) topics the corporations need to address. Cybersecurity is a
process, not a product or a department
within the company. This needs to be
addressed using a top-down-top approach. Needs to reach the entire organization.
Einaras Gravrock, Cujo: Absolutely. I think
cyber security researchers, as well as ethical hackers have been very vocal for years
about security issues and finally they are
being heard. We have reached the point
where a significant dialogue is happening
around the world and cyber security
experts are a big part of that dialogue.
Francisco Amato, Infobyte: I don't think
so, it depends a lot on the culture and the
country, but in general people start to
grasp cyber security threats posed to
them more from problems or news that
happen in companies on a daily basis than
from warnings from IT sec professionals.
To give an example, people for quite a
few years have known that they need to
do backups for security reasons, for normal problems with hard discs that break,
etc. Today, with attacks done with Ransomware, we can see now that simple
backups don't always get the job done. It
is possible that this type of attack ends up
raising awareness about the importance
of safeguarding one's information, because not only is there the chance of your
hard disc breaking but when a Ransomware is able to capture all your information
and extort money from you in order for it
be returned. The same kind of things
happen when almost weekly a new company has their information compromised
and people seeing this in the news start to
ask themselves how they can protect
themselves and their organization.
Amit Serper, Cybereason: Absolutely - all
the recent data breaches have thrust cyber security into the spotlight. Now that
it’s on it, Cyber security leaders will also
“cross the chasm” and become much more visible as cybersecurity champions and
evangelists.
Wade Johansen, CouriTech LLC: Yes, it’s a
key factor in getting needed information
out to the public quickly so actions can be
taken immediately as needed. If you wait
for the news to report it, then chances are
it’s already old news to the cyber community.
www.eforensicsmag.com
www.hakin9.org
- 123 -
C
YBER SECURITY
AWARENESS
Will the cyber community influence the level
of cyber security awareness?
Kenneth C. Citarella, Guidepost Solutions:
Cyber security awareness must develop
within the user community at all levels.
No matter what security experts say, unless the need for security is well understood and adopted as a policy and a practice,
we cannot become more secure.
Andrew Bagrin, My Digital Shield: Yes,
they are doing it already and will continue
to improve.
David Clarke, VCiso: No, awareness plus
strategy and technology will.
Julie Herold, Kenny Herold, Odin’s Eye:
No, the topics are too complex and therefore not palatable for anyone that is not
IT savvy as well as IT Security savvy.
Leon Kuperman, Zenedge: Yes, the trend
will continue.
Wade Lovell, Simpatic: Yes, those of us
who cried “Wolf!” are now seen as wellinformed instead of paranoid. “Your mind
is working at its best when you're being
paranoid. You explore every avenue and
possibility of your situation at high speed
with total clarity.” ― Banksy, Banging Your Head Against a Brick Wall.
Anthony Di Bello, Guidance Software: Certainly, and already are doing so through
things like national cyber security awareness month (October).
Nick Prescot, ZeroDayLab: Yes, because of
the legislative drive that is happening but
it will become more of a business issue.
Stephan Conradin: Yes. We must influence
because we are in front line.
Alina Stancu, Titania: Yes, the security
community is the only one to drive awareness among the non-technical public.
While there is an argument to be made
regarding scaremongering by some vendors, there are genuine businesses in the
industry that wish to inform and educate
as well as develop a thriving business and
support economic growth.
Michael A. Goedeker, Auxilium Cyber Security: That is our (its) responsibility. We
must continue as an industry to teach and
make aware but in ways that are different
than before. Its cool and hip to be secure,
it's a way of life that everyone should
have.
www.eforensicsmag.com
www.hakin9.org
- 124 -
C
YBER SECURITY
AWARENESS
How can we work towards improving
cyber security awareness in 2016?
Michael A. Goedeker, Auxilium Cyber Security: Talk, present at Bsides and other
security conventions, boycott the selling
of speaker slots (for money) by sales companies.
Dennis Chow, Millar, Inc: Add gamification theory to the community which will
encourage active participation in improving security awareness as a whole.
Amit Serper, Cybereason: Start cyber security education and awareness training in
elementary school.
Elizabeth Houser, Praesidio: Fund and make mandatory cybersecurity training for
users.
David Coallier, Barricade: The only way we
can work towards improving cyber security awareness is by building tools that are
not exclusively made for security experts.
We are very bullish on the concept of
bottom-up security. Traditionally, security
has been mandated from the top-down.
A C-Level would push for the security
standards to be put in place and it would
become more a chore to the people who
are actually managing the day-to-day operations, developing the online applications, etc. Many new products, such as
Barricade, empower the developers and
operations teams first, then they allow
the organisation to grow with it. Engineers by nature want their work to be
better. New products allowing developers
to produce better code and allowing the
operations teams to deploy and manage
their infrastructure with confidence are
required. Security is rarely at the top of
the priority list for most SMBs and it
shouldn't change. What should change
are the products those companies use in
order to manage their security.
Richard De Vere,The AntiSocial Engineer:
We should all stop bashing people over
the head with cyber security. It’s time we
turn our expertise to our family and
friends. The big corporates will always be
responsible for their own security but the
common person in the street is at risk daily from preventable attacks.
Stephan Conradin: Communicate, collaborate, explain again and again.
Wade Johansen, CouriTech LLC: Social
awareness. There is a stigma that goes
with being the one to say something, and
then maybe being contested by others.
Standing up for making any improvements
in security is hard because it’s essentially
non-conformist in nature. However, it's a
critical part of moving any society forward
when we speak about raising security
awareness.
www.eforensicsmag.com
www.hakin9.org
- 125 -
C
YBER SECURITY
AWARENESS
How can we work towards improving
cyber security awareness in 2016?
Mayur Agnihotri: Some points which are
first clear for audience and trainers are:
Don’t confuse cyber awareness programs
with security training; • Include posters,
newsletters, email tips, blogs and reminders; • Cyber security awareness improves by changing culture (changing behaviors {Relate cyber awareness to personal life, family, home and corporate }) •
Creating a Culture of Cybersecurity at
Work / organization • Cyber security
events must be started at small and medium size companies, schools, colleges
and society.
Ondrej Krehel, LIFARS: Make it law to
have cybersecurity guards just as they
have regular security guards.
Wade Lovell, Simpatic: Launch meaningful
social media campaigns with star collaborators. • Buy a Guy Fawkes mask and help
take down ISIS or contribute to Anonymous in other ways.
Paul Hoffman, Logical Operations: Just
keep the message out there. The hackers
are helping by creating News.
Kenneth C. Citarella, Guidepost Solutions:
Government leaders at all levels must engage in a protracted and serious discussion of issues about cyber security. Some
have begun that effort, but it must be more widespread and focused on specific
efforts to be undertaken by government,
business and private individuals.
Gerald Peng, Mocato: I believe that too
often, awareness happens when there is a
cyber disaster like Target or Ashley Madison. Part of the problem is the highly specialised nature of cyber security. I believe
that to keep cyber security top of mind,
the discussion has to become proactive
and accessible by non-industry people.
Julie Herold, Kenny Herold, Odin’s Eye:
Continue to have breaches, spamming
initiatives, malware campaigns whether
targeted or not, successful take downs for
illegal activities, and other information
regarding cybercrime activity and reduction being advertised for the sake of awareness. If non-IT savvy end users do not
have a direct impact to them personally,
we will not see improvement.
Rajeev Chauhan: The weakest link in the
chain of cybersecurity is the lack of awareness amongst the users at all levels,
starting from home users to corporate
users. Concentrated efforts to create awareness has to be undertaken by schools,
colleges, communities and corporates.
www.eforensicsmag.com
www.hakin9.org
- 126 -
C
YBER SECURITY
AWARENESS
How can we work towards improving
cyber security awareness in 2016?
BroadTech Security Team: Making cyber
security mandatory in curriculum. • Short
interesting articles in print and visual/
cyber media, etc., are what our organization does in collaborating with the state
police. • Conduct workshops.
David Clarke, VCiso: Security should be at
board level, and legislated for.
Andrew Bagrin, My Digital Shield: We need to separate myth and reality. The reason awareness is taken with a grain of salt
is because something is always trying to
be sold.
Nick Prescot, ZeroDayLab: There won't be
a magic wand to deliver, it's an education
strategy.
Anthony Di Bello, Guidance Software: Doing what we can to make it a mainstream
issue. Part of which involves being able to
speak in everyday terms and with relatable examples to folks outside our industry.
Alina Stancu, Titania: We can demand for
better legislation to reflect the concerns
of individuals and businesses. There is, of
course, the danger of over-regulation and
crippling costs of compliance can be discouraging to small businesses. That is
why the security industry can cooperate
to develop helpful, free tools to support
even firms on small budgets to achieve a
basic level of security. If we raise the bar
step by step, we can then focus on innovating more, collaborating better and
living safer.
www.eforensicsmag.com
www.hakin9.org
- 127 -
C
YBER SECURITY
AWARENESS
What obstacle in awareness will remain unsolved?
Mark Bennet, Blustor: Many cyber security risks are shrouded in complexity that is
difficult for the general public to fully
grasp. The cyber security community and
the media need to work closely together
to simplify and distill these risks into everyday terms that the public and our legislatures can better understand.
Leon Kuperman, Zenedge: The fundamental miscommunication and misunderstanding of how technology works and what is
vulnerable.
Wade Johansen, CouriTech LLC: The realization of what firewalls and cryptography
can really do for protection, and the importance of retaining offline backups.
Michael A. Goedeker, Auxilium Cyber Security: That people listen and change
their habits. This can only be done by
experiencing the pain of breaches (or so it
seems).
Dennis Chow, Millar, Inc: Resources, not
enough time and or money for polished
programs at all the various entities from
small to large.
Richard De Vere,The AntiSocial Engineer:
I think awareness and perception to cyber
crime is a hard battle, people can’t see
most attacks, they have a tendency to
ignore issues and hope it will be OK. With
more and more breaches hitting the media in 2015, people are starting to be more aware - but have a long way to go!
Kenneth C. Citarella, Guidepost Solutions:
The biggest obstacle will be personal conduct. Everyone likes to push cyber security off to the firewall, the system operators, the programmers or anyone else
they can. We all must recognize that how
we use whatever computer we are on,
just like we drive a car, is critical to our
safety.
Alina Stancu, Titania: The industry is still
ridden with technical jargon. To the
“uninitiated” public, this can be offputting and impenetrable. There is a perceived lack of interest even regarding the
steady reports of breaches and cybercrime. Perhaps it is time to learn how to
translate the industry in practical business
terms.
Elizabeth Houser, Praesidio: The precise
formula of situational awareness, motivation, and behavior modification to increase user participation in routine cybersecurity.
www.eforensicsmag.com
www.hakin9.org
- 128 -
C
YBER SECURITY
AWARENESS
What obstacle in awareness will remain unsolved?
Ondrej Krehel, LIFARS: Having a security
professional and not just “security aware”
staff.
BroadTech Security Team: Rapport. People don’t understand the InfoSec languages and jargon. So things have to be simplified while spreading awareness.
Stephan Conradin: The ability of people to
understand they are a big part of security.
Julie Herold, Kenny Herold, Odin’s Eye:
There is no magic bullet to educate the
average end user.
Paul Hoffman, Logical Operations: Training v. production. We can’t stop production for training. So we are having to
squeeze training in as minimally as possible is the mindset for most companies.
David Clarke, VCiso: Board level buy in,
companies have legal, finance components they are there for compliance and
legal reasons, cyber needs to be there as
well.
Nick Prescot, ZeroDayLab: It won't happen
to them so they won't worry about it.
Wade Lovell, Simpatic: Inertia. It is a powerful force. “The vis insita, or innate force of matter, is a power of resisting by
which every body, as much as in it lies,
endeavours to preserve its present state,
whether it be of rest or of moving uniformly forward in a straight line.” Isaac
Newton.
Andrew Bagrin, My Digital Shield: The
trust, because cybersecurity is a complex
thing to understand and trust someone
about.
Anthony Di Bello, Guidance Software: The
human factor can only be mitigated, not
solved. Even with the best security awareness program, 1/100 people will still click
that well-crafted phishing email.
www.eforensicsmag.com
www.hakin9.org
- 129 -
C
YBER SECURITY
AWARENESS
What role will awareness play in corporate cyber security?
Michael A. Goedeker, Auxilium Cyber Security: A big one. Awareness pays many
dividends to any company that invests in
them. There are neutral statistics that
prove that awareness campaign training
decreases successful password hacking
and social engineering attacks (two of the
most difficult attack vectors to secure because of human nature vulnerabilities).
Kenneth C. Citarella, Guidepost Solutions:
Security awareness is the key to our security, ultimately. This is true for individuals, as well as businesses and governmental agencies of all sizes. We must know
our weaknesses, understand what the
attackers do and remove practices that
create vulnerabilities.
Wade Johansen, CouriTech LLC: Realization of the threat landscape which evolves
daily is a technical cyber security challenge and often a nightmare. True awareness
requires many things, including social media integration, which often is blocked on
most corporate networks - accurate reporting from real-time systems which
often display false positives - and
knowledge by the technical staff to be
able to interpret the data when anomalies
are encountered. Target is an example of
a breach where the systems were pointing
to an event in progress, and it was repeatedly ignored as an anomaly that wasn’t a
danger.
Andrew Bagrin, My Digital Shield: More
training and testing of social engineering.
Elizabeth Houser, Praesidio: The lack of
user awareness and inattentiveness will
continue to pose a threat to corporate
cybersecurity infrastructure.
Julie Herold, Kenny Herold, Odin’s Eye:
We think there will have to be tighter controls given the BYOD policies many companies and organizations are implementing and deploying within their organizations to protect the end users from themselves.
Richard De Vere, The AntiSocial Engineer:
Awareness and a good understanding of
the nefarious people that we can all encounter online is the main objective. You
can’t expect people to care about their
digital security if they don’t have the perception of what's out there today.
Ondrej Krehel, LIFARS: It helps but you
really need a professional. No one says to
a secprof you should be accounting aware
so we don’t need accountants, so why the
other way?
www.eforensicsmag.com
www.hakin9.org
- 130 -
C
YBER SECURITY
AWARENESS
What role will awareness play in corporate cyber security?
Paul Hoffman, Logical Operations: It will
play the biggest role. No software or hardware can make up for an unaware employee clicking, or not changing a password, or any number of things that leave
the cyber door wide open.
Gerald Peng, Mocato: Awareness will positively impact corporate cyber security by
facilitating support and investment in cyber security protocols and tools.
Stephan Conradin: Crucial, employees
must understand that cyber security if not
a black box like a firewall, it is a continuous process and they are involved.
BroadTech Security Team: In many startups, there are no firewalls and the laptops are connected directly to internet
through WiFi. In such cases, end point
security is of prime importance and users
should be made aware. In most corporates, awareness training is given, I suppose,
and their focus should be on making people compliant to the security instructions.
Nick Prescot, ZeroDayLab: Users are becoming more aware and this will be a constant education exercise.
David Clarke, VCiso: The awareness is there, it’s the incentive to implement that
isn’t.
David Coallier, Barricade: This is going to
be immense. For corporate awareness to
kick in, security needs to be implemented
bottom-up as a cycle rather than topdown as a mandate.
Wade Lovell, Simpatic: Maybe, just maybe 2016 is the year cyber security becomes a Board issue rather than an IT issue.
Dennis Chow, Millar, Inc: Eventually, it
will become standard as part of other policies and procedures signed like an AUP.
Anthony Di Bello, Guidance Software: A
large role, many organizations already
have some form of cyber awareness program. If nothing else it will help minimize
the risk of social engineering attacks,
which are leveraged extensively in the
first phase of most compromises.
Mayur Agnihotri: Organization’s people
have a key role to play in effective cyber
security.
www.eforensicsmag.com
www.hakin9.org
- 131 -
W
HO IS
WHO
Nicolas Orlandini
Gerald Peng
KMPG
Director Forensic Services
Mocato, Founder
He is a Director of KPMG’s Cyber
practice and a member of the
Forensic Technology team, specializing in digital response services and cyber investigations. He
is specialized in identification,
preservation and collection of
electronic stored information
(ESI ), data leak prevention and
detection, information protection and incident response, and information security audits. He also has a
strong background across the electronic evidence
acquisition protocols and chain of custody regarding
eDiscovery matters or internal investigations. He developed and leaded the Forensic Technology Lab in KPMG
Buenos Aires – Argentina office for many years, providing evidence collection, processing and hosting to
companies and law firms located across Latin America,
including clients located in Argentina, Brazil, Chile, Uruguay, Paraguay, Bolivia, Peru, Venezuela, Ecuador, Colombia, Panama, Curacao and Costa Rica.
Gerald Peng is the founder of
Mocato Inc., a consulting firm
that specializes in digital forensics, E-Discovery and data analytics. In the last 12 years, Gerald has provided services in
computer forensics, incident
management and information
security. He has worked closely with financial institutions, law firms and government to perform computer
forensic investigations and fraud analysis. Gerald is a
certified computer forensic examiner (EnCE, GCFE), Certified Fraud Examiner (CFE), Certified Information Systems Security Professional (CISSP), and Certified EDiscovery Specialist (CEDS). He is also a member of the
High Technology Crime Investigation Association
(HTCIA), and a graduate of McMaster University’s Computer Engineering and Management program.
Francisco Amato
Infobyte, CEO
He is a researcher and computer security consultant who works in the area of vulnerability Development, blackbox testing and reverse engineering. He is CEO of Infobyte Security Research
(Infobyte LLC) www.infobytesec.com, from where he published his developments in audit tools
and vulnerabilities in products from companies like Novell, IBM, Sun Microsystems, Apple, Microsoft. His last work was evilgrade a modular framework that allows the user to take advantage of
an upgrade process from different applications, compromising the system by injecting custom
payloads. Founder and organizer of ekoparty south america security conference.
www.eforensicsmag.com
www.hakin9.org
- 132 -
M
ISCELLANEOUS
LogRhythm’s Predictions for Cybersecurity
An uptick in all-in-one home surveillance systems. We are seeing more motion sensing/camera/
recording devices in the home that can be managed through personal devices. This type of technology will
continue to expand, and with this expansion, hackers will try to exploit them or cause chaos.
A rise in the use of mobile wallet apps. Like having virtual money and an ID in one’s pocket, mobile wallet
apps are at the intersection of marketing and payments. And although a mobile wallet is convenient, it is
directly tied to one’s mobile phone which is a critical access vector for cyber threats.
New model of what to protect. Instead of a mandate to “protect everything on the network,” IT staffs
must work more like a unit, centralizing and protecting the most critical resources. This approach moves
defense-in-depth to the most critical business components of the organization.
Identity access management: The unsung hero. Companies will be investing more money and R&D resources in behavior-based modeling, analytics and identity access management to track behaviors. More customers are asking about it, which will motivate the rest of the industry to follow.
The next big attack target: Education. This industry has a plethora of data that cyber criminals want - credit reports, personally identifiable information (PII), donor money, tuition money. And these institutions
are not doing an adequate job of securing all their systems. Add to that the myriad “customer” – namely
professors, student, parents, administrators – and you have magnified the attack vectors exponentially.
Emergence of hacking for good. More organizations, like Anonymous, will be leaving the dark side and
hacking for the public good. They are more motivated by the notoriety and publicity on social media than
for financial gain. Teens are learning to program on their own; high schools are introducing technology and
coding to get this generation aware of and more proficient in this industry. Younger generations are finding
coding and programming cool. This is the next gen workforce that we hope will continue to want to positively impact society.
Security is in a renaissance. Security is a hot space. And the fact that CISOs are getting a seat in the Boardroom is another indication of the importance of this industry for all organizations, regardless of the vertical market. Many companies still don’t have adequate security infrastructures, awareness or training to
defend themselves. There will also be consolidation. Companies will either “get it” or not, and governments will start ramping up regulations.
www.eforensicsmag.com
www.hakin9.org
- 133 -
M
ISCELLANEOUS
LogRhythm’s Predictions for Cybersecurity
Next steps for CISA, open sharing of threat intelligence. Critical infrastructure will emerge as more companies in various sectors, such as energy, financial and healthcare, join in. The principle and the intention
behind the creation of a more collaborative community for the open sharing of threat intelligence is grand,
with two distinct sides of the political aisle. We will either see a big push or nothing happen at all.
Ransomware gaining ground. The ransomware-style of attack is powerful and expanding into Macs and
mobile devices, making it easier to target consumers. Criminals can gain big profit by locking down an entire system; victims have no choice but to pay. Although consumers are ripe for the picking, businesses are
not immune to this approach.
Vendors need to step up – Despite the running list of breaches, many companies still do not have an
adequate security infrastructure to defend itself against cyber criminals. And we cannot rely on consumers
to know how to protect home systems. It is up to the security vendors to build better software, systems
and patching mechanisms, as well as offer training and services to protect people, companies and their assets.
www.eforensicsmag.com
www.hakin9.org
- 134 -
M
ISCELLANEOUS
IBM’s Predictions for Cybersecurity
Bob Stasio, senior product manager for cyber threat analysis, i2 Safer Planet:
The market for behavioral analytics and threat detection offerings will continue unabated • Large financial
organizations will continue divesting themselves of managed security services to create their own fusion
centers • “Big X” consulting firms will offer their customers cyberintelligence-as-a-service consulting options • Companies and government agencies will begin using block-chain encryption to protect against
cyberthreats • Private organizations will increase their visibility into the dark web to become more proactive about cyberthreats than ever before.
Shahid Shah, CEO, Netspectives Communication:
The market for behavioral analytics and threat detection offerings will continue unabated • Vulnerability
curators will become increasingly prevalent as companies learn to share breach data • Companies will
begin properly inventorying digital assets and data as part of their risk management strategies, heightening
understanding of threat surfaces and ways of minimizing them • Third-party libraries and software components will increasingly gain attention as CIOs and CISOs realize how many vulnerabilities they create.
Todd Rosenblum, senior executive for worldwide big data, i2 Safer Planet
Auditability and managed access of US citizens’ personal data will be an increasingly important requirement for US national security agencies • The international community will create safe zones in Syria to
stem the mass migration to Europe, and big data analytics will play an integral role in enforcing identity
resolution and border security in those safe zones.
Andrew Borene, federal manager, i2 Safer Planet
Continued cybersecurity breaches and state-sponsored cyber espionage will lead to spikes in cybersecurity
spending on both workforce and software solutions • New data sources arising from the Internet of Things
and biometrics will lead to a renewed government interest in using big data to prevent terrorism.
www.eforensicsmag.com
www.hakin9.org
- 135 -
M
ISCELLANEOUS
Kenneth C. Citarella, Guidepost Solutions: Every year we learn about new
intrusions and new breaches until we
have almost become numb from the relentless reports. It will not change in 2016
unless there is serious cooperation among
all levels of government, the computer
industry and network owners, coupled
with serious diplomatic pressure from the
U.S. government on the international
front.
David Clarke, VCiso:
Cyber Security Vendors who can spend
the most on R & D and who have market
positions now will dominate the Information Security Marketplace. • The CISO
role will need to change from being part
of IT and report to either directly to the
CEO or at least to Legal or Finance board
members. • Legislation or pressure from
Cyber Insurance, will enforce that certain
cyber security components are mandated,
eg strong authentication. Other industries
such as the car industry, aero, nuclear and
building have many mandated safeguards
already, seat belts, vehicle checks, crash
standards. An unsafe vehicle cannot be
put on the roads, unsafe aircraft in the air,
thus unsafe IT would not be permitted on
the electronic highways.• Governments
may need to provide assistance on protecting information superhighways similar to
the way the road systems and airspace is
protected. • Cyber Security will need to
become an outsourced function due to
complexity, rapidly evolving cyber technology, huge amount of Data to be processed and analysed, intricate threats, and
exponential skills shortage.
Richard De Vere,The AntiSocial Engineer:
The industry hasn’t taken the large steps
it needs yet to focus on security first and
profit second. Finance still leads most businesses security implementations in 2015
and for our selfish greed in this matter,
we will see security breaches and online
crime rise like it has done every other
year previous. This is good for business in
the short term yes, but the industry
should seek to help people reduce crime
before our business model collapses on
itself.
Wade Johansen, CouriTech LLC: Organizational hacking will become a normal
course of business and defense, if botnet
time and crypto ransomware services can
be bought for as little as $50 for an account, I believe you will see similar services
being more readily available for purchase
such as hackers for hire.
Irfan Shakeel, EH Academy: The importance of incident handling and digital forensics will increase. The community will
invest their time and resources to develop
and create the effective work-process to
solve hacking cases.
www.eforensicsmag.com
www.hakin9.org
- 136 -
M
ISCELLANEOUS
Kris Rides, Tiro Security: I think we will
see more attacks coming through small
vendors to larger companies. Many high
tech vendors who are providing niche services have little or no security posture
making them an easy way to get at the
real target. We are already seeing SMB’s
increasing their spend on security as they
realize it can be a differentiator when it
comes to winning new business against
competitors.
www.eforensicsmag.com
www.hakin9.org
- 137 -
W
HO IS
WHO
James Carder
LogRhythm
Greg Foss
LogRhythm
CISO & VP
Security Operations
Team Lead
He has over 18 years of
experience working in corporate IT security and consulting for the Fortune 500
and U.S. Government. At
LogRhythm, he develops
and maintains the company’s security governance model and risk strategies, protects the confiden`tiality, integrity and availability of information assets, oversees
threat and vulnerability management and the Security
Operations Center. He also directs the mission and strategic vision for the LogRhythm Labs machine data intelligence, threat research, compliance research, incident
response, and threat intelligence teams. He holds a Bachelor of Science degree in Computer Information Systems from Walden University and is a Certified Information Systems Security Professional.
He is LogRhythm’s Security
Operations Team Lead and
a senior researcher with
Labs, where he is tasked
with leading both offensive
and defensive aspects of
corporate security. He has just under a decade of experience in the Information Security industry with an
extensive background in Security Operations, focusing
on Penetration Testing and Web Application Security.
Greg holds multiple industry certifications including the
OSCP, GAWN, GPEN, GWAPT, GCIH, and C|EH, among
others. He has presented at national security conferences such as DerbyCon, AppSecUSA, BSidesLV, and is a
very active member of the Denver security community.
Dennis Chow
Millar Inc, Security Manager, Incident Response
He is a security practitioner that has over 10 years of combined IT and Information Security experience. Dennis currently leads Information Security efforts at Millar, Inc. as their Network Security Manager. In addition management and practitioner experience, Dennis has consulted for various clients
within Oil and Gas, Healthcare, Defense, and other critical infrastructure industries. Dennis also holds
several industry known certifications including the GCFA, GCIH, GCIA, GPPA, CISSP, E|CSA, C|EH, and
L|PT and is currently the Program Manager for a collaborative Cyber Threat Information Sharing
Grant by the Department of U.S. Health and Human Services.
www.eforensicsmag.com
www.hakin9.org
- 138 -
W
HO IS
WHO
Andrew Borene
Federal manager, i2 Safer Planet
Bob Stasio
Senior Product Manager of Cyber
Analysis at IBM i2 Safer Planet
Bob Stasio is the He brings nearly
14 years of rare expertise fighting
top tier malicious actors through
his work in the intelligence community, the U.S. Military, NSA and
commercial sector. Bob served on
the initial staff of US Cyber Command. Serving in Iraq during “The
Surge,” Bob’s intelligence unit
supported the detainment of over
450 high-value targets.
Andrew Borene provides executive
leadership for IBM’s i2 Safer Planet
Federal business team. He served
as Associate Deputy General Counsel at the U.S. Department of Defense and is a former U.S. Marine
Corps military intelligence officer. Prior to joining IBM, Mr. Borene was a Counselor to the international law firm of Steptoe & Johnson LLP. His career includes leading
corporate development at a microrobotics startup and U.S. intelligence community program management for a publicly-held big data
company. He is active within leading public-private initiatives for
improved U.S. national security,
global leadership and technology
growth.
Todd M. Rosenblum
Senior executive for worldwide big
data, i2 Safer Planet
Todd M. Rosenblum joins IBM as a
Senior Executive for Global Business Development. He is responsible for identifying market engagement opportunities for IBM’s Safer
Planet, Enterprise Insight Analysis
suite of capabilities. Todd focuses
especially closely on deepening
collaborative partnerships with
senior executives in the United States Government, U.S. State, local
and private sector companies, as
well as worldwide defense, intelligence and law enforcement institutions.
Shahid Shah
CEO, Netspective Communications
He is an award-winning Government 2.0, Health IT, Bio IT & digital
Medical Device Inventor & CTO
with over 25 years of technology
strategy, architecture, engineering,
entrepreneurship, speaking, and
writing experience. He is the chair
of the #HealthIMPACT Forum.
www.eforensicsmag.com
www.hakin9.org
- 139 -
A
DVICE
What advice would you give to fellow cybersecurity
professionals going into 2016?
Mark Bennet, Blustor: Cyber security professionals and the industry need to challenge our current paradigms that often
involve centralizing and attempting to
control every element of data flowing in
and out of the systems under our protection. We are in a leaky ship and bailing
the water out faster isn’t really solving the
problem. We need to look closer at the
underlying root issues, which include
things like immutable human behavior
and the inherent weakness of outdated
security mechanisms such as usernames,
passwords, and PINs. Until we do that, at
best we are just keeping our heads above
water.
Rajeev Chauhan, Cyber Oxen: Be suspicious, but don’t be paranoid about security, the best approach is having preventive
measures in place.
Kenneth C. Citarella, Guidepost Solutions:
Be patient when reminding others, be
vigilant, and hold on tight.
David Coallier, Barricade: If you have to go
to one conference this year, go to a conference that's NOT about security. Maybe a
software or cloud conference. Talk to people about security and note their eye-roll/
exasperation reactions. Security is scary,
and it's adversarial. Let's break down the
barrier and make security something more natural.
Amber Schroader, Paraben Corporation:
Vigilance to where we are leaving our digital identities. We are expanding out to
more and more layers that hold information tied to who we are and not thinking
how to protect and secure each of those
layers. We need to focus on knowing what
is where as we look at a cyber future with
devices tied to ourselves at every corner.
Mayur Agnihotri: “Keep seeking out new
things to learn and master what you
know.”
Wade Johansen, CouriTech LLC: You will
never be right 100% of the time, don’t let
it stop you from being right 1% of the time. Also, if you have a one-in-a-million
idea to improve something, then there
are 8,000 other people on this planet
thinking the exact same thing as you... be
the first to say it out loud.
Nick Prescot, ZeroDayLab: Talk security as
a business issue and not an IT issue. IT
creates the systems that process data, the
business are the ones that process the
data and the operations teams are the
ones that are responsible for the data.
www.eforensicsmag.com
www.hakin9.org
- 140 -
A
DVICE
What advice would you give to fellow cybersecurity
professionals going into 2016?
Mitchell Bezzina, Guidance Software: The
“assumption of compromise” mindset has
been gaining notoriety within Security
teams, it takes the active defense approach where security teams consciously
hunt for organization threats rather than
rely on technology to alert. The personnel
problem does not help this cause but building teams from parallel skillsets is the
only way to ensure there are more security professionals, and don’t concern yourself with a flooded market – there will
never be enough skilled cybersecurity
specialists.
Alina Stancu, Titania: Keep on top of compliance, as that will remain important in
ensuring baseline security. Certification
against governmental or business accreditations will travel down the supply chain
as more suppliers demand that businesses
present some form of security assurance
of their product and services.
Gerald Peng, Mocato: Your role is more
broad and important that you may imagine. Protecting the public from cyberattacks on their IT infrastructure and devices will help deter cybercriminals from
their spheres of activity. Our focus must
extend past our employers and clients.
We must collaborate to secure our data
sovereignty, and reduce any weak points
in our systems.
Roberto Langdon, Nicolas Orlandini,
KPMG: Our vision of what will be going in
2016, is that there have been several cases where the forensic investigation helped to discard false hypothesis, false
conclusions, and these aspects are showing the importance of this discipline to
be used strongly each time, and so on in
the future. As the forensics doctors said
“a dead body can still tell information regarding to resolve a murder”, the information technology recipients or devices
can bring more than we can imagine, in
order to resolve frauds or criminal cases.
Paul Hoffman, Logical Operations: Jump in
with both feet.
Dotan Bar Noy, Re-Sec Technologies: We
live in exciting challenging times and are
receiving public attention as well as enterprises boards. We need to make sure the
advice and solutions we are offering are
not just adding layers of more of the same, but substantially improve the overall
enterprise security while keeping organization productivity untouched.
Stephan Conradin: Learn, understand,
have global view, learn again, understand
again.
www.eforensicsmag.com
www.hakin9.org
- 141 -
A
DVICE
What advice would you give to fellow cybersecurity
professionals going into 2016?
Michael A. Goedeker, Auxilium Cyber Security: LEARN HOW TO HACK THINGS, Be
curious, always continue to learn new
things and technology. Stay informed and
aware, assume every OS, Application and
piece of hardware can spy on you, has
weaknesses and needs to be verified. Security is a business process just as much
as it is a technological one, never EVER
forget this. Security protects IP, revenue
and the business. Be creative, think outside the box.
David Clarke, VCiso: Keep Going. Keep the
Passion.
BroadTech Security Team: Stop hype. Learn your stuff. Know what you are talking
about. Keep yourself updated daily & share your knowledge with others. Stop using
jargon and fancy words and explain things
clearly to people. Our job is to keep things
secure and not to show off our knowledge
or expertise. One more prediction. Once
Hammer2 is feature complete, DragonFLYBSD implements single sign on and
redundancy using CARP, etc. The way of
doing cloud computing will take a new
turn.
Craig McDonald, MailGuard: The number
one tip is to plan a 360 degree approach
to cyber security. Understand all your businesses attack vectors and how these can
be infiltrated by cyber criminals. Blocking
threats through the use of cloud security
services such as email and web filtering
should be the first line of defence – protecting the organization’s network.
www.eforensicsmag.com
www.hakin9.org
- 142 -
C
ONTRIBUTING
COMPANIES
www.eforensicsmag.com
www.hakin9.org
- 143 -
www.eforensicsmag.com
www.hakin9.org
- 144 -
www.eforensicsmag.com
www.hakin9.org
- 145 -
www.eforensicsmag.com
www.hakin9.org
- 146 -
www.eforensicsmag.com
www.hakin9.org
- 147 -