No matter how sharp or savvy, what prodigious prognosticator could have 30 years ago forecast the earth-shaking events that have brought cyber-attacks and cybersecurity center stage?
While recent events certainly make it difficult to conjure what the next 30 years, or even the next 10, will have in store in cyber, long-time IT security experts—armed with the benefit of wisdom, experience and, of course hindsight—are willing to venture a guess at what threats, challenges and demands will lay ahead.
“This is an interesting question to reflect on, given that some of my oldest published predictions for ‘in the next 10 years’ are now more than 10 years old. At that point, the increasing interconnectedness of computers seemed like the biggest issue, given the poor state of security knowledge of most computer users at the time. I foresaw things going one of two ways: either we’d all get more security-savvy, or the Internet would become an unusable slagheap. The reality went somewhere down the middle. We’ve become accustomed to an increasing amount of background noise from spam, phishing, fraud, abuse, deceptive privacy practices, and data breaches. This hasn’t exactly made the Internet unusable, but it has certainly made it a much more frightening place, and there is an increasing amount of evidence that people are pulling away from certain online activities or just viewing the whole situation with resignation. It would seem that the next ten years will be the crucial years in terms of establishing a base level of trust. I doubt that the background noise of crime and misbehavior will ever go away at this point, but if trust isn’t established, we may end up with a more segregated Internet, as ‘public’ spaces become unusable.” --Lysa Myers, security researcher at ESET
“The greatest challenge of the next 10 years is one enterprises are already facing: automation. Even today, most security vendors focus automation on alerts or on very specific, granular activities that fail to provide the simplicity and force multiplier security teams need. Security teams should instead focus on implementing an elastic defense that adapts to its environment. With the ever-changing and rapid deployment of cloud environments, this is especially important.” --Ratinder Ahuja, founder and CEO of ShieldX
“Looking ahead in the future, I think there are three key things that will challenge the industry: quantum computing, machine learning and artificial intelligence and workforce diversity… Quantum computing’s impact on encryption is not a matter of if, but when, technology that breaks encryption algorithms will exist. New technologies will need to be invented to protect our sensitive data. The second area in the future relates to a data-driven industry. While we have seen the advent of machine learning and artificial technologies, we are on the cusp of adversarial machine learning that will be used to defeat our own technology. It will be very interesting to watch how organizations and the industry deal with this problem. And, as we look at stopping attacks, we must keep focused on building the best team of cyber defenders, which implies diversity. We need to evolve our thinking and think differently about the problems because, just like the attackers, our strategies must evolve too.” -- Grant Bourzikas, McAfee Labs, CISO
“Challenges ahead include having a mature enough incident response/defense infrastructure and team such that active threats and past events are detected much earlier in the game, hours instead of weeks. Also, organizations need to know what devices are on their networks. With the maturity of IoT and the exponential increase of sensor devices, it’s near impossible to know all the devices connected to the production network. There’s also an increasing skills shortage gap [with] various industry reports showing a two million person shortfall of workers today and growing. The number of women in cyber has remained at just 10-12 percent for more than five years which means the attrition rate is higher than the attraction rate. Lack of diversity will lead to blind spots in organizations security strategy.” --Michele Guel, distinguished engineer and chief security architect for the security and trust Organization at Cisco
“The merging of all networks into a continuously interdependent system means it will become almost impossible to determine what is happening with the assets you are charged with protecting. The consequences of system failure could mean that someone up North freezes because a hacker got to their IoT system via your company's cloud system. In 1992 I could not envision today. I would be lying if I said I could really envision tomorrow.” -- Patrick Hinojosa (retired), former chief technology officer and vice president for marketing, Panda Security U.S.
“The Russians are not alone in attacking our networks. State sponsored cyber armies like the Chinese have, and rogue nations like North Korea and Iran with skilled hackers living off the land are also significant threats in the next 10 years. The problem is that the Internet is a beta. It was built for redundancy and not security. If only the NSA had said ‘yes’ in 1978 to the question if TCP/IP should be encrypted. We would have lived in another world today and in the future.” -- Stu Sjouwerman, founder and CEO of IT security training company KnowBe4
