Don’t you hate year-end articles? I do — to me, they are frequently just an excuse for writing about the obvious. At least this is often the case when it comes time to read articles about security challenges of the past year. I especially dislike year-end articles that don’t offer any new insights, particularly for the reader who has been paying attention and can craft their own highlights and lowlights without having to consult a leading analyst or other truth seeker to stay on top of the latest security challenges.
Two recent articles from FastCompany and Wired about the “emerging security threats of 2016” demonstrate my point.
Publications Address Security Challenges
FastCompany interviewed three executives from security vendors and talked about the rise of ransomware, how threat vectors are moving from desktops to smartphones and the dangers of the Internet of Things (IoT). These are all things that have been written about over the past year in some depth and frequency. Certainly any CISO worth the title would already know about these trends. In fact, one of the threats mentioned was WireLurker — which Security Intelligence covered more than a year ago.
Wired digs a little deeper: Instead of just mentioning ransomware, it talks about extorting data, as was done with the members of the Ashley Madison site. Yet our story about ransomware from September 2015 goes into a lot more detail about threat vectors than either publication.
The Wired piece also mentions IoT-based attacks. Again, this is something that we have written about extensively at Security Intelligence. To be fair, the Wired article does touch on several other threat vectors and security challenges.
Looking for a Real Annual Review?
If you are looking for a solid year-end summary, SecurityCurrent has one that offers actual information from 25 different CISOs. The range of replies from these security leaders is interesting. As you might expect, instead looking at the flavor of the week, the CISOs talk about improving existing safeguards rather than focusing only on the types of attacks themselves.
Some argued that antivirus programs are due to be replaced with better technologies and tools. Others claimed that now is the time to adopt cloud security practices and better operational methods to stay ahead of bad actors.
A few CISOs do reference the rise of ransomware attacks and how having better and more reliable backups are critical (that seems obvious, but is worth mentioning). IBM’s David Cass, the CISO for Cloud & SaaS Operational Services, weighed in as well. He said that in 2016, “cloud will be about leveraging new capabilities rather than just a cost savings.”
While year-end articles may never be my cup of tea, I’m glad there are still some publications and blogs that go the extra mile and find practical information for security practitioners.