2008 Security: More of the Same...Much More - Twenty-Four Seven Security

« Government Leads in Data Breaches | Main | Rather Ridiculous Data Theft Story »

January 08, 2008
2008 Security: More of the Same...Much More

Found an interesting article on CNet by Jon Oltsik looking forward to security in 2008. A quick summery of his list is below with my comments (also, the last one is mine):

Comprehensive Desktop Security: PCs used to only have to worry about antivirus (the good old days), but you can now add Network Access Control (NAC) and data protection to that list.

Public Key Encryption: This is becoming a popular way to transmit info on the internet, and while government will probably drive the Public Key Infrastructure, expect PKI-ready applications and PKI-enabled Windows.

Federated Identity: While federated identity had pretty much overpromised and underdelivered already, it was drawing heavy buzz at this years IAM show, and expect it to realize much of its promise this year.

Encryption: Still somewhat resource-intensive to deploy, new storage devices should change that this year, and with so many laptops gone missing last year, the only reason that hits the news is when that laptop is carrying unencrypted data.

SaaS Security: Too complex, too many patches, and not enough skilled people, all the more reason to give the job to someone else (but if they're called WiseGuy Security, you might want to go with someone else).

Security Product Consolidation: While IBM has been making noise about their end-to-end security product, the other biggies have been quickly acquiring companies to fill out their end-to-end security portfolios.

Information Governance: Expect standard data models, meta data tagging, and information classification to help companies standardize their data security so they now where it is, what it is, and who has access.

Better PCI DSS Enforcement: The payment card industry data security standard rules are written, but many companies are still far from compliant. Previously, the PCI DSS folks have kept pushing back the deadlines, but in order to prevent us from going back to the barter method (how much can 200 digital words get you at the ole cigar shoppe?), expect stronger enforcement and more stringent penalties.

Log Management Architecture: The who and what of data access is key to data security, and log management plays a big part of that. But acquiring log data and managing it are two different things, which is where log management comes in.

Application Security: Applications can no longer be tossed out to the wolves of the Internet without comprehensive security testing (the stakes are just too high).