The SANS Technology Institute

Security Laboratory

Sec Lab: Predictions and Trends for Information, Computer and Network Security

A collection of predictions about the future of security for computers, networks and information.

2009 Security Predictions - Updated January 3rd, 2009
Stephen Northcutt's favorite Security Predictions for 2008 - Updated April 16th, 2008

2009 Security Predictions

January 3rd, 2009
By Stephen Northcutt and friends
Version 1.8

Raphael Gomes Pereira from Chemtech in Brazil weighs in,

• In 2009/2010 we will have more problems and issues related to information security in industrial environment (SCADA, PIMS, MES and other industrial systems). As a result of increased successful attacks, we will see more security products developed for this market as well.

Database Activity Monitoring will start to be the new security project for ITSEC shops. This will be driven by compliance, it will be very similar to the push for log monitoring. The initial push will probably start with PCI and as auditors start understanding the problem. This has all the earmarks of a hot project because there is a simple business driver. Employees snoop on database records when they shouldn’t. Britney Spears' records were accessed by 13 employees at UCLA Medical Center. George Clooney’s were accessed at a New Jersey medical facility. Even though both of these are clearly HIPAA violations, PCI has more specific language referring to database monitoring. President-elect Obama’s cell phone records were accessed by Verizon employees and also his passport file was improperly accessed.

In a related prediction, NewsBites 12/30/2008 carried the following story:
Report Finds DHS Intelligence Fusion Centers Present Privacy Concerns (December 23 & 29, 2008) According to a Privacy Impact Assessment (PIA) from US Department of Homeland Security (DHS) chief privacy officer Hugo Teufel III, the agency's intelligence fusion centers pose significant privacy concerns. The centers were created to comply with the Implementing Recommendations of the 9/11 Commission Act of 2007. The Act also requires that PIAs be performed. The PIA found several areas of concern, including ambiguous lines of authority rules and oversight; participation of the military and the private sector; and mission creep.
http://www.dhs.gov/xlibrary/assets/privacy/privacy_pia_ia_slrfci.pdf
http://www.fcw.com/online/news/154752-1.html?type=pf
http://www.nextgov.com/nextgov/ng_20081229_7913.php




David Swift, Sr. Security Specialist with Perot Systems, shares his 2009 security prediction:

• I’m afraid I’d have to go with "Peter Picks a Pundit". Following the Peter principle, many in high places within IT, through no action of their own, who are not well informed, nor willing to ask those who are, will continue to be led by consulting/marketing groups in their choices rather than driven by business needs.

David Hoelzer, Director of Research at Enclave Forensics, has just returned from teaching at a SANS conference, and he sent us his information security predictions for 2009:

• I predict that in 2009 a major corporation who is fully PCI/DSS compliant will experience a major data breach, proving the point that "Compliant" is not the same as "Secure".

• My second prediction is that we'll see the industry begin to look for the next "big thing" in log management since many feel that SIEMs, SEMs, and the log management tools that they are paying for are not delivering the promised results.

David Linthicum, InfoWorld has posted his 2009 Service Oriented Architecture (SOA) predictions, my favorite, "There will be a larger focus on inter-domain SOA technology, or highly scalable and secure middleware technology that will provide scalable service and information access between the instances of SOAs within the enterprise, and perhaps intercompany as well. The fact is that much of the SOA solutions out there can't scale much past a single problem domain, thus this technology will become key to the strategic success of SOA."


There will be any number of people warning about MySpace, Facebook, Google Hacking etc in 2009-2010. As they come up, I will try to toss links to them. And they are all valid to some extent: young vulnerable girls do post too much information on MySpace, people do use other social media to track other people. Here is a really creative crime, written up in Heraldnet.com, "Another area of online crime that people need to be wary of is the bogus job offer, which can lead to being duped, or dead. The man who robbed an armored truck guard in Monroe last month used a Craigslist ad to hire a dozen unsuspecting decoys to be in the area as he made his getaway. The ad was for a prevailing-wage job -- $28.50 an hour -- for a road maintenance project. Those who inquired were told to show up to work wearing a "yellow vest, safety goggles, a respirator mask ... and, if possible, a blue shirt." Turns out that's also what the robber wore."


Benjamin Wright, Attorney, author and SANS Instructor, shares his 2009 security predictions:

• I predict we will hear more about the use of artificial intelligence to manage enterprise e-records. Firms are drowning in records (e-mail, IM and so on), and they are keeping more of those records on account of pressure from e-discovery in litigation. To expect employees to sift through their records one-by-one -- and then decide what to keep and what to destroy -- does not work well. See http://legal-beagle.typepad.com/wrights_legal_beagle/2008/09/e-mail-instant-text-message-record-destruction.html

• However, firms have legitimate desires to pare down the quantity of the records they keep and to better understand the records they do keep. To tackle this problem, a few advanced firms are developing custom artificial intelligence programs. The programs examine each e-mail, text and so on and decide how to categorize it and how long to keep it, based on an analysis of content. This is a fertile field for the application of AI.

Stephen Northcutt muses on the recent G20 meeting, their final communique has five major points:

• We agreed that a broader policy response is needed
• Based on closer macroeconomic cooperation
• To restore growth
• Avoid negative spillovers, and
• Support emerging market economies and developing countries

OK, first a financial observation, all that I have read says to diversify investments. However, almost every thing we have invested in is down. Growth stocks, down. Value stocks, down. I managed to eke out a profit first quarter, but it was just taking too much time. Bonds, down. Mutual funds, down. Foreign investments, down. Even start up companies are drifting down because the market is so tough. In fact, if Kathy had not insisted on the classic 4% CD for a measurable percentage of our investments, we would have been badly damaged financially. The only way to avoid negative spillovers is to implement some decoupling. Everything is still related, so there was no bright sector to turn to. There is an interesting advertising article by the Motley Fool on China and why their stimulus might actually create decoupling, but I am not in the mood to play in stocks of any sort before the end of the year. My 2009/2010 security prediction about the G20 communique is that to do all of this wonderful stuff they promise, they will have to do a lot of communication and planning. And some of the computer systems they do this communication and planning on are going to be infected with malware; the sort of malware that is designed to collect intelligence data. This article by Business Week paints a bit of the picture. And if you can get to SANS Security West, Rob Lee, a forensics expert, is going to explain the specifics of this in his night talk. The result of that is that some of this money will not be as effective as the people hoped because unscrupulous actors are going to intercept some of the plans and use them to their own advantage. Darkvisitor reports, "In October, Chinese hackers were able to gain access to the World Bank and this month it seems they have penetrated the International Monetary Fund. The analysis, provided by a former British intelligence officer, concludes that China is using this information for geopolitical leverage during the global financial crisis." If I was the G20, I would hire a few real security experts, run Kaspersky on as many systems as possible (my understanding is that while it is slow, it is the best of the lot), so even if you use a different AV product, at least scan them with Kaspersky and also the Microsoft One Care Safety Scanner, an awesome, free tool. Also, get as many of the G20 on Firefox 3 running the NoScript plugin as possible. Next, get whitelist software like SavantProtection, CoreTrace, Bit9 or Lumension on those systems to make it much, much harder to infect.

And this same advice goes for President-elect Obama, I hope that cybersecurity will be a priority in his administration. That was one of his campaign promises according to nextgov "As president, I'll make cybersecurity the top priority that it should be in the 21st century". "I'll declare our cyber-infrastructure a strategic asset, and appoint a national cyber adviser, who will report directly to me. We'll coordinate efforts across the federal government, implement a truly national cybersecurity policy and tighten standards to secure information -- from the networks that power the federal government to the networks that you use in your personal lives." No matter who you voted for, the evidence is compelling that the United States government needs to do a better job of securing their systems.

A blogger, Douglas Karr, that focuses on marketing, has an interesting prediction for 2009, that search and mobile are the future. The reason this prediction is interesting is that Nokia just announced they expect mobile device sales to be soft in 2009. The Marketwatch article states many high tech companies have lowered their forecast for 2009 including Intel, Cisco and Sun ( Sun is cutting 6,000 positions). According to ThomasNet, "Unsurprisingly, the world economic outlook remains grim, with global GDP expected to decelerate in 2009, according to recent economic reports. Recovery is not anticipated until the latter half of next year." So at first blush, I think Mr. Karr may miss the prediction since he pegs 2009, but that search and mobile are going to do well in the future is for certain. But before we listen to the gloom and doomers, let's drill down into the data. Mr. Karr's blog does point to an incredible file by Mary Meeker from Morgan Stanley (use the plus sign and view in full screen mode or the text is too small). It is the best analysis I have seen of the current economy and really have me thinking. If you want to understand the current economy, please take the time to read this, if you don't get it the first time, come back a day later and look at it again. Here is just one fact that I found amazing, Kindle, the Amazon ebook accounts for 12% of all Amazon book sales if that title was available for Kindle. Another thing that may help Mr. Karr's prediction is that the popular gadgets are really popular. According to a prediction published by Reuters in June, "Morgan Stanley expects 27 million iPhones to be sold in calendar year 2009 with an average revenue of $550 per unit." So maybe not every mobile device is going to do well, but Nokia could have an off year and Apple could have a banner one. And as far as search, Google remains a steady Eddie, continuing to wrest market share from Yahoo and Microsoft. I still hold that the Michal Perry blog that yellow pages will not be useful in 2009 misses by a few years.

Next a bit more on iPhones. Stephen Northcutt observes that almost all SANS instructors have iPhones. Will we see a major focus to compromise iPhones with malware in 2009-2010? Very likely. First some background, CSO magazine reported last year in an interview by Bill Brenner, possibly the best IT Security Journalist, with Mikko Hypponen, "It's quite quiet on the mobile side. We now have over 400 known mobile phone viruses and Trojans, but most of those target the older smartphone systems," he says. "Most of the current systems have improved built-in security." Hypponen believes the most likely mobile risk today isn't mobile viruses or Trojans, but mobile spying tools like FlexiSpy, Neocall or Mobile Spy. These commercial tools run fine even on the latest versions of Symbian, Windows Mobile or Blackberries, he says. Meanwhile, iPhone has been the target of some attacks, but it still has a minuscule market share globally compared to the big boys like Nokia. That means a smaller bull's-eye. But as that market share increases, he expects more attacks to materialize." Then, in January 2008, Internetnews.com reports, "The US Computer Emergency Response Team (US-CERT) has issued a warning that a fraudulent iPhone upgrade is making its way around the Internet and users should not be fooled into installing it. A package called "iPhone firmware 1.1.3 prep," which described itself as "an important system update. Install this before updating to the new 1.1.3 firmware" is floating around on the Internet. The fact it does not come from Apple is clue #1 that something is wrong. "This Trojan claims to be a tool used to prepare the device for an upgrade tofirmware version 1.1.3," the US-CERT advisory said. "When a user installs the Trojan, other application components are altered. If the Trojan is uninstalled, the affected applications may also be removed."


Fred Kerby, SANS author and instructor, offers two predictions for 2009:

• Organizations that have 'streamlined' the risk assessment process to include blind adherence to results from credentialed scans (and ignore other considerations) will experience a continued downturn in security effectiveness. Approved scanning templates that produce out of context reports will continue to mislead accreditors, resulting in more re-work for already burdened system administrators and other security personnel.

• Encryption for portable storage devices will continue to be a significant challenge for organizations of all sizes. Some organizations that implemented public key cryptography earlier for encrypting email (with the intent to leverage that infrastructure to portable devices) are now living in the theory - reality gap where they experience the frustration of not being able to obtain private decryption keys that were believed to be escrowed earlier.

Douglas Huber (GCIH CISSP CCNP CCDP CCAI) CISCO Regional Academy at Akron University / Summit College:

• My prediction is that the new applications oriented firewalls that allow the construction of rules based upon packet content/signatures in conjunction with protocols and ports will be chased by a number of vendors and will change the role of firewalls in a number of data center topologies. These will tend to displace the role of traditional IDS, proxy servers and other individual products as these become all-in-1 solutions that may be easier to manage.

• A second prediction is that corporate management will become increasingly aware of intellectual property theft as an IT security risk. This will occur as the financial visibility of these losses increase.

John Bambenek from the Coordinated Science Lab at the University of Illinois: My thought is that we will see an increase in using technology for the purposes of economic manipulation from foreign powers. While I don't really believe that Estonia and Georgia were subjects of "cyberwar" in the proper sense of the term, I do believe it has broadened the horizons of nations as to ways to engage in "soft" conflict with other nations.


During 2009 - 2010 you will start to hear about encryption key management problems with an end result of not being able to get your data back. Granted, this is not a new observation, Computerworld ran an article I believe was ahead of its time with the following pithy statement: ""If you share the key, you share the data; if you lost the key, you've lost the data," says Dennis Hoffman, general manager of the data security unit of RSA Security Inc., now owned by EMC Corp."

Somewhere between 2009 - 2012, you will start hearing rumblings of regulating Google (a scary thought). Let's go back to the United Airlines stock price dip and see what we can learn about the future: Sept 9, 2008, LATIMES, "Shares of UAL briefly plummeted as low as $3 early in the day -- from $12.30 on Friday -- after a 6-year-old story on the company's 2002 bankruptcy filing resurfaced on the Web and was reported as news by an investment letter. The shares bounced back after the market realized the report wasn't current. But investors who sold at the day's lows are stuck: The Nasdaq Stock Market, where UAL stock is listed, said trades triggered by the erroneous report wouldn't be rescinded. What's more, shares of other carriers, including Continental Airlines Inc. and AMR Corp., the parent of American Airlines, also briefly dived with UAL before rebounding. UAL blamed the mess on a posting of a 2002 Chicago Tribune article on the South Florida Sun-Sentinel's website. The story then was picked up by Income Securities Advisors, a Florida investment newsletter, and disseminated as a one-line brief over Bloomberg News -- triggering a wave of panic selling. Tribune Co., the owner of the Sun-Sentinel (and also the parent of The Times), initially pointed a finger at Google Inc., saying it appeared that the search engine highlighted the story out of the Sun-Sentinel's archives over the weekend, which generated traffic and caused the newspaper's computer to move the story to a page of most-viewed articles. But Google said the only reason its search engine "crawler" bothered with the story was that it was listed on the Sun-Sentinel page of most-viewed stories -- and with the weekend date on it, instead of the 2002 date."


Personal devices, from the iPhone to personal GPS, are going to throw up so much interference there will be unprecedented (though minor) problems, an O'Reilly blog talks about iPhones, but the concept of electronic interference can affect any of them, "We're really in an interesting time, radio speaking, in that there hasn't been a time before, certainly in the last five years, maybe the last ten, when there was such an inordinate number of relatively high-powered personal transmitters just wandering loose in the world."


Joshua Wright from Will Hack for Sushi says, "one of the trends I'm seeing is the continued movement toward pervasive wireless connectivity. Not limited to WiFi, there are lots of opportunities for people to connect to wireless for their social network site access, email, etc. Services like the Xohm WiMax offering in Baltimore will continue to spread, competing with existing 3G services and future 4G Long Term Evolution (LTE) technology as well. From a security perspective, users have a lot more ways to get connected now. Not only should organizations be concerned about rogue AP's, but they are also exposed from someone getting WiMax service at work to bypass content filters, or bridging their 3G card to their Ethernet segment. We still talk about auditing listening TCP/UDP ports, but now we also have to be concerned about a client's WiFi/Bluetooth/WiMAX/3G/802.15.4 connectivity as well."

Paul Asadoorian of PaulDotCom's 2009-2010 predictions. Paul is weighing in with 3:

• Other threats will become as easily exploitable as remote exploits. We've all seen how people scramble and make noise when Microsoft releases a patch for a new remote exploit (ala MS08-067). We will start to see attackers using other most subtle measures, such as web applications and mobile device attacks, in the same manner. Except, at least in the beginning, there will be no scramble and noise.

• Wireless networks will continue to source attacks. So many organizations have done a good job implementing "secure" wireless networks. However, there are always other threats that will continue, such as guest networks, handheld devices, client-side wireless software, that will open doors for attackers. These attacks are targeted and subtle now, look for a "knock your socks off" wireless attack in 2009 to really help put the risks in perspective.

• Someone will unplug the Internet - We've danced around it for quite some time and have seen some examples (youtube.com went away briefly in 2008), but time has come for major meltdown. This will most likely be a targeted attack as we move closer to cyberwarfare tactics really hurting. With the economy in the US already weak, enemies will be looking to take their shots and cyberwarefare will be one of them. Economic targets or even natural resources will be at risk. Thats the fun about predictions, you don't have to be right and you can think big. [Stephen Northcutt] Well that is certainly thinking big. For myself, I think there is enough redundancy that you cannot take down the Internet. I guess the closest thing we have to study is the Akamai attack.

Tim Stanley leads by example at Continental Airlines in labeling data according to CSOonline, “Stanley wants to categorize every file in the enterprise by three variables: owner, business value and risk level. The government has "top secret," "secret" and "confidential" ratings, but Continental's designations will be more granular and dynamic, using tiers and subsets of tiers. Thinking this way vaults Continental ahead of most companies.”


Eric Cole, Secure Anchor, offers two security predictions for 2009,

• Less reliance on patching This is a tricky one because I am not saying organizations should not patch. Patching is critical and still must be done. However, with the window shrinking between when a vulnerability is public and when the exploit is released, organizations will have to deploy other measures to help minimize their impact to exposure. This is further emphasized by seeing more out of cycle critical patches released by vendors, showing that organizations are going to have to do more with desktop lockdown. Hardening a client system by not allowing administrator access and removing all unnecessary components are important. Two results of organizations being less reliant on patching for their primary protection are more deployments of HIPS (host based intrusion prevention) and think clients increasing in popularity. Thin clients could also take the form of virtual machines where you load a new image every time you start the computer.

• More focus on data, less on the perimeter The perimeter is critical and must be maintained to have a proper level of security; however, the focus needs to be on understanding, mitigating and reducing the risk to critical data. Therefore, organizations will put more energy and time against data focused protection. The DLP (data loss prevention) space will have to be redefined since much of the current technology goes after low hanging fruit and companies will demand solutions that truly protect critical information.

Kevin McLaughlin (CISO, GSLC, CISM, CISSP, PMP), University of Cincinnati Information Security Department frames his 2009 predictions in light of his recent article describing our nation in cyber crisis:

• In 2009-2010 we will continue to see a trend where IT resources are asked to step up and become Information Security leaders and to re-tool themselves into that role. This means that we will continue to be climbing the curve towards having enough Information Security expertise inside of organizations to meet the basic Infosec needs of the business but we won't reach the saturation point of that effort during the 2009-2010 time frame.
• We will also continue to see Information Security departments with inadequate funding (a generalization) when compared to other business units; and, while companies tout that they spend 3-5% of their IT budget on security, they forget to mention that this is spread across Systems operations, network operations, development, business services, and, oh yeah, the security unit gets some of it also. This means that the trend of Information Security professionals having to coax peer groups to lead the way in many new security implementation areas will continue.
• We will continue to see a migration of Information Security professionals out of core IT and into a more overall Risk Management unit, which is a good thing, and this move will position our profession much better in regards to being able to better influence business/compliance strategies - one of which will be to educate our communities that we need to be data centric not equipment, location or infrastructure centric.

Stuart King raises the question of Security Fatigue in his Risk Management Blog and asks the question, "Are we going through problem fatigue from working through a continual cycle of issues that have the same root causes?"


Ken Steinberg, CTO of Whitelist/Endpoint Security vendor Savant Protection, weighs in with no less than three predictions:

• "Integrated Touchscreen Biometrics: One of the biggest problems in data protection is the initial classification and protection of the data as it is "laid down" (read saved). With the popularity and productizing of touch screen technology, I think it is feasible that when files are created/edited/copied, the producer/consumer will identify themselves by simply touching the screen as the file is accessed, allowing the computing system to use their fingerprint as a watermark and security protection mechanism. File system drivers will be written to work against a series of rules that apply to the stored biometric signature and will control read and write natively.
• Create a file, in order to save it you must imprint it and assign a classification.
• Read a file, you must provide biometric access which is checked against a rules engine.
  

• Risk Aware Wireless: My network access is too passive in its orientation towards security. I can easily see my network cards providing me an assessment of potential risk or risky activity as I access different LANs (terrestrial or wireless). Wireless providers or an independent agency would greatly aid the overall mobile community by tracking Access Points by risk and/or enhancing network cards to detect improper network activity which would signal changes in one only risk profile. The industry needs to enhance HIPS to include WIPS (wireless intrusion prevention) and I can clearly see this being introduced by a vendor in the next 18 months.

• Data Masking Browsers: For companies that want to make sure their employees are not shipping data outbound via their browsers, enhancements will be provided which will allow the CSO to set up trust relationships with certain websites and to assign customer encryption with these endpoints so that employees can only go to certain websites and any data payloads are encrypted by a process outside their span of control. If the target http server does not have the key for decryption, the data is still secure. This will help combat against users shipping data to themselves on a home or third party webserver and the possible DNS poisoning.

Mason Brown, a SANS Executive points out "Historically, I think it is right to say that crime tends to go up when the economy goes down. Good people WILL steal to feed their kids. So, I think we will see an increase in organized and other crime activity due to slowing economy. And I think it will be exacerbated by reductions in budget for IA training and technology. IOW, the bad guys will work harder and the good guys will be fewer and on average, have less current skills and technology.Which means the bad guys will win even more often."

GTSI explains why we should not cross the streams. Dark Reading has picked up Georgia Tech Information Security Center report that highlights the top threats "Cellphones will become members of botnets. VOIP systems will get hit by blackmailing denial-of-service attacks. The cybercrime economy will thrive, even as the global economy struggles. And today, around 15 percent of all computers online are infected as bots, up from 10 percent last year, according to the Georgia Tech Information Security Center's (GTISC) new report on emerging cyber threats for 2009 and beyond."


Government Computer News also picks up the Georgia Tech Information Security Center report, their takeaway is "What's the top threat to data security going to be in 2009? According to the GTISC Emerging Cyber Threats Report for 2009 out of Georgia Tech's Information Security Center, the answer is malware specifically disguised as "benign social networking links."
In 2009 - 2010 we will need to do a better job of measuring Information Security. From Kevin Thompson: "I just got done reading "The New School of Information Security" and "Security Metrics: Replacing Fear Uncertainty, and Doubt" and I was very pleased to see more attention being paid to measuring security and attaching business processes to the practice of information security. Having said all of that, I think the biggest challenge that we're going to be facing in the future is measuring information security. The time is coming when we will no longer be able to convince our management to spend money on something by scaring the bejezus out of them. This is already the case in some larger institutions with mature project selection processes, but I think if the economic recession continues more companies are going to be scrutinizing spending across the board. It is high time that everyone working in information security learn about using Net Present Value to select projects. However, if you're going to estimate cash flows, you need to have good data to go on, which means that you need to be able to measure events and the impact of those events. I don't know if this is a powerful trend for 2010 as much as 2012 or 2013, but it will be something that we all need to know.

Our inability to measure information security directly affects our ability to manage risk. How can we calculate Annual Loss Expectancy when we can't really determine how much our assets are worth? We have no way of reliably determining the probability of some event affecting our assets, and we have no way of knowing how much damage each of these events will do.

My advice would be to prepare yourself for these questions because they are coming. Selling me a self defending network is no longer sufficient. I want to know how many unpatched machines were connected to the network, what vulnerabilities are exposed because of the missing patches, how often those vulnerabilities are being exploited on other networks, and how much it has cost others when it was exposed. Then I can show my managers real benefit for their purchase.
J. Michael Butler, GCFA GSEC CISA, weighs in with a double hitter:

• "The job of the forensic investigator will be made increasingly difficult by the technically savvy user. With the ubiquitous availability of (free!) tools like TrueCrypt, and the ability to easily hide an encrypted volume, even in an encrypted volume, law enforcement investigators will have to rely on more indirect evidence in some cases, such as judicially warranted keystroke loggers or other surveillance options." [Stephen Northcutt] Great point Michael, I know we are starting to cover antiforensics in our hands-on Computer Forensics, Investigation, and Response class, but it may become more of an issue as time moves on.
  

• "In regard to eDiscovery, my prediction is that, with the increasing number of eDiscovery tools available, there will be an increased expectation by the court for more documentation in less time. While it may not become law, the simple knowledge that the tools are available will make the court less lenient when a corporation complains of excessive resource cost in time and money required to produce documentation. It will become a due diligence expectation for a corporation to acquire and use automated tools designed to streamline the eDiscovery process." [Stephen Northcutt] Interesting thought Michael, let's keep an eye on case law and especially see if this impact the applicatiion of Zubulake.
  

Repeat from 2008: Tony Bradley's blog mentions Network Traffic Consolidation, I think it has legs for 2009
"One of the big technologies of 2007 was the introduction of unified communications by both Microsoft and Cisco. The merging of all communications technologies into a single, unified system will continue into 2008. Aside from the whiz-bang, 'keep-up-with-the-Jones' aspect, there is a lot to be gained in terms of efficiency and productivity for organizations that leverage unified communications."


Repeat from 2008, Rational Security is focused on Information Centric Security Phase One
"It should come as no surprise that focusing our efforts on the host and the network has led to the spectacular septic tank of security we have today. We need to focus on content in context and set policies across platform and transport to dictate who, how, when, where, and why the creation, modification, consumption and destruction of data should occur. In this first generation of DLP/CMF solutions (which are being integrated into the larger base of "Information" centric "assurance" solutions,) we've taken the first step along this journey. What we'll begin to see in 2008 is the information equivalent of the Mission Impossible self-destructing recording...only with a little more intelligence and less smoke. Here come the DRM haters".
--April 11 2008 Update: "It's time for the industry to move away from protection of infrastructure and toward an "information-centric" security model, said Thompson, chairman and CEO of Symantec" two days ago in a keynote at RSA. I think this is a sure fire winner for 2008. For one thing the move to comply with the rules of discovery has caused organizations to survey what information they have, which is a first step in information centric security.