So it's well past new years eve and I am finally posting a small update.
I have been reading all the other blogs and figured it was time I posted my own "predictions for 2009" style post where I warn against increased attacks of various kinds and offer my hopes for the future. Unfortunately I'm not optimistic...things usually get worse before they get better.
Even with the increased focus on security lately we have several fundamental holes that we haven't managed to sweep under the carpet in the past 20 or so years. Everything from buffer overflows to SQL injections which we have proven solutions for still exist in the wild with varying frequency. With the increase in the number of software, websites, "intelligent devices" and other technological advances there will be an even greater attack surface available to the "bad guys".
I will stop myself short of writing a complete doom and gloom post here. There is light at the end of the tunnel, progress is being made and awareness is increasing. Personally I think the security industry as a whole needs to lift their game and stop selling snake oil to line their own pockets with gold. We need to adhere more to academia, be open about research, give credit where due and try to find solutions that prevents, not cures problems. The time of reactive thinking and response need to come to an end. So if you achieve nothing else in 2009, please try to focus on proactive solutions.
I have been reading all the other blogs and figured it was time I posted my own "predictions for 2009" style post where I warn against increased attacks of various kinds and offer my hopes for the future. Unfortunately I'm not optimistic...things usually get worse before they get better.
Even with the increased focus on security lately we have several fundamental holes that we haven't managed to sweep under the carpet in the past 20 or so years. Everything from buffer overflows to SQL injections which we have proven solutions for still exist in the wild with varying frequency. With the increase in the number of software, websites, "intelligent devices" and other technological advances there will be an even greater attack surface available to the "bad guys".
I will stop myself short of writing a complete doom and gloom post here. There is light at the end of the tunnel, progress is being made and awareness is increasing. Personally I think the security industry as a whole needs to lift their game and stop selling snake oil to line their own pockets with gold. We need to adhere more to academia, be open about research, give credit where due and try to find solutions that prevents, not cures problems. The time of reactive thinking and response need to come to an end. So if you achieve nothing else in 2009, please try to focus on proactive solutions.
