Cyber forecast for 2013: 4 areas where the stakes are raised

The year just ending was much like any other: The bad guys attacked, the defenders parried, the bad guys disengaged and attacked with a thrust in a different quarter. Both sides have gotten better in this online match and neither has developed a decisive advantage in the perpetual dual in cyberspace.

What is changing are the stakes. More data and more applications are going online, and as targets become more valuable they will attract more attacks. Highly motivated criminals, industrial spies, hacktivists or nation states will continue to use every trick they can to gain a marginal advantage, and when a breach or other security incident does occur the results are likely to be serious.

The pain points that observers are worrying about for the coming year are not new — except for the release of a new version of the Windows operating system — but they represent areas where the good guys and bad guys are likely to be going head-to-head over those high-value targets. Here are thumbnail sketches of some of these pain points. As always, this list represents a broad consensus of concerns and does not pretend to be comprehensive or scientific.

Cloud computing

It turns out that the cloud is a pretty secure place. “There is no doubt that there are risks in the cloud,” said Richard Moulds, vice president of product management and strategy for Thales eSecurity. “But depending on the abilities of the agency, the cloud might actually do some things better.”

Patch and system management can be more efficient because a cloud provider can justify acquiring the needed tools. But good security is not perfect security.

“Most of the time, we are not going to see many security issues because the large cloud services do a good job, but once they fail, the impact will be much, much higher, and that is the problem,” Engin Kirda, associate professor in computer science at Northeastern University, said in a presentation at Georgia Tech’s 2012 cybersecurity summit.

Agencies will have to determine to what degree they can trust a cloud provider to protect their data, and the degree to which they take responsibility for security. Encryption is a valuable tool for protecting data, but at the moment cloud users have to decide between letting the provider encrypt the data and control the encryption keys, or encrypt the data themselves and retain control of the keys, which limits the functionality of the cloud. Standards for key management are emerging that would allow cloud providers to do encryption while data owners manage the keys, but this service “is not really available now,” Moulds said.

Clouds also can be used as platforms by bad guys. Using stolen credit card accounts to buy cloud computing resources can be a quick way for criminals to create clusters of virtual systems. This raises the question of the cloud provider’s responsibility for vetting users of their services.

Supply chain security

The issue is not a new one, but it takes on special significance in IT, where many components of critical systems are manufactured abroad and accidental or malicious flaws that are difficult to detect could create back doors for remote exploits. This subject has been bubbling toward the top of consciousness for the past few years.

Microsoft made news earlier in 2012 with the discovery of malware running on pirated copies of its operating systems purchased in China, and in October the House Select Committee on Intelligence warned companies of the security risks of products from Chinese companies ZTE and Huawei, saying that “U.S. network providers and systems developers are strongly encouraged to seek other vendors for their projects.”

The supply chain issue is closely related to the broader issue of secure software development. Although adoption of secure development practices does not address the issue of intentional creation of backdoors, it can help protect against bugs that create vulnerabilities and provide criteria for selecting trusted vendors.

Steven B. Lipner, chairman of SAFECode and a director of program management for Microsoft’s Trustworthy Computing initiative, predicted there would be a new policy focus on software assurance in the coming year. “Whether that is good news or bad news depends on what kind of policy directions people choose to take,” he said. Overly prescriptive requirements could create more problems than they solve, he warned.

The National Institute of Standards and Technology has weighed in with advice on managing supply chain risk for federal information systems in an interagency report published in October. It recommends that agencies:

• Uniquely identify supply chain elements, processes, and actors.
• Limit access and exposure within the supply chain.
• Establish and maintain the provenance of elements, processes, tools, and data.
• Limit the sharing of information.
• Perform risk management awareness and training.
• Use defensive design.
• Perform continuous integrator review.
• Strengthen delivery mechanisms.
• Manage disposal and final disposition throughout the life cycle.

Collateral damage and unintended consequences of cyber war and espionage

Cyberwar and state-sponsored espionage emerged several years ago as concerns, but state-sanctioned use of cyber weapons such as the Stuxnet family of software might be just the tip of the threat iceberg.

“Conflicts in modernized areas will use cyber warfare to a varying extent, often involving malware,” Snorre Fagerland, principal security researcher in the Norman Malware Detection Team predicted. “Those without the money, skill or time to develop their own will use off-the-shelf tools.”

But Microsoft blogger Tim Rains warns that the process will work the other direction as well, with criminals benefitting from cyber war and espionage. “It’s a safe bet that there have been some unintended consequences that we will continue to see in 2013 and beyond,” he wrote. One example he cites is the appropriation of a zero-day vulnerability used in Stuxnet for use in criminal malware.

Malicious code is notoriously difficult to control once it has been released into the wild, and the well-funded efforts of nations to develop sophisticated weapons could go to subsidize cyber criminals, Rains warns.

“The barriers to entry for criminals to leverage highly sophisticated techniques in their attacks are lowered each time the malware and vulnerabilities that highly skilled professionals develop and use, are discovered,” he wrote. “This is likely to amplify the unintended consequences of espionage in the coming years.”

Windows 8

By all accounts, Microsoft’s latest operating system reflects the company’s efforts at secure software development and does a pretty good job of security. But it isn’t perfect and it is a high-profile, high-value target.

Windows 8 is a significant redesign with a much different look and feel that will cause many enterprises to be cautious in transitioning. But with XP approaching its end of life and the failure of Vista to gain popular support, we can expect to see Win8 being widely adopted in coming years. This, and the fact that it will provide a uniform platform for a wider variety of devices, will make it an attractive target for evil doers. With enough researchers hammering away at it, they will find significant vulnerabilities to be exploited.