Scoring cybersecurity hits and misses for 2013
Connecting state and local government leaders
Predictions are easy; accurate predictions are harder. Here’s how we did last year in predicting cybersecurity trends for 2013.
Predicting is easy. When it’s made, one prediction is as good as another. Only in hindsight can you pick the winners from the losers. Let’s look back at my 2013 predictions for cybersecurity and see how good they were.
I hedged my bets pretty well last year. The predictions for the most part covered areas that were so basic that they would be important security concerns regardless of what happened. But did they deserve to be singled out for 2013?
Cloud
It turns out that reliability, not security, was the big issue in clouds.
An inspector general’s report found that NASA, a pioneer in cloud computing, suffered from a lack of proper security. “We found that weaknesses in NASA’s IT governance and risk management practices have impeded the agency from fully realizing the benefits of cloud computing and potentially put NASA systems and data stored in the cloud at risk.” But the report did not cite any serious breaches, and according to data from the Privacy Rights Clearinghouse most data losses still are occurring the old-fashioned way: Through lost, stolen or discarded devices and documents and from in-house breaches. Not from cloud breaches.
What caused problems in the cloud were a string of outages plaguing Amazon Web Services, Dropbox, Microsoft Office 365, Windows Azure cloud storage and CloudFlare. Data wasn’t lost, but it was unavailable. For the end user, an outage is as good as a denial-of-service attack.
Collateral damage and unintended consequences of cyberwar and espionage
This one was spot-on, especially for the NSA, which suffered from multiple self-inflicted foot wounds in 2013.
From June on, the nation’s eavesdropper in chief, Gen. Keith Alexander, found himself defending once-secret electronic surveillance programs in the wake of a never-ending stream of revelations stemming from Edward Snowden’s leaks of classified documents. Repeated lies, half-truths and evasions were exposed with each new release about wholesale collection of digital communications data at home and abroad, the tapping of international fiber-optic cables, cryptographic back doors and abuse of data.
NSA staffers, portrayed by Alexander as heroes, became the bad guys in many eyes. In December, the first of what will likely be multiple court decisions about the programs found wholesale collection of cellphone metadata likely to be unconstitutional.
Supply -chain security
This issue failed to rise to the level of a crisis in 2013.
Although lengthy and far-flung supply chains have possible weak links all over the world, China has been the primary concern for the U.S. government. There are appropriations laws in place prohibiting some agencies from dealing with Chinese contractors, and there have been anecdotal reports of NASA contractors with suspect Chinese ties.
In November, the Defense Department amended its acquisition rules allowing the DOD “to consider the impact of supply chain risk in specified types of procurements related to national security systems.”
But 2013 did not produce any serious cybersecurity incidents resulting from weaknesses or backdoors in IT products that were inserted in the supply chain (if you don’t count reports of NSA dabbling in commercial crypto systems). Of course, the beauty of supply-chain tampering is that if it is done right, no one will see it. We might not know for years if we’ve already been had.
Windows 8
With the popular Windows XP approaching end-of-life in April 2014, the security of Windows 8 is a concern. But there has not been much bad news here. The latest Windows OS generally is seen as the most secure version to date.
Windows 8 includes its own antivirus features with Windows Defender, which starts early in the boot-up process to help protect against rootkits. Downloaded files are scanned for executables and applications are sandboxed. Version 8.1 includes data classification for remote wiping, improved fingerprint biometrics and better encryption. Overall, this one was a miss.