I’m pretty sure that all who read this blog will agree: traditional prevention-centric security models are becoming less and less effective each day, while conversely, people- and information-centric security models continue to advance and gain effectiveness. In a nutshell, people- and information-centric strategies begin by defining “the norm” (what is good). These strategies help companies quickly identify anomalies and then quickly respond and resolve those anomalies.
We’re at a point where we must assume attacks and breaches will happen constantly and turn legacy prevention-centric security strategies completely on their head. Today’s new security technologies that operate under this assumption, such as micro-virtualization for the endpoint by Bromium, are positioned to become an essential component of any enterprise security strategy in 2020.
In fact, Gartner has spent the past 6 months boldly predicting at various IT- and security-related events that by 2020 prevention-centric strategies will be obsolete. This makes total sense if you consider two major developments:
- The convergence of several major computing trends, such as cloud, mobile and the internet of things—all of which rapidly fuel expansion of the digital universe.
- The launch of increasingly sophisticated cyber-attacks, namely Advanced Persistent Threats (APTs)—many of which target the above burgeoning trends.
First, let’s talk about the digital universe. As the digital universe grows and becomes more pervasive in our lives, our ability to trust this universe becomes more and more important. Without trust, the entire digital universe fails. Fast-forward to 2020, and this notion of a digital “world without trust”, becomes even more daunting, especially if you consider the following estimates:
- 50 to 75 billion “devices” will be connected to the internet (compared to 8.7 billion in 2012).
- Nearly 6 billion smartphones will be in the hands of consumers (compared to 2 billion in 2010).
- The average household will own roughly 50 internet-connected devices.
- The overall size of the digital universe will reach 40,000 Exabytes or 40 trillion gigabytes (more than 5,200 gigabytes for every man, woman, and child in 2020).
- From now until 2020, the digital universe will nearly double every two years.
I could go on, but I think you get the picture. The numbers above are at a digital universe-wide level, but you can expect your corporate infrastructure and network to grow and scale similarly, if not faster.
The opportunity this “big data” presents is fascinating. But now, consider the “opportunities” this anticipated growth provides cyber-attackers. As the digital universe expands, our ability to preserve trust in this universe becomes more challenging, more daunting and more imperative. And if we don’t have trust, it really doesn’t matter how many internet-connected devices researchers believe we will have in 2020. Without trust in the digital universe, our world of frequent and convenient online commerce may cease to work.
So if you’re struggling to secure and protect trust today and you have plans to leverage and monetize your enterprise’s growing digital capabilities, something definitely needs to change, and change now. Encryption keys and digital certificates provide the backbone of trust for your organization’s digital assets, yet they also serve as a cyber-attacker’s weapon of choice to evade detection.
The highest profile example of this is the U.S. National Security Agency (NSA) breach by Edward Snowden earlier this year, the success of which relied heavily upon a total breakdown of trusted computing. Like the size of your digital footprint, these “attacks on trust” will only keep growing if they continue to be successful.
Because certificates are being used as cyber-weapons, their validity periods are becoming shorter and shorter. Today, I personally recommend employing certificates with a maximum validity period of no longer than one year. The rationale is that the longer a particular certificate is used, the more likely it will be copied or forged and thus will no longer be trustworthy. Some studies go even further, and proclaim “short-lived” certificates limit the scope of vulnerability, as a result of having validity periods of only a few days. While this practice sounds great in theory and enhances certificate security, the operational aspects could be a nightmare. Quite simply, IT groups cannot effectively and securely manually perform that type of ultra-frequent certificate revocation and provisioning.
The good news is that even now in 2013 it is possible to both secure trust and effectively execute all required processes around a rapid rotation of certificates, regardless of how large your digital universe may eventually grow. Venafi’s current technology platform for protecting any key, any certificate, anywhere is engineered around Gartner’s 2020 recommendations. Venafi’s platform provides a people- and information-centric security and protection strategy for keys and certificates. It establishes the norm (a baseline inventory of keys and certificates) and provides rapid anomaly detection along with dynamic response technology to remediate attacks. Furthermore, Venafi’s platform allows an enterprise to quickly and securely revoke anomalous keys and certificates that are associated with APTs or unknown machines/devices, and rapidly enroll and provision new ones, regardless of how often.
For your growing digital footprint to remain trustworthy, your organization’s move toward a people-and information-centric security strategy must include the protection of keys and certificates. The success of your security strategy depends upon your ability to comprehensively cover 100% of your attack-vector surface, and allowing for rapid detection and response in all areas.
And now is the time to begin securing and protecting this trust in your infrastructure because the larger infrastructure grows, the longer it takes to initially control and secure. By creating a strong program to control and secure digital trust today, you place your business in an ideal position to confidently expand its digital footprint and maximize its value to the business tomorrow. Bring it on, 2020.