One of the things I love most about my job is the opportunity to collaborate with hundreds of security leaders across many industries and geographies. There’s definitely industry focuses, as well as some geographic trends, yet the overarching themes are common across the security landscape. Following the usual year end tradition, here’s what I see on the horizon for our programs, as well as some things that aren’ton the radar that probably should be, and as a bonus, one that is, that probably shouldn’t be.
The overarching theme again in 2019 will be staffing and resources. I separate those intentionally, both because people are more than just a resource, and because the staffing challenges are deeper than the budget challenges. We’ve all heard the varying statistics about millions of unfilled cybersecurity jobs in the next few years, yet as damaging as unfilled positions are, the churn occurring within the existing staff is worse.
One CISO, at a medium sized company, has given up trying to retain most of his staff – he views himself as a farm team for the big companies. So he’s trying to maintain a core of well-compensated people and live with the churn at the lower levels of the organization. Many CISO’s have complained that their HR pay bands/scales/ranges are based on IT, rather than security, and are both low and far too static. Yet even when they are able to maintain market compensation, the mind numbing tedium of repetitive tasks cause job frustration and churn.
Those staffing challenges are driving the two big technical trends for 2019: widespread adoption of machine learning in the SOC for incident discovery, and automation/orchestration for remediation. There’s (rightly) a lot of skepticism about machine learning and AI right now, yet real implementations and applications are having significant success in reducing the grunt work of low-level incident identification and analysis. User and entity behavioral analytics are still in the early stages, though we’ll see wider adoption. While some organizations will attempt to build their own security analytics data lakes using base ML technologies, as we’ve seen this past year, those efforts often fail, and I don’t expect widespread traction in that area.
Once the incidents are identified, for routine remediation, automation will explode next year. That’ll be split about evenly between human in the loop and hands-off automation, depending on culture and the level of the incident. One CISO has a policy that every time an incident is manually remediated, the next step is to automate it – the program goal is that manual remediation only occurs once. That’s improving staff morale and retention, allowing his highly skilled people to move up the value chain, and that approach will see widespread adoption next year, particularly for commodity incidents.
Another trend we’ll see, particularly among small and medium sized organizations is a move towards managed security services, at least for Tier-1 and often a hybrid model for Tier-2 and 3. We’ll continue to see some dissatisfaction with MSS providers, and churn among those customers. Aside on that – the best practice is to make sure to own the analytics infrastructure and data, so that when the MSS changes, history isn’t lost. The root cause of the dissatisfaction is that MSS contracts are written like IT outsourcing contracts, and have very clear specifications of what will be done. Understandable from a liability standpoint, but ineffective in a fast moving and dynamic cyber-hostile world. I’m starting to see some MSS providers working towards more flexible contract language, but that’s slow going. Still, due to the staffing shortage, particularly for off-hour support, MSS will be a core feature of a growing number of programs in 2019.
The flip side to MSS and it’s challenges, is the cloud. In this case, I’m talking mostly about security fromthe cloud. Right now, on-prem solutions require care and feeding, and often it’s the security professionals who are managing the tools. Moving those solutions off-prem frees up staff to actually do security. I saw the corner turn in 2018, with even risk-averse organizations embracing the cloud for select portions of their infrastructure. In 2019 that’ll accelerate, particularly for analytics and identity. Related to that is the emerging trend of the cloud providers offering security solutions themselves. Right now that’s rudimentary at best, and only for environments directly on their cloud. I don’t expect major improvements in 2019 – but let’s revisit for 2020.
An honorable mention goes out to companies with large IOT deployments, particularly for critical infrastructure: securing those environments will be the major program driver in 2019. That’ll begin with security analytics – just being able to understand what’s happening in the OT network is the largest challenge. The volume of events and data produced, as well as the unique characteristics of the environment, will require custom machine learning models to properly detect anomalies. Rule-based analytics are likely to remain problematic for IOT data sources due to the high variance between implementations.
The next honorable mention is SSL decryption. This is just started to emerge as a major concern over the past few months, and I had three conversations about it in the past two weeks alone. Upwards of 60% of traffic is now encrypted, including the vast majority of CnC traffic and data exfiltration. If the 2019 budget didn’t include SSL decryption funding, that’s likely to be an incremental ask.
The last honorable mention goes to our business stakeholders, who are now facing the reality that they need more than just technical means of addressing cyber risk. First, there’s been a growing trend to move the CISO out from under the CIO or CTO, and to a risk, compliance, general counsel, or direct COO/CEO reporting structure, and I expect that to become much more common in 2019. Second, as the threat of a black swan event becomes real, business executives are growing concerned about having good crisis communication plans in place. What looks like a good idea in the heat of battle often turns out to be a really bad decision, so a few forward looking teams are building those coms plans in advance. Part of that includes being prepared for a question on an earnings call asking if you’ve ever experienced a breach. The proliferation of privacy regulations makes answering those very touchy, as ‘breach, incident, disclosure’ and such all may carry specific legal meaning. A few more big breaches, and this could be a major trend in 2019.
And that leads me to the things that should be major trends, but aren’t. Those privacy regulations are largely known, but I’m not seeing significant efforts to address them programmatically. Companies that had to comply with GDPR are assuming those efforts will be sufficient for the upcoming California or now-in-effect Colorado laws, and they’re probably in not too far off (assuming they did a worldwide adoption). For organizations that didn’t have GDPR requirements, I’m not seeing widespread interest in a data classification and discovery effort. It’s hard and tedious, but if you don’t know where the data is, what it is, or who owns it, complying with disclosure regulations is essentially impossible. If we get a national pre-emptive law (highly unlikely) those teams will be caught short.
That’s a good example of the big piece that’s missing from the hot trends: basic blocking and tackling. In addition to data governance, many organizations, including those looking at AI and machine learning, still don’t have positive control over what’s on their network, how it’s configured, or in many cases, even formal policies governing the environment. Identity remains problematic, with a lack of centralized authority, integration with employee life-cycle, let alone SSO. Gaps in that basic infrastructure will prevent the ‘hot trend’ initiatives from realizing full value. It’s hard to do UBA without endpoint or identity management!
Now the bonus, I hear a lot of interest in threat hunting. That’s one that commonly comes up in conversation, though honestly, the vast majority of organizations aren’t ready to really tackle it, at least not beyond the vanity title. Let’s leave that for another blog post, and probably a 2020 trend.
In closing, I had a CISO, pretty worn out from a long year, wistfully hope for a ‘Christmas Truce’. I suspect that desire is the widest trend of all, so here’s hoping for a Silent Night this season.
Merry Christmas to you and yours!