JAN - JUNE 2019CYBERSECURITY REVIEW8 SECURING NEW TECHNOLOGY IS GOING TO BE OK. JUST NOT TODAY.By Stephen Fried, IT Security Director, American Family Mutual Insurance Company, S.I.My cell phone has a camera in it. That's not a big deal today, but back in 2003 cell phone cameras were a cutting-edge technology and well-meaning security pros (myself included) warned that this would allow attackers to steal all your data, violate your privacy rights, and cause the downfall of our companies. Ah, the good old days, when camera phones were our biggest problem. Many of the predicted hazards of camera phones came true; sensitive information was photographed and privacy was violated. But we also used some basic security controls such as prohibiting phones in certain areas or severely restricting their use to limit the potential damage. These crude but effective controls allowed us to manage the short-term risk until we learned how to control the technology better. Flash forward to 2014. At that time you couldn't find a security professional worth their certification that would have recommended moving your data to the cloud. We were terrified of the prospect of trusting data to what we said was "just someone else's computer." Over time we overcame the fright, studied it, made mistakes, learned some more, made some more mistakes, and kept trying. We finally learned how to secure things in a well-designed and well-managed cloud environment. It didn't happen all at once, a lot went wrong along the way, and although we still haven't mastered it, we're getting much better. It's a cycle we've been repeating since the earliest days of computing (and computing security), and it's a cycle we'll keep repeating for the foreseeable future.So, what are today's challenges that well-meaning security pros are warning about? AI, Machine Learning, IoT, and Blockchain all promise (according to vendors and consultants) untold riches and unlimited market domination for the right companies willing to take the plunge and invest heavily in their development. All of them are also frightening security people to death. Why? Because like camera phones, the cloud, and everything that came in between, we don't quite fully understand them. They represent dramatic change and, frankly, we security people don't handle change very well. Add to that the generally sorry state of security technology, infrastructure, and software and our comfort level decreases even more. Deep down we know that for all the business' good intentions, market promise, and well-funded research and development in these technologies, one thing is inevitable:We're going to get it wrong! Very, very wrong. That's bad for business, and it's bad for our customers.IN MY OPINION
< Page 7 | Page 9 >