Next week, one of the biggest security conferences in the world, RSA, kicks off at the Moscone Convention Center in San Francisco. Each year, tens of thousands of information security (infosec) professionals come together at RSA to share their cyber security research, network with peers and learn about the latest defensive technologies from researchers and security vendors alike. While I personally prefer the deep research and training found at the Black Hat and DEF CON security conferences, if you’re specifically looking to learn more about latest and greatest defensive tech, RSA is a key conference to follow.
If you’ve attended conferences like this before, you probably know that certain top topics or themes tend to emerge as the major focus each year. Whether it’s newly developing threats, like ransomware during 2014, or a technological disruptor that’s changing the industry, like cloud was years ago, certain topics surface organically and end up driving much of the conversation and excitement. So what technology, trends or topics will dominate RSA this year? Let me dust off my crystal ball and share a few educated guesses.
First, let’s start with the conference’s official theme for 2019—Better. Every year, the RSA conference organizers select an official theme after consulting various attendees and stakeholders. “Better,” in part, means the industry needs improved technological tools to protect the world from advanced cyber threats, but the organizers also mean that all of us—from the security professionals to the CEOs—have to do better at protecting ourselves from digital and internet attacks. This might include everything from diligently sharpening our security awareness and education with knowledge about the latest threats, to making sure our managers have the budgets necessary to implement proper security controls.
While there is certainly legitimacy to the notion that the industry as a whole needs to band together and do better, I personally think it makes for kind of a soft, abstract and non-actionable theme. I would rather focus on the top issues or topics I think researchers and the industry at large will discuss during the conference. With that in mind, here are my predictions for the four major topics we’ll see emerge at RSA this year:
The Internet of Things still represents the weakest link and largest target.
This might seem like a no-brainer prediction to some, but nonetheless, I believe the poor security of Internet of Things (IoT) products will remain a major topic of discussion at RSA 2019, and for many years to come. The lack of security in many IoT devices has been a hot topic at every infosec show in recent memory – and for good reason. Countless new IoT devices are making their way into the market, faster than anyone originally predicted. Meanwhile, many security researchers have found that most of these devices are not designed with security in mind, and many are susceptible to the most basic security flaws circa 2000. What does this mean? A significant portion of new IoT products are shipped with default – or worse yet, hardcoded – passwords. They use unencrypted communications and network services, and they suffer basic coding and security vulnerabilities that traditional software manufacturers corrected a decade ago.
And still, the general public continues to buy and use these products regardless of their insecurities, proving to the vendors that they can stay in business despite their awful security practices. This year at RSA, I suspect we’ll see many researchers disclosing new flaws in IoT devices and further examining the problem to offer novel industry-wide solutions.
Machine Learning and Artificial Intelligence will remain top buzzwords.
Both artificial intelligence (AI) and machine learning (ML) have been around for a while, but have really enjoyed exponential growth and improvements over the last few years. Companies have finally started actually productizing this new-ish technology in fresh and tangible ways, and the security industry is no exception. During RSA, expect to see both new and legacy defense products that leverage ML/AI to improve their efficacy, to detect or block new threats, and to help scale and automate certain security tasks. However, attackers won’t remain stagnant. I’d also expect to see new research illustrating how hackers are or will be leveraging ML/AI themselves, to help their threats evade security controls. Like IoT, you can expect ML/AI to be a big theme at RSA and every other major security show this year.
Security automation and orchestration to become more prevalent.
In this technological era of big data and artificial intelligence, combined with the industry’s general lack of time, resources, and expertise, you can see why automation has become such an important IT topic. This holds true for the infosec industry too. Right now, security professionals are expensive and hard to come by. IT infrastructure is widening, spreading out data to cloud resources all over the world, not to mention the presence of a now constantly mobile workforce. Many IT security professionals barely have time to keep up with the latest patches, let alone spend the time to scan their logs for any evidence of an attack. This is why security automation and orchestration is a growing topic of discussion. Most experts don’t believe you can totally replace security teams with an automated solution (yet), but they do want to find ways to quickly take care of the more basic security tasks so that their expensive and valuable security professionals can devote more time and effort to the tougher problems. During next week’s conference, you should expect vendors and speakers to discuss and demonstrate products and techniques that can automate some of the basic tasks security professionals have to deal with every day.
Authentication and identity management will see a renewed focus.
Most security professionals would probably agree that authentication is the cornerstone of security. Your security controls are designed to let some users in, and keep other users out, but if you can’t reliably identify who a user really is, the control becomes worthless. While many strong authentication products, such as multi-factor authentication (MFA), single sign-on (SSO), biometrics and privileged access management (PAM), have existed for a long time, the constant deluge of data breaches and password database leaks has re-illustrated the weakness in many authentication paradigms. As a result, the industry is both re-thinking they way we approach authentication and making efforts to simplify previously complex or expensive authentication technologies for the everyman. Expect to see many experts pushing things like MFA, context-aware authentication, user and entity behavioral analytics, and other evolutions to authentication that improve our ability to accurately validate who someone is, and make it easier and more secure for them to log in.