The Top 3 Security Trends from RSA 2015

“This year there is some optimism that we may be able to gain real traction against the attackers.”

This year’s RSA security conference in San Francisco had a somewhat paradoxical feel. While on the one hand it felt somber and somewhat defeated, there were also sparks of optimism and some sense of a light at the end of the tunnel.

While many have perceived this reality for years, the fundamental inability of companies to secure their systems against determined attackers finally has finally sunk in. Researchers keep discovering vulnerabilities with no sign of any slowdown on the horizon. Considering the pace of evolution, we are unlikely to see any great improvement in the users of the systems any time soon either.

Last year seemed to be the year of detection and response. There was an incredible amount of attention paid to finding intrusions and recovering from the attacks. In contrast, this year there is some optimism that we may be able to gain real traction against the attackers. For instance, I saw three positive trends in the talks I heard, and from the people we spoke to at the Passages booth.

1. Outsourcing security to the cloud

Very few companies have the in-house expertise to run an effective security program. In most small and medium businesses, the admins typically double as the “security guys.” As such, operational requirements often trump proactive security measures — leaving the organization vulnerable. However, cloud providers often have the large security teams and comprehensive practices in place. When the internal security is weak, and the cloud provider is strong, moving to the cloud can significantly improve overall information security.

2. Damage minimization

Losing one user password is unfortunate, but losing a million passwords is a disaster. Performance and simplicity have dictated that all information should be live and available all the time for any kind of request. People are starting to realize that they can re-architect their systems to naturally reduce the damage from a breach. Unnecessary data can be purged or moved to less connected databases. We can also place limits on the rate of queries to reduce breach size. Companies can even avoid holding whole classes of sensitive information, as we have seen with things like Apple Pay where the merchant never sees the credit card data.

3. Self healing or automatically recovering systems

Bringing compromised systems back online has been a laborious process. Only systems known to have been compromised would be restored because of the significant added labor costs for each additional device. Automating the recovery and restoration process makes it possible to quickly remediate a swath of systems that just might have been impacted by some event. The ideal endpoint is to reduce the time and effort required to bring systems back online, to the point where they can be restored very frequently even if a breach has not been detected. This kind of automated restoration creates self healing systems even against undetectable attacks.