Today’s Predictions for Tomorrow’s Internet – National Cyber Security Awareness Month – Week 3: October 16-20

Overview:

Smart cities, connected devices, digitized records, as well as smart cars and homes have become a new reality. Week 3 will remind citizens that their sensitive, personal information is the fuel that makes smart devices work. While there are tremendous benefits of this technology, it is critical to understand how to use these cutting-edge innovations in safe and secure ways.

Privacy will be a major concern:

The United States government recently repealed internet privacy laws allowing internet providers to share user information with third parties and advertising firms without user consent. The bill, which had not yet gone into effect, would have made it so Internet Service Providers would have to obtain permission to collect and share their data from users (Neidig, 2017). In the future, we will continue to see arguments over the degree of privacy users can expect from internet service providers and other businesses. Users must be aware of the data that they share online by reading privacy statements that are posted on company websites and forms. It is imperative that users understand how their data will be used once it has been surrendered. As a consumer, you cannot assume that your data will not be shared or sold to third parties (USA.gov, 2017).

A Continued Shift to the Cloud:

An increasing number of organizations are moving to the cloud because of the benefits it affords them. In the future, we will continue to see both commercial and government infrastructure migrate to cloud platforms. Spending on public cloud computing is expected to rise from $67B in 2015 to $162B in 2020 (Gantz & Miller, 2016). However, when shifting from traditional infrastructure to a public cloud deployment, companies give up their data to cloud service providers who are then responsible for the confidentiality, integrity, and availability of that data.

The loss of control over the data may make meeting compliance standards difficult. Companies typically need to prove who is allowed to gain access to the systems storing the data, the data that those individuals are allowed access to, and where the data is being stored (Cox, 2010). When moving to the cloud, alternative methods of deployment should be considered. Both hybrid and private cloud deployments allow companies to have greater control of their data by keeping the data local or choosing the data that is to be hosted publically. It is also important that users understand the risks of storing their data in an environment where shared resources mean shared vulnerabilities that put all the information stored in the provider’s cloud at risk.

This CSIAC webinar is intended to provide a vendor-neutral look at how (or if) a cloud solution is right for your mission. Additionally, several design patterns for realizing highly resilient computing environments are presented:

CSIAC has a number of resources on cloud computing, including several technical journal articles, reference documents, CSIAC reports, and webinars. Check out the topic’s resources here: https://www.csiac.org/tag/cloud-computing/

Increased Reliance on Software Defined Networking (SDN):

As companies move to the cloud, network technology will become virtualized. Networks will be controlled using software in junction with traditional hardware. Control logic is separated from the hardware infrastructure of traditional networks to software-based controlling entities. These SDN controller entities will provide more points of security failures across networks while increasing network efficiency. SDN technologies, coupled with an increased reliance on Network Function Virtualization (NFV) technologies, that are aimed to virtualize and replace existing physical infrastructure will create an entirely new ecosystem for cloud technology (Pate, 2013). As the standards and regulations for this new technology arise, an increase in new security vulnerabilities and attack surfaces will also arise. Networks will now inherit vulnerabilities from not only the network devices/logic itself, but also the virtualization technology and software implementation that the services rest upon.

Internet of Things (IoT):

Cars, medical devices, and other products will continue to be produced with network capabilities, increasing attack surface. There is expected to be 20.4 billion IoT devices connected to the internet by 2020 (Gartner, 2017). With an increasing number of devices coming online, attackers have more potential targets than ever before. Part of the problem with these IoT devices is that patches are not regularly rolled out like they are for regular computer systems. Patches for IoT devices are an afterthought, leaving devices vulnerable to attack (Electronic Privacy Information Center, 2017). After purchasing an IoT device, consumers should download any new patches that exist and change the default password if they can. Patching will help remediate known vulnerabilities that exist while changing the default password to a complex password will defend against password guessing and password-cracking software. Corporations should consider segmenting their network, placing IoT devices on their network, to prevent having a single point of failure (U.S. Department of Justice, 2017).

Incorporating security into the design of components used in the Internet of Things (IoT) is essential for securing the cyber-physical infrastructure upon which society depends. This webinar presents the challenges involved in securing IoT components and provides possible solutions by drawing inspiration from the past:

Learn more about IoT: https://www.csiac.org/tag/internet-of-things-iot/