How can you prepare for infrastructure security threats in the next decade?

Risk Assessment: Conduct a comprehensive risk assessment to identify current vulnerabilities, threat vectors, and potential impact of security breaches on your infrastructure. Technology Audit: Review existing technology and infrastructure to evaluate their resilience against modern threats. This includes assessing the security of hardware, software, networks, and data storage. Compliance and Standards Review: Ensure your current security measures comply with relevant industry standards and regulations, which are likely to evolve over the next decade.

Assessing your current state is a monumental task, even for small businesses who don't have the people or focus on security. The NIST frameworks, ISO's and Essential 8 are fantastic resources but we must recognise the implementation of these is where it falls over. Have you actually read a NIST SP 800-***? That's where I believe the Essential 8 from ACSC has it's worth, they're maturity levels, written in plain English, that everyone in the business can understand. Doing a risk assessment is difficult because where do you stop? My experience in the world of military aviation taught me to understand levels of risk and how to recognise what acceptable risk looks like. Start with the basics - conversations in the office about security.

Predictive Threat Intelligence: Implement tools and processes to gather and analyze threat intelligence proactively. This helps in predicting potential attack vectors and preparing defenses accordingly. Regular Security Audits and Penetration Testing: Conduct frequent security audits and penetration tests to identify and fix vulnerabilities before they are exploited by attackers. Invest in Emerging Technologies: Stay abreast of and invest in emerging security technologies such as artificial intelligence, machine learning, and blockchain that can provide advanced protection mechanisms.

Preventative medicine is better than a cure right! A cyber attack can destroy even a large business. There are so many tools out there on the market to detect, deter or respond to attacks, with security monitoring software or 24/7 SOC teams. Back-ups, patching schedules and secure admin credentials are your best friend here. Cauterize the wound, roll-back to last back-up, roll-over passwords and get back to business. Being proactive doesn't need to be implementing honeypots or SIEM dashboards, it can be as simple as having a well rehearsed fire-drill.

Moving with the times is important, but not at the cost of tried and tested security patterns. Jumping into every new buzzword is likely to lead to more dead ends than new horizons. ⚠️ Blockchain has been championed for a decade, but is yet to find a viable problem where EDL is the optimal solution. ⚠️ Zero-trust is little more than a rebrand of Saltzer & Schroeder's design principle of 'complete mediation' from the 70s. Segmentation is similarly a design idea that hasn't reached widespread adoption after decades. ⚠️ Edge computing is another spoke on the thin/thick client merry-go-round as processing then connectivity make leaps. Both are valid models depending on priorities. Stick to what you know, and be open to learning.

Artificial Intelligence and Machine Learning: Leverage AI and ML for predictive analytics, anomaly detection, and automated threat response. These technologies can significantly enhance the ability to identify and respond to security incidents. Blockchain for Enhanced Security: Explore blockchain technology for secure, tamper-proof systems, especially in areas like identity management and transaction security. Internet of Things (IoT) Security: As IoT devices proliferate, ensure robust security protocols are in place. This includes secure device authentication and encrypted communications.

Avoid the "shiny tech" syndrome. Focus on the key trends that are having a game-changing impact on cybersecurity. Things like GenAI, Quantum Computing, Serverless are going to change infrastructure security in a major way in the coming 3 to 5 years ( forget the decade ! ) Most companies serious about AI will adopt cloud platforms given the amount of processing power and storage that is required so managed services will slowly replace infrastructure security. An understanding of the shared responsibility model is crucial for companies to understand infrastructure security and how it changes in the cloud

I scoff at the phrase "new and emerging technologies", it's a sales pitch and don't fall for it. AI and ML? most people have no idea what it actually is, which is why I did a thesis in ML. I wanted to understand it and be able to sniff out the garbage marketing. Same with Quantum [insert old technology name here] paraphernalia. Don't get me wrong, new technologies are wonderful and exciting, and can solve real problems. My issue is that even robust security postures can be achieved with today's technology and we don't need a blockchain burger, a side of Quantum chips, with AI&ML sauce. Security a people problem, not necessarily a technology problem.

Regular Cybersecurity Training: Conduct regular training sessions to keep staff updated on the latest cybersecurity threats and best practices. This should include all employees, not just the IT staff. Simulated Cyber Attack Exercises: Organize simulated cyber attack scenarios, like phishing simulations or breach drills, to help staff understand how to respond in real situations. Awareness Programs: Implement ongoing awareness programs about common security risks such as phishing, social engineering, and safe internet practices.

Train your staff, yes. But for goodness sake, can we not have yearly / mandatory online training exercises that NOBODY learns. Culture is the key here. Most people, myself included, are inquisitive people and won't shy away from discovering or learning something new. I despise studying (training) but enjoy discovery and learning. What's the difference? Culture and environment. Enforcing mandatory training, whilst necessary and we will begrudgingly click through it, creating a learning culture in the office will empower staff to discover what they are interested in and have an environment where they can share that across the company.

Set Clear Security Objectives: Define specific, measurable cybersecurity goals that align with your organization's overall strategic objectives. Risk Management Alignment: Ensure that your cybersecurity goals are in sync with your organization’s risk appetite and risk management strategies. Compliance and Regulatory Goals: Incorporate compliance with relevant cybersecurity regulations and standards into your objectives. Technology Adoption Goals: Align goals with the adoption and integration of new security technologies and practices.

Do you lock your house when you go on holiday, lock your car when parked at the shop, or have a pin-code to unlock your phone? We don't even think about these tasks, they're Business-As-Usual security practices that are part of our lives. Security in business should be in the same domain, inherent in what each employee, manager, partner or C-level does without hesitation. Depending on your industry, there may be a myriad of laws and regulations to adhere to, and it can be difficult to introduce and build adherence to security principles when staff are bogged down with current laws. This is why it is imperative to have security as a habit, not a task.

While the article provides practical approaches to safeguarding infrastructure from security threats, it may adopt a somewhat weak stance considering the evolving cybersecurity landscape expected in the next decade. Businesses should pivot towards developing robust cyber resilience strategies, especially for their infrastructure. The escalating role of AI predicts increasingly sophisticated security attacks that pose greater challenges to defense. Companies may soon be evaluated based on their continuous and adaptive response to cyber threats. The measure of a company's effectiveness will hinge on its capacity to foresee, endure, recover from, and adapt to cyber threats.