Lieberman Software and Core Security form strategi... » London, UK: Lieberman Software Corporation has announced a new strategic alliance with (Courion) Cor... Ness Tec helps secure the Torridon Hotel with MOBO... » UK: MOBOTIX AG has released details of a project for the Torridon Hotel that has upgraded its CCTV t... Norbain adds new Suprema and BioConnect biometric ... » Norbain has announced the addition of new BioConnect biometric products to the Norbain product portf... UK2 Group selects Opengear for global Smart Out-... » UK: Opengear has announced a successful project with UK2 Group, a growing hosting provider, to impro... Zinwave to demonstrate public safety DAS at Crit... » Zinwave has announced that it will showcase its UNItivity distributed wireless access solution (DAS)... Outdated systems placing maritime vessels at ris... » Maritime vessels are under significant threat of cyber-attack because many are carrying outdated sof... Blesma gears up for annual fundraising initiativ... » Fundraisers from all over the country are getting ready for Blesma Week – the fundraising initiative... Optex Systems announces $1.12 Million Purchase O... » RICHARDSON, TX: Optex Systems, Inc. has announced it has received a $1.1 million purchase order to s... Wargaming sponsors TANKFEST 2016 » Wargaming is once again partnering with The Tank Museum, Bovington, to sponsor TANKFEST, one of the ... Symetrica presents compact and ultra-light weara... » Berkeley, CA: Symetrica has introduced a prototype wearable detector system that provides high-sensi...


Advertise with Vigilance

Got News?

Got news for Vigilance?

Have you got news/articles for us? We welcome news stories and articles from security experts, intelligence analysts, industry players, security correspondents in the main stream media and our numerous readers across the globe.


Subscribe to Vigilance Weekly

Information Security Header

Reuven Harrison, CTO of Tufin Technologies takes a look into the world of system administration

Historically security products have been developed either in response to, or in anticipation of, major shifts in enterprise computing - or at least that's been my experience. Without a time machine it's impossible to state exactly what the future holds, but it is possible to make an educated guess based on what has happened to date. So allow me, if you will, to share my observations on significant events that occurred this year and how I think they’ll impact the year ahead.

Legislation came of age

Eight years after it was first introduced, the Payment Card Industry Data Security Standard (PCI DSS) has not only caught the attention, but gained the respect, of security professionals.

In contrast to other standards, which require companies meet a certain objective offering little explanation of why or guidance on how to become compliant, PCI DSS is different because it’s prescriptive. Now, nothing is perfect, as there is always room for improvement – and PCI DSS is no exception, but what it does do (really well in my opinion) is ensures all organisations who are subject to the regulation can easily adhere to a set of industry standard best practices. Organisations not only have a very clear understanding of what they need to do, but more importantly why they have to do it.

The legislation itself strikes a good balance between technology, business processes and implementation practices.

It is regularly maintained and updated so it remains current.

From an IT perspective, it even outlines the specific security controls and processes it expects organisations to adopt if they’re to adequately manage and secure credit card data.

Perhaps this is due to the PCI Security Standards Council’s establishment of a thriving ecosystem which gives enterprises and auditors access to solutions and service providers that can be used to implement the standard. Although “compliant” and “secure” are still far from synonymous, PCI DSS has created more common ground between the two than any other external mandate to date.

Organisations are increasingly storing personal and credit card details - whether it be for more direct contact with customers, employee information or government requirements. For that reason I expect, in the coming year, we will see more companies having to comply with PCI DSS in order to make their client data safe.

No longer fantasy but reality

For many years we’ve seen various cyberspace wars played out on the big screen and in sci fi novels. Unfortunately, this year fiction became reality – and in a big way!

Perhaps the most significant incident was Stuxnet – although there have been others. In June, Stuxnet was widely reported to have taken over Iran’s computerised systems, that operated its centrifuges, and having done so destroyed 1,000 used to enrich uranium. In a plot that would have made Ian Fleming proud, this event proved beyond doubt that a cyber-event can actually result in physical damage. The gauntlet could be considered well and truly thrown down as, in October, the U.S. government accused Iran of launching distributed denial-of-service (DDoS) attacks against U.S. financial institutions in retaliation.

For years many have warned that cyberspace is a dimension of vast potential, for both good and bad – and now we know it to be true. Nations and organisations will need to reconsider their security strategies, and increase their investment to both defend themselves and improve their cyber-ammunition. Countries all over the world are dedicating significant government resources to protect their critical infrastructure, and the IT security industry is closely engaged, developing technologies specifically designed for cyber warfare. As unfortunate as the reality of cyber war is, preparing for it will continue to be a wellspring of innovation.

The walls became stronger

With network firewalls unable to differentiate between various forms of modern Internet applications (mostly running over HTTP on port 80), their relevance has been called into question. However, the perimeter still needs to be protected. Thank goodness then that a new technology stepped up to the plate. NGFWs, or Next Generation Firewalls to give them their full title.

The strategic value of NGFWs was highlighted in Gartner's 2012 Firewall Magic Quadrant, with several firewall vendors including Check Point, and Cisco launching their own. NGFWs provide the ability to set access policies based on users and applications, thereby re-establishing the firewall as a fundamental security device. While application-aware firewalls have been around for some time, Palo Alto Networks’ investment in innovation and market education has resulted in widespread adoption of commercial grade NGFWs. By the end of 2012, most large enterprises will have adopted this technology to varying extents, or at least plan to.

There is no doubt that NGFWs have revitalised the firewall industry, and will continue to do so, however many organisations have yet to fully utilise the application awareness component of them, making it hard to foresee their true impact.

I believe that NGFWs could potentially displace the need for other types of solutions, or accelerate the convergence of network security and application management across other fronts. For that reason I think it’s a very exciting time to be in the firewall marketplace with many reasons to ‘watch this space’.

While the future remains unknown, one thing that is certain - network security does not occur in a vacuum. It is inextricably linked to other developments, both in terms of emerging technologies and enterprise computing as a whole, but also in response to the world we all share. Forewarned is forearmed – as they say. The next twelve months will be an exciting journey of discovery