Jeff Williams, Contrast CTO: Security Predictions for 2018

Security Predictions for 2018

The world of software is changing quickly at all of our clients. As we look across tens of thousands of applications and a wealth of vulnerability and attack data, some clear trends emerge. We continue to believe that organizations that move to DevSecOps will thrive against their competition.  Here are some of our thoughts on the changing application security landscape for 2018:

1. Attacks after a vulnerability disclosure will happen faster than ever.

While attacks once took weeks or months to emerge after a vulnerability disclosure, today it’s been reduced to about a day. That “safe window” will get even smaller, giving organizations only a few hours to respond. The Equifax breach is just an early example of this trend.  Organizations should ensure that they have established the infrastructure necessary to respond within hours.

2. Federal breach legislation will be enacted, forcing companies to
    disclose breaches quickly.

Consumers and thus Congress are super sensitive to timely disclosure. The outrage over recent delayed breach announcements at Uber and at Stanford GSB will drive new regulation. Unfortunately, breach disclosure has never been a strong motivation for companies to invest in better security.

3. Election security will continue to be discussed, with no
    significant action.

Despite strong evidence that U.S. elections were tampered with, widespread recognition that our voting infrastructure is not well-secured, and multiple ongoing investigations, it is an extremely complex and political problem that will take years to address.

4. Attempts to undermine encryption by law enforcement will fail.

Agencies like the FBI will continue to lobby for weakening encryption to allow phones and other devices to be searched. However, companies will continue to resist these efforts in order to protect the privacy of their customers and their own confidentiality.

5. Organizations aggressively embrace cloud and DevSecOps.

Leading enterprises have already realized that cloud and devops are not a threat to security, but the best way to reduce risk. Since the threat is now continuous, companies will need continuous security to go along with continuous integration and continuous delivery. Organizations will prioritize instrumenting their entire stack and applications with best of breed security tools for real time visibility, protection, and control.

6. Security budgets will increase focus on application security.

Major breaches like Equifax and Uber have shone a light on organizations that are not doing nearly enough to secure their software supply chain. Today, every organization has an Equifax problem and it has created room for even more budget towards improving all aspects of application security.