Category: Innovation

On June 15th, Gartner released it’s Top 10 Technologies for Information Security in 2016. As a security ‘professional’ with over 15 years front-line experience, it has taken me this long to find out what half of these things are even trying to achieve. My initial impression was that this was just an attempt to corner the market on acronyms.

Now that I’ve had a little more time to look at them, it’s not just about acronyms, it’s about selling things. Things the vast majority of businesses don’t need. Things that if you DID introduce them into your current environment it would be like building a castle on a swamp (hope you got the Monty Python reference);

Utterly useless, expensive, and completely missing the point.

The breakdown:

  1. Cloud Access Security Brokers (CASBs), provide a “…critical control point for the secure and compliant use of cloud services across multiple cloud providers.” – In the real world this is called performing proper due diligence, before you outsource to a cloud provider. The right reporting should be built into the SLAs. Good God, even the PCI DSS makes this a requirement!
    o
  2. Endpoint Detection and Response (EDR), “EDR tools typically record numerous endpoint and network events, and store this information either locally on the endpoint or in a centralized database.” then compare the output to “known indicators of compromise (IOC)“. [Ed. note the 2-for-1 on the acronym front] – Why the Hell would you wait for a ‘known indicator of compromise’ instead of trying to fix the problem pro-actively first?!  Hardening guides, vulnerability management, system baselining, FIM et al are all designed to produce baselines of known-good configs thereby minimising exposure. This is nothing more than a rebranding of basic security tenet in order to sell a technology.
    o
  3. Non-Signature Approaches for Endpoint Prevention, uses “machine learning-based malware prevention using mathematical models as an alternative to signatures for malware identification and blocking.” – Seriously (see 2. above)? Once you have your system at a known-good config, stop anything NOT that. Are you seriously going to spend God-knows how much on a new technology instead of doing what you SHOULD have doing all along …for free(ish)?
    o
  4. User and Entity Behavioral Analytics (EUBA), “…provides user-centric analytics around user behavior, but also around other entities such as endpoints, networks and applications.” – This one just pisses me off, and I can only assume Gartner were paid a ton of money by EUBA vendors to add this to the list. This is the THIRD nod to baselining and I’m only at number 4 on the list.
    o
  5. Microsegmentation and Flow Visibility, which is basically more granular segmentation (think system-to-system instead of the usual network-to-network). – So let’s see; most organisations have horrible segmentation at the network level, so to combat this, buy a technology that puts the ‘firewalls’ on each endpoint and maps your traffic flows at that level. I have an idea, why don’t you just do segmentation properly with the infrastructure you have and THEN decide if you need more. I seriously doubt you will unless you’re an IaaS/PaaS provider.
    o
  6. Security Testing for DevOps (DevSecOps) – In other words; building security and security testing into every step of the development process. This is new? I have to assume this was just padding to avoid a Top 9 scenario.
    o
  7. Intelligence-Driven Security Operations Center Orchestration Solutions, “an intelligence-driven SOC [ISOC] also needs to move beyond traditional defenses, with an adaptive architecture and context-aware components.” – So what you’re saying is; Let me know if something happens that’s not normal? Errr, isn’t that reporting events outside of a KNOWN-GOOD BASELINE!?!
    o
  8. Remote Browser solutions “…remotely present the browser session from a “browser server” (typically Linux based) running on-premises or delivered as a cloud-based service.” – This one kinda makes sense, but haven’t we had jump-servers for decades that could do something very similar?
    o
  9. Deception “technologies are defined by the use of deceits and/or tricks designed to thwart, or throw off, an attacker’s cognitive processes, disrupt an attacker’s automation tools, delay an attacker’s activities or disrupt breach progression.” – Anyone who uses this technology deserves to be hacked. This is perhaps the stupidest concept I have ever seen and I cannot believe it’s on anyone’s list. Gartner should actually be ashamed of themselves.
    o
  10. Pervasive Trust Services, “As enterprise security departments are asked to extend their protection capabilities to operational technology and the Internet of Things, new security models must emerge to provision and manage trust at scale.” – Finally we agree on something; centralised management of end-points based on known-good configs.

As far as I am concerned, 99.9% of organisations can effectively ignore this Top 10 list. You will NEVER find a technology that fixes stupid. Just do security properly and you’ll achieve what every organisation is looking for; appropriate, value-for-money, security.

It’s a shame Gartner can’t monitise a ‘Top 10 Information Security Back to Basics’, that would actually be worth a read.

 

In my continuing crusade against greedy and self-serving biometrics vendors – which is absolutely NOT all of them – I figured I would give them a little taste of their own medicine with a ridiculous assertion in the title.

Of course biometrics isn’t dead [I believe it’s still in its infancy] and of course it will only continue to grow in distribution and influence. Its adoption will sky-rocket as mobile devices take over the world and IoT makes thinking for yourself redundant, and I for one am more than happy for it to spend time more in the sun.

What I cannot / will not accept from biometrics:

  1. Its growth at the expense of ANY other form of authentication (without appropriate justification),
    o
  2. Its false and irresponsible claims to its security, and;
    o
  3. Its blatant disregard for its ultimate benefactor; the mobile phone

Put to one side for a minute that not ONE legislation / regulation in payments actually requires biometrics (where “strong authentication” is primarily defined as 2-factor), and focus for a second on how biometrics has even made it as far as it has. Simply put, without the mobile phone, there would BE no biometrics in the mainstream.

It’s not like we would all carry around a separate device to perform biometric authentication, would we? No, we wouldn’t, so it’s only because biometrics is so readily available that we even consider it an alternative to passwords. That’s right, an ALTERNATIVE, and for the foreseeable future, one completely driven by consumer preference. No financial institution in their right mind will make biometrics mandatory, probably ever. I certainly wouldn’t.

So if the mobile phone is so all-powerful, why aren’t they attacking passwords? Simple, a) they have no need to, they are the dominant factor, and b) they are smart enough to realise that without the OTHER two factors they are not providing the best solutions possible.

In other words, they get it.

Rather a bleak picture, isn’t it? 1) not required for regulatory compliance, 2) will never be mandatory, only a consumer preference, 3) will never be suitable for some forms of authentication due to false ‘positives’, and; 4) it completely reliant on something else for its distribution. But even with all of this against it, I will embrace biometrics, in all its forms, if it provides me the convenience I crave, with ENOUGH security to transfer the risk to someone else (my bank for example).

And that’s really what it all boils down to; risk. A simple word but one completely misunderstood, and usually handled poorly. Bottom line; if the effort to steal something is greater than its value, it’s safe …enough. That’s all biometrics and passwords provide; security enough, and the amount of security you have to provide for a transaction is directly proportional to the value of the transaction.

For example, why would you use Apple Pay when it requires authentication that the contactless card does not? Is it more convenient? No. Does it provide more value-add services? No. Does it have anywhere near the distribution of plastic? No. Do YOU have to care about the security of contactless? No, you don’t.

Biometrics is, and will always be only a player in the game. While mobile holds most of the cards, any form of biometrics will be beholden to it, so they should play nice.

In just the last week, these are two of the articles paraded by the ‘Biometrics For eCommerce’ group on LinkedIn, both of which are taken from PYMNTS.com;

Is Biometrics Putting The Nail In The Password’s Coffin?

Is It Time To Cash In PINs For Biometrics?

My question is; Just how dumb do you have to be to wage a war against your own side? You don’t see The Times and The Sun slagging each other off, or Lexus and Toyota competing for the same demographic, do you? And why not? BECAUSE THEY ARE ON THE SAME DAMN TEAM!

So why is it that biometrics advocates feel the need to pick on passwords / PINs? I can only imagine it’s something like a school bully who only picks fights he thinks he can win, or perhaps they realise that biometrics is nowhere near the panacea they want it to be so they have to compare it against the lowest common denominator.

And let’s face it, that’s exactly what PINs are; the lowest form of password, which is the simplest of the 3 forms of authentication. That’s why it’s so prevalent, and orders of magnitude more accepted and consumer friendly than any form of biometric. But it is also the cause of all of their limitations, which are not inconsiderable.

However, instead of trying to kill the password /PIN, what’s wrong with taking the position of collaborative support? PINs are inadequate for some scenarios, just as biometrics are wholly inappropriate for others. Addressing the factor of authentication outside of the context of risk is no different from asking how long is a piece of string.

What about consumer preference? Is ANY financial institution or bank going to enforce a ‘biometrics-only’ stance? Not unless they are irretrievably stupid.

What about device capability? Are we going to force all 7.3 billion people on the planet to buy the latest smartphones? More than 2/3 of all mobile phones are still not biometrics enabled, do you really see passwords / PINs going away ANY time soon? No, nor do I.

Even for those with smartphones, who’s to say that the something-you-know has to be a passWORD? A picture of your own choosing will suffice. Or special characters in place of numbers perhaps? How many people out there speak Klingon? All you have to do is remember SOMETHING, and the smartphone could not make that easier (especially for those with learning disabilities).

Clearly my blog’s limited reach will have no impact on those too short-sighted or just too plain greedy to adopt a collaborative approach to authentication and identity management, but like almost all FinTech’s disruptive innovators, those going it alone will fail. Biometrics has finally, and rightfully, taken it’s place in the arsenal of weapons used against the bad guys, but for now advocates seem Hell bent on using them against their own friends.

In the end, only multi-factor authentication will win the day. Biometrics will be a big part of that, but the mobile phone (something-you-have) itself will be even bigger, and something-you-know will never go away.

Nor should anyone want it to.

I guess it’s quite prophetic that 2016 is the Chinese Year of the Monkey, though I suspect that the Year of the Headless Chicken will be a little more accurate.

Every year, someone either predicts a ‘Year of x‘, or claims that the previous year was ‘The Year of y‘, and usually it’s the very organisations with a direct vested interest in the technology in question. 2015 was the Year of Biometrics, 2014 was the Year of Encryption, and so on.

Thankfully the financial industry at large took a step back and put these, and many other technologies, into an appropriate perspective. Mostly. Especially biometrics, where numerous vendors were dribbling all over themselves when Apple Pay finally hit the mainstream. We heard cries of “The password is dead!” and “Biometrics is the future of authentication!”, all of which was utter nonsense in light of the Payment Services Directive 2 (PSD2).

Yes, many banks have invested significant sums in biometrics (usually to enhance their mobile banking app security), and no, these investments will not be wasted, but from what I’ve seen most of them have missed the point; that authentication is just a temporary means to an end.

The result is that those Hell bent on disruption will fail without collaboration, those with a single authentication technology will fail without partnerships in a multi-factor solution, and those interested only in keeping things the same will be left behind. The only hope of achieving a balance between all of these things is to ask the only stakeholders who have no idea what they want;

The consumer.

Even after a few years of dramatic changes and innovation in payments, what everyone seems to have missed – or at least underestimated – is that payments (or finance in general) is far too complex for the average consumer to understand. In my opinion it’s been made too complex to even be sustainable, especially when you consider that the concept of a payment is actually very simple; I have a value stored here, and I want to transfer it over there in exchange for a product or service. HOW that happens should not be the consumer’s concern, only the security and efficiency of that transaction should.

I have no problem paying my bank to protect my stored value (i.e. money), as long as it’s reasonable. I have no problem paying someone to protect (and accept liability for) the transfer of that money somewhere else, as long as it’s reasonable. What I DO object to is the numerous intermediaries in the current system who not only make the process expensive, but ridiculously slow and inefficient.

But what I really want is for payments to go away entirely, at least from my perspective as a consumer. I want the HOW of the payment to be handled in the background, and the decision made by a trusted third party who found the best all-round deal for the product/service of my choosing. Whether that’s finding a plumber, or shopping for groceries, the only innovations I care about are ones that take care of the things I hate doing; like filling out online payment forms, or lining up in Sainsbury’s to pay for a pint of milk.

So, in truth, 2016 will likely be the Year of Nothing Much Happened. Truly beneficial change will take a long time, and while the pieces necessary for innovation are already available, getting all of the stakeholders to agree on the way forward will extend way beyond this year, and likely next.

I’m hoping that 2016 will actually be the Year of Getting the Future-State Plan Right, but I somehow doubt it.

 

If I was any good at predicting the future, I would be writing this from my yacht in the Caribbean, and not from my kitchen in Southwest London. That said, I do get to work mostly from home, so maybe I’m doing something right.

While my predictions for 2016 will necessarily be as narrow as my field of expertise, there is a lot going on that will eventually change we the way everyone performs many of their daily functions. Probably not this year, and maybe not within the next 5, but once they DO begin to change, there will be no looking back. This is a good thing, and well past its time.

Prediction 1: Identity Management will begin to replace single-factor authentication – ANY single form of authentication is inadequate, and even multi-factor and multi-mode authentication is of limited use. For the Internet of Things, payments, or any other transaction to take place securely and accurately in the future, identities must be seamlessly and mutually introduced. Authentication only provides the what-of-you (and usually only in one direction), not the who-of-you, the full function of ‘distributed transactions’ (i.e. mobile based) requires both.

Prediction 2:Identity Management will be decentralised onto consumer mobile devices – as a corollary of prediction 1, the control of identities and authentication will decentralise from individual credential stores (user databases) to APIs and/or block chain-esque distributed ledgers that create authentication and identity mechanisms on-the-fly. The level of information provided will be agreed and controlled by the consumer prior to any transaction taking place, and must be mutually assured. i.e. the receiver of the authentication must themselves authenticate, unlike almost all e-commerce today.

Prediction 3: HOW you pay will become increasingly irrelevant – you have a value in the bank you want to spend, you should not have to care HOW you get to that value as long as you are getting the best deal to do so. Third Party ‘Money Management’ Services, APIs, and even regulations like the Payment Services Directive 2 (PSD2) here in the EU are forcing traditional financial institutions to open their books. You’ll open ONE application, regardless of which retail store you’re in, comparison shop against price and ratings, and your app wil choose not only the best price and rewards, but the best WAY to pay, all behind the scenes. Credit / debit / direct debit will mean little to you, nor should it, the only thing that matters is that we will eventually stop paying the price of plastic.

Prediction 4: Value-Add Services and Customer Service will be the only differentiators – with the enormous competition available to the global economy, price and quality will have little impact on the purchase decisions you make, they will be much the same. Brand loyalty (even if this exists in the future) will instead be driven by the services provided around the products you want; from instant coupons, to ratings and reviews, to reward and loyalty choices, to availability and payment terms, these will be made available instantly in a multi-function app (much like, or even the same as, prediction 3) for consumers to make an educated choice of vendor. But the Customer Service provided throughout the entire consumer journey will be the ultimate differentiator, and any vendor not treating their customer like royalty will be out of the game, regardless of everything they may do well.

Incidentally, this is also why mobile payments have yet to reach anything like their true potential, they are no better than the plastic they will replace.

Prediction 5: Loyalty Programs will begin to centralise – I think we can all agree that there are simply too many loyalty and reward programs out there. Every coffee shop, retailer, airline and hotel have their own points scheme, few of which are interchangeable. How many points would you say you have floating around out there that you will likely never use? It just makes sense that the single app provider (per predictions 3 and 4) will begin centralising and normalising any point scheme available. This will be very difficult, but will be their differentiator to which app provider consumers choose.

While these may seem very narrow in focus, perhaps even of little relevance to the ‘masses’, the payments industry alone is a multion-TRILLION £/$/€ industry and the opportunities for innovation and/or investment almost limitless. We already have the device upon which all of these future trends will rely, all we need now are the APIs and Third Party Providers to bring it all together.

Unfortunately we still equate our value with money, and have done for millenia. Money itself is irrelevant, and you work in order to obtain the things you need to survive / be happy, so HOW that transaction is effected should be irrelevant. The above predictions should get us back on track.

Technology and even regulation is pushing simplification down to the consumer, this can only be a good thing.

Done correctly…