2012: The End of the World?

It may well be the end of the world as we know it. The computerization of the great pillars of modern life has reached the point where the solid foundations built over hundreds of years could be toppled with a simple mouse click. We have seen attacks emerge against infrastructure classified as critical. There is reason to worry, since this equipment (SCADA) was, for the most part, never designed to withstand the rigours of open networks. There have been real-world demonstrations of APTs hitting private companies that never put mitigation measures in place for this type of threat. The first companies will serve as an example for the others, and companies will gradually implement best practices… and stop making the secret sauce so easy to reach from the office network. This will require a major paradigm shift, both for companies and for security solution vendors. Let's be clear: firewalls don't solve every problem, and they even create a perception problem.

Personally, I belong to the de-perimeterization school of thought, as put forward by the Jericho Forum, where the machine becomes its own perimeter. Many have tried it. It is possible to expose machines directly on the Internet without them getting "pwned"…. But it takes effort and a solid understanding of what you are doing. There is no room for improvisation. As mobility keeps growing, this will become a reality whether we like it or not.

Will this change the current perimeter? Not really. It is still a good idea to put structures in place to filter part of what goes on, without necessarily applying very strict controls. Academia is probably the best example of a network that hosts a large number of unmanaged devices, puts up partitions to protect more sensitive zones, and puts an outer perimeter in place so it doesn't let just anything in (blocking all the background noise of the Internet).

The end of the world? The end of a world, not the end of the world.