2002 predictions from expert Stephen Mencik |
 |
By Stephen Mencik
14 Dec 2001 | SearchSecurity |
|
|
We asked security experts to give us their industry predictions for the New Year. Here's what Stephen Mencik had to say.
I've never had a very good crystal ball, but I'll give you my thoughts.
2002 will (again) be billed as the year for public key infrastructure (PKI). Again, PKI will not be widely implemented.
There will be greater emphasis on using biometrics for identification and
authentication. While this is a good thing and will likely have success in the long
run, I don't think the user community at large is ready yet for wide-scale biometric
implementations.
There will continue to be many virus and worm attacks, and many people
and companies will be affected due to continued poor operating practices (not
stopping certain types of e-mail attachments, not updating antivirus signatures, etc.).
Web site defacements and other Web server attacks will continue. Many
people still do not keep up with security patches and other advisories. Even those that do
can still get hit. Remember that the attacker's job is easier than the defender. The
attacker only needs to find one hole, the defender needs to find (and fix) them all.
National Security Telecommunications and Information Systems
Security Policy No. 11, the
National
Information Assurance Acquisition Policy, requires that after July 1,
2002, the acquisition of all
Commercial Off-the-Shelf Information Assurance (IA) and
IA-enabled IT products
be limited to those evaluated in accordance with either the Common
Criteria, National Information Assurance
Partnership Evaluation
Program or the Federal Information Processing
Standards'
validation program.
Despite this policy, many waivers will be granted allowing
non-evaluated products to be acquired, rendering this policy moot, much as the policy for "C2 by
'92" became a non-issue.
Stephen Mencik
Stephen is a Senior Infosec Engineer for ACS Defense, Inc. He has worked in computer and network security since 1981, and was a charter member of the DoD Computer Security Center. Stephen answers your network and infrastructure security questions via searchSecurity's Ask the Expert feature.
Do you agree or disagree with Stephen's predictions? Share your thoughts in our anonymous discussion forum.
|
|
|
|
