Unisys IT security experts predict 2005 will bring more threats

Companies worldwide will meet huge challenges in the coming year as they rely more and more on integrated networks linking them with partners and clients, increase their use of mobile technologies to empower workforces, and face determined efforts by cyber terrorists and cyber criminals to disrupt business and government.

This is the word from Unisys chief security advisor, Sunil Misra, and colleague Patrick O`Kane, chief architect of the Unisys Identity and Access Management Practice.

They predict the following will be the top IT security challenges and developments in 2005:

1. As applications are brought closer to the edge of the Internet, it is only a matter of time before an attack on a specific vendor`s application or database product causes damage that leads the customer to sue the software provider for the consequences of the security breach. Misra says: "It`s likely that in 2005 we`ll see agitation for laws on security breaches involving application software. This will significantly alter the economic balance of power between the application software provider and the buyer."

2. As companies increasingly include external parties - such as business partners, suppliers and customers - in their business networks, the likelihood grows that companies` IT infrastructures and vital business information will be compromised by attacks by partners` or clients` personnel. Misra says companies must evolve their security focus from simple information security to a more programmatic, process-oriented method of securing the infrastructure and authenticating users - from comprehensive policies agreed on with partners, to technology safeguards such as proxy firewalls and to federated identity management.

3. As they become both smarter and increasingly indispensable for business, mobile environments and devices such as 3G networks, cellphones and PDAs are pushing the boundaries of the enterprise IT infrastructure farther than the security infrastructure can currently reach. Protective technologies for Bluetooth and other common mobile environments are nascent and difficult to use, creating openings for "snatch and grab" data theft conducted on the fly. Misra says: "Companies must approach mobile security from a business perspective rather than technology. They need to analyse the potential impact of current and future threats. Then they must make business decisions about the amount of money and resources to put in place to mitigate the risks created by mobile security threats."

4. Cyber attack styles will become virulent. Misra notes: "In 2005, we can expect the first worm or virus with a truly dangerous payload that alters or destroys information at the record level." The resulting problem will not be remediable by simple means, such as restoration from a previously backed up version of data. Enterprises will spend considerable time and money searching for and replacing what has been altered. Misra says: "The worst thing is, these virulent attacks will violate the victim`s operational and business integrity - decreasing trust at a time when it`s never been more essential for e-business."

5. New cyber criminals are emerging. Unlike their predecessors, they often have purely economic motives, do not fear consequences and are willing to launch increasingly destructive attacks. Misra says: "Until now, cyber extortionists have generally only threatened to cause damage - erasing the contents of computers` hard drives or corrupting data pointers, for example - unless they were bought off. Now we`ll see them actually wreak havoc if their threats aren`t complied with, using a range of assaults from targeted denial-of-service attacks to actual record level destruction of information."

6. Complex business imperatives, such as compliance with Sarbanes-Oxley and Basel II, mean the ramifications of security breaches and non-compliance are now economic and personal. "Faced with accountability for compliance, management has begun to realise security is 20% technology and 80% process," says Misra. "Off-the-shelf solutions are no longer adequate." In 2005, enterprise management will increasingly realise the value of - and the need to implement - multi-layer, end-to-end solutions spanning a full range of requirements, from threat and vulnerability analysis to policy development, implementation of multiple technologies and managed security services. They will often find that outsourcing design, implementation and management of those solutions to an expert partner is the most efficient and cost-effective way to achieve optimal risk management and return on investment.

7. Credit reporting agencies will become more involved in managing the consequences of identity theft. Reporting agencies will need to help devise user identity validation methods that prevent identity thieves from using stolen ID information to access information from additional sources. O`Kane says: "If the credit reporting agencies don`t become involved through consumer education and other proactive steps, the government will step in and start to solve the problem for them."

8. Federated identity management enables participating organisations to co-operate in sharing each other`s authentication and authorisation services. Thus it is vitally important for secure information sharing with external partners and suppliers, or among business units in a company. In a Unisys research study conducted in October, 37% of respondents indicated they would implement federation within the next year. That adoption rate for this nascent technology is likely to accelerate further with industry adoption of the latest release of the OASIS Security Assertion Markup Language 2 (SAML 2) standard.

9. Companies will revisit role-based access control (RBAC) for identity and access management. RBAC grants users access privileges to certain applications according to their function, not their personal identity. It can eliminate the complicated changes needed when access rights are linked directly to individual users. Adoption of RBAC was stalled until recently because of the difficulty and cost of defining roles at the enterprise level. "In 2005, newer technologies will enable faster realisation of the benefits of RBAC - especially greater operational efficiency and lower costs," says O`Kane.

10. Virtual directory technology will increasingly become a strategic component of identity integration projects: It provides a way to view and aggregate identity information from multiple systems without physically combining the databases. The recent maturing of virtual directory technologies now enables virtual directory solutions, which are important for integrating both new and legacy systems.