Security predictions for 2008

At the beginning of each year I like to talk about what did or didn’t happen during the past year, and what to expect in the coming year. Unlike past years, I’ll try not to get too emotionally ramped up on all the failures.

[ Roger Grimes's column is now a blog! Get the latest IT security news from the Security Adviser blog. ]

First, the good news

Overall, compliance laws (and years of bad press) finally forced most organizations to encrypt more data and laptops by default. Chances are these days that if a thief steals a laptop it will be password protected and its data encrypted. More developers are utilizing SDL (secure design lifecycle) in their programming, taking into account from the beginning the malicious risks posed to and by their applications. Overall, exploits aren’t down significantly, but they are in the software where SDL is used. In addition, more organizations are using stronger password policies and two-factor authentication. All of these trends are good.

Now, the bad news

Sadly, the overall computer security picture hasn’t changed much. The Internet is still a very dangerous place to compute. Malware, adware, and spam still make up a very large portion of Internet traffic. Professional criminals control millions of computers turning our futuristic superhighway into the wild, wild, west. Personally, nearly every PC I investigate is filled with worms, spyware, and adware. Antivirus software continues to be embarrassingly inaccurate against the newly created malware churned out each day. Distributed Denial of Service attacks still go on unabated and are very hard to defend against.

We still aren’t catching many criminals. Sure, there are headlines about a few people here and there getting arrested, but apparently those being caught aren't making a dent in the real problem. It’s like the war on drugs in the United States: We’ve spent billions of dollars over three decades and drugs are still just as plentiful as when we began the war. In both cases we don’t seem to change course even though the current strategy isn’t working.

There were no promising wide-scope, technological advances in the computer security arena to give me hope that next year will be any better. There are no leaders or groups with significant power stepping up to lead us into a more secure future. The malware writers and criminals are all smiling into the new year and sleeping well.

The future

Predicting the future of malware is actually pretty easy. All you have to do is look at the increasing trends and figure out what technologies and platforms will be hot in the next year or so. Hackers hack what is hot.

If Apple computers gain market share as I’m sure they will do in 2008, then you can expect more Mac malware. Mac malware is showing up in greater numbers, and Apple already has its hands full patching and re-patching the Mac OS, Quicktime, and other related software. Apple patched more than 200 vulnerabilities in 2007. If history is a good judge of future behavior, then Apple will suffer through a few widespread exploits in 2008.