John Pescatore

I would really, really like 2009 to be a better year than 2008, even more than my normal hoping that year X be a better year than year X-1.  From a security perspective, there are mainly 3 areas I want to see improve:

• Economics – 2008 was a real financial bummer, even worse than the dot com bust years in 2000/2001. Not just depressing from a “eek, what happened to my 401k” perspective, but because of businesses taking more chances to cut costs. A business that is out of business is less secure than one that stays in business, but the survival instinct often causes a lot of bad decisions to be made – ever seen “Lord of the Flies“?So, here’s to hoping the global economy bottoms out in 2009 – but also wishing that some lessons were learned. 
• Vulnerabilities – the reports of critical Windows vulnerabilities took a sharp uptick towards the end of 2008, as did vulnerability announcements from just about every other infrastructure vendor.  The good news is that successful exploitation of those vulnerabilities did not seem to jump – we have gotten better at patching and using Intrusion Prevention to shield unpatched servers. So, for 2009 I want the software vendors to accelerate the improvement of their software development cycles to get back ahead of the curve.
• Governments – You can argue whether regulations will improve security or not (in general, I’m on the not side) but 2008 proved that the worst of all worlds is cosmetic regulation, which I define as having regulations that don’t get enforced.  In 2009, I’d like to see governments focus on enforcing the existing financial, safety and privacy legislation and regulations, vs. dream up new ones, and  focus on on using their market power to drive security to higher levels, vs. waste money on czars and funding of YACS – Yet Another Cybersecurity Strategy.

Most world class athletes succeed by visualizing future success vs. reliving past failures, so in the spirit of the holiday season let’s all envision Dec 2009 and looking back on an economy that started to recover, software that started to get better and governments that worked. I leave you until the new year with a quote from Alfred North Whitehead, one of authors of Principia Mathematica:

“It must be admitted that there is a degree of instability which is inconsistent with civilization. But, on the whole, the great ages have been unstable ones.”

Happy Holidays and Happy New Year!