TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

What does 2022 have in store for cybersecurity and cloud security specialists?

60 pointsby BlackPlotover 3 years ago

6 comments

sys_64738over 3 years ago
Ransomware is the biggest nightmare I&#x27;m seeing. Everything connected to a company network is having to be audited for patches and approved OS installs. IT needs to have root access to every system. Any system not approved to be networked will be isolated at the switch to knock off the network and that team&#x27;s other IT systems will be knocked off too.<p>Security just went least privilege for network access where I work.<p>This is especially prevalent to VMs and containers. Anything with an IP address is being audited. Anything.
评论 #29727264 未加载
评论 #29725390 未加载
评论 #29725653 未加载
评论 #29732668 未加载
评论 #29726047 未加载
评论 #29728539 未加载
jabroni_saladover 3 years ago
On my end the growingest vector is audit remediation. Your cyber insurance providers have noticed that you constructed your environments out of swiss cheese and are now mandating actual pentesting and practical demonstrations of your fixes if you want to maintain your policy. Those self service checklists seem to be going away.<p>gotta say, audit remediation is a pretty chill field to be in as well. The recent round of &#x27;hackers dont sleep for the holidays&#x27; articles made me feel glad to get out of the incident response game.
评论 #29725981 未加载
评论 #29728284 未加载
评论 #29728706 未加载
Syonykover 3 years ago
They just so happen to see a lot of challenges that their software is well suited to resolve... no surprises there.<p>My predictions for 2022: An awful lot of work to be had before you go insane.<p>I&#x27;d expect the trends of &quot;massive complexity causing problems solved by more complexity&quot; to continue, because that&#x27;s <i>literally</i> the only thing the hardware and software industry seems capable of doing anymore. Stacks of complexity that then require more complex hardware to run, and the cycle continues. <i>Nobody</i> understands the whole stack anymore, except perhaps the malware authors who freely move up and down the stack to accomplish their goals. Those writing the software and, theoretically, auditing the software don&#x27;t seem capable of finding badness hidden in it - and decades of experience says, &quot;Humans can&#x27;t find suitably stealthy badness hidden in software, intentional or not.&quot; Look at how long some of the really nasty bugs have been floating around (exploited or not, we don&#x27;t know) before someone finally got around to noticing them. I mean, <i>how long</i> was Debian only generating one of 32k SSH keys?<p>I don&#x27;t see a good path forward for &quot;connected, computer based, all the things.&quot; If we were willing to consider dumping, say, 80% of the features of modern computing, we could probably do a pretty good job securing the other 20% (the commonly used ones). But at too many places, payment and promotion is for features, not bugfixes, not security patches. So new features just keep getting released, old stuff gets abandoned, and the cycle of promotion goes on. The incentives are simply wrong to create anything faintly resembling secure software.<p>And I expect a continuing wave of people who&#x27;ve been doing security for 20-30 years just... quietly retiring to a life of not much consumer tech. The joke in my circles is that we&#x27;ll be goat or llama farmers, and I&#x27;m not sure it&#x27;s too far from the truth. I expect a large collection, in decades to come, of &quot;You clearly enjoy this farming thing, I don&#x27;t think you care a bit about making money, and why is the most advanced bit of technology on this place a couple Arduinos?&quot; You&#x27;ll find them run by former low level security types.<p>I don&#x27;t know how much runway is left in the current trends of tech, consumer and enterprise, but we&#x27;re clearly at a point where <i>nobody</i> can reason about the stuff anymore, and even if you&#x27;re using all the patches, all the best practices... you can still have your whole company shut down by ransomware and such. It&#x27;s less likely, but still far from impossible, when we see things like former NSA 0days used to deploy ransomware. Pretty hard to defend against 0days.<p>Were I to do a business these days, I&#x27;d probably take a serious look at doing things like &quot;Training employees on Qubes&quot; (and buying hardware that can run it). You may not be able to make things impossible for an attacker, but you can sure make them want to go somewhere else for easier pickings (if they&#x27;re not targeting you, specifically - if they are, you&#x27;re probably screwed). The whole &quot;Giant Windows Domain&quot; thing repeatedly proves impossible to secure in practice.<p>Or maybe just go back to typewriters and a good secretary or two.
评论 #29731979 未加载
评论 #29728889 未加载
评论 #29729087 未加载
1cvmaskover 3 years ago
The importance of the pervasive use of stronger multi-factor authentication and a good patching policy to mitigate against the vast majority of current and emerging risks.
throwoutwayover 3 years ago
This just seems like a rehash of old themes and a bit of blogspam. Is there an original idea in here?
deletriusotisover 3 years ago
2022 seems to be really intense and interesting