[Techtaffy Newsdesk]

At the RSA Conference 2012, currently being held in San Francisco, Scott Charney, corporate vice president of Microsoft Trustworthy Computing, detailed the road ahead for Trustworthy Computing.

Mr. Charney encouraged industry and governments to develop more effective privacy principles focused on use and accountability, improve end-to-end reliability of cloud services through increased fault modeling and standards efforts, and adopt more holistic security strategies including improved hygiene and greater attention to detection and containment.

Scott Charney (Corporate vice president, Microsoft Trustworthy Computing): We are at another inflection point, with expectations for better security, privacy and reliability growing at an exponential rate. Now is the time for industry and governments to develop and adopt strategies and policies that balance business and societal needs with individuals’ choices.

The Cloud and Big Data

The proliferation of devices and cloud services has resulted in a massive aggregation of global data, also known as big data. While offering many potential societal benefits, this collection of data poses unique challenges. From a security perspective, big data represents a valuable target for attackers. As the cloud and devices become more integrated with society, people also become increasingly dependent on the reliability and availability of data and services to function. Finally, the massive increase in the amount and types of data available for collection, analysis and dissemination has strained traditional rules to protect privacy.

One solution for the privacy challenge is for government, industry, academia and consumer groups to collaborate in updating current privacy principles to address the world of big data. These revised principles should place a greater focus on appropriate uses of data. They should also include an “accountability” principle to help ensure organizations use and protect data in ways consistent with individual and societal expectations. Together, these principles can help reduce the burden on the consumer and shift greater responsibility to the data collector.

The advent of big data has also been challenging for governments. Any transformative technological change that recasts the way people live will engender deeper government engagement. This is because governments’ relationship with the Internet is a complex one.

Mr. Charney said governments globally are simultaneously users of the Internet, protectors of individual users as well as the Internet itself, and exploiters that capitalize on the power of technology for a variety of purposes.

In times of need, governments may use online services to keep citizens informed, and first responders can react more effectively than those not using cloud-based services because they have GPS devices, mapping capabilities, street views, videoconferencing and other cloud-based services. Such benefits only materialize, however, if these systems meet reasonable expectations of overall service reliability.

Recognizing this fact, governments may play an increasingly active role in many aspects of the Internet. Some nations are looking at legislatively mandating the adoption of information risk-management plans for those managing information and computing systems.

The Evolving Threat Landscape

While the quality of code has improved and infection rates have declined, the threat landscape continues to evolve. Opportunistic threats have been supplemented by attacks that are more persistent and, in many cases, far more worrisome.

While some of these attacks have been called ‘Advanced Persistent Threats,’ that term is often a misnomer. Some are advanced, but many are not; attack vectors are often traditional and unsophisticated. What marks these attacks is that the adversary is willing to persist over time and is firmly resolved to penetrate a particular victim.

Companies must improve their basic hygiene approach to counter the opportunistic threats and make even persistent and determined adversaries work harder. This can be accomplished by designing systems not just to prevent attacks and recover from them, but also to detect successful attackers quickly and contain them so that their unauthorized access or disruption is limited. This new paradigm of protect, detect, contain and recover can serve as a practical foundation for managing risk in the age of persistent and determined adversaries.