Cybersecurity trend forecast: Streamlined, simplified security

Simplicity will be the cornerstone of effective cybersecurity as companies strive to consolidate resources, according to Javvad Malik, security advocate at AlienVault Inc. and an 18-year veteran of the information security, or infosec, industry. For most organizations to adapt to this cybersecurity trend, they must adopt new approaches to how they deploy and think about cybersecurity processes, Malik said.

In part one of this two-part Q&A, Malik spoke with SearchCIO about changes in the cybersecurity landscape and highlighted key cybersecurity trends to watch out for this year. He also shed light on how emerging tech like AI and techniques like DevSecOps are influencing the cybersecurity industry.

Editor's note: The following interview has been edited for clarity and length.

What are some of the big changes that you are seeing in security?

Javvad Malik: From my early days to now, the biggest change I see is that, before, you could get away with making some mistakes and it wouldn't be such a big issue. Now, there is very little margin for error, especially if it's a public-facing issue -- the public awareness is there and social media allows it to become very visual, very quickly.

Javvad Malik

In that regard, it's more challenging to be in security today than what it was like some 15 odd years ago. It also means that everyone has to be really, really good at detecting when something goes wrong and knowing how to respond, not just from a technical perspective, but also from a PR perspective. They must know how to communicate what went wrong and assure the public that you know everything is OK and they are going to rectify it.

What new cybersecurity trend should we watch out for in 2018?

Malik: Cryptocurrency and how that impacts companies is one cybersecurity trend. Also, there is ransomware. They are linked because cryptocurrency has enabled ransomware in a lot of ways.

Rather than buying 50 security products, companies will look at, 'How can we consolidate this so we can get an outcome that meets our security need?'

One other cybersecurity trend we will see is there will be a lot of focus on streamlining and simplifying the security stack. Cloud has forced companies to rethink how they architect a lot of what they do because it's a lot more efficient. We are going to see a lot of that trickle back down into the enterprise. Rather than buying 50 security products, companies will look at, 'How can we consolidate this so we can get an outcome that meets our security need?'

Down the road, you will see companies buying fewer security products and that will do the job of what 50 were doing, before they rearchitected and rethought how they are going to implement security. A lot of it is just about fundamentally rearchitecting how you deploy security and your layers. I think that the trend is going to be under the surface, but something a lot of companies will adopt.

Will AI transform cybersecurity? How should cybersecurity professionals prep for AI?

Malik: To say that AI will transform cybersecurity is a bit of a stretch for now. I think what we will see is like with most new technologies: There is a bit of hype around it and then it becomes commoditized, and after a while, we just see it getting baked into products.

For security professionals it's important to understand the technology, but they should focus on the outcomes. If you can detect a threat accurately, it doesn't matter whether you are using machine learning, or AI, or using a signature-based technology. Your objective is to detect the threat and to stop it. If that is happening, then use whatever tool there is in your arsenal.

There are companies that are adopting DevSecOps. What are the benefits of that?

Malik: Some of the main benefits are rapid deployment and the agility that it brings to the whole process. You can do things very rapidly and if something breaks, you can undo it really quickly. It's all about agility. That is so important in today's day and age … companies can't really have projects held back or delayed because security can't keep up with the pace.

But with any new techniques that companies are deploying, it is wise to start with a small use case first. Don't try to deploy it across the entire company and do everything at once. Start and see how it works, and see how it fits in with the culture, and then adapt it and expand it from there.

Continue to part two of the Q&A, where Malik discusses the looming cybersecurity skills shortage.