PCI Compliant Site Gets Hacked! PCI Is a Failure
I've seen several security practitioners point toward FISMA and PCI, and the fact that PCI compliant sites still periodically get hacked—as if that somehow proves something? PCI is a laundry list of security design features that could reasonably be retitled "The credit card industry's list of computer security stuff you should have been doing all along." It's not some magic elixir that, when drunk, is going to protect your networks. Security practitioners have been saying for decades, "It's just hard work and attention to detail." PCI covers only a few useful details.

That said, look an onslaught of the PCI clones. Failure is an orphan but success has many proud parents. PCI has, so far, been the single most important thing to hit information security; there will be a lot more private-labeled standards in the works.

Blip - SCADA - Blip
SCADA (Software Control and Data Acquisition) systems remain a blip that appears on security practitioners' radar screens. One second, it's there, the next, it's not. Yet anyone who's looked at production process/control networks usually comes away shaken and sweating with terror. Yes, we're (still!) hard at work securing our Internet-facing networks but, maybe, if we just throw a firewall between our production networks and our mission critical networks—it'll all be OK. Won't it?

Spyware/malware makes transitive trust a severe problem for "isolated" networks. If your "isolated" network is not 100 percent disconnected from other networks, it's not "isolated."

So, that's the list. Does any of it look familiar to you? A lot of it should—these are problems that we security practitioners have been dancing around for decades. What's going to be hot in the next couple of years?

Here's my top picks, and what they mean.

The Hot and Not List

Virtualization
Hot: Virtualization is going to change the landscape of... Not much, really.

Instead of regular insecure servers, now we'll have virtual arrays of insecure servers. Virtualization will, however, allow us to realize how much progress we still need to make in automating system administration, and how many organizations are woefully deficient at change control and revision management. Eventually, someone will realize that good system administration equals good server security; can we hope that virtualization is what will push that breakthrough?

Vulnerability Disclosure
Not hot: I was shocked to see that vulnerability disclosure remains a hot topic for some. It must be that people are still cashing in on finding flaws in commercial software. Or, are they doing us all a really big favor out of the kindness of their hearts? I forget which it is, this year.