I am officially declaring 2017 the year of threat.
Following years of rhetoric about state-based attacks and who is at fault for what major system compromise the public seems to finally have come to grips with a few indisputable notes us security pros have been screaming at the tops of our lungs for a couple decades.
There is (at least) a threat out there targeting every principal.
The bad things threat actors cause mean more to the average person than the increasing the frequency of plastic rotation in a wallet.
Things are obviously getting worse.
The public hasn’t grokked this one yet but:
4. Things are trending to get very much worse before they can get better.
It’s worth noting however there seems to be plenty of evidence materializing to back up the stupendous industry reports claiming an exploding threatscape.
How has the security community collectively responded to the challenge that is threat?
Following well worn paths in meatspace, the security community (and no thanks to overtures from our politicians when they unilaterally try to “do something” about security without community feedback [Wassenaar]) has apparently given up on a common
shared defensive posture of the digital realm. I see continued talk in public about information sharing, but despite this the threat intelligence business has balkanized into a federated network of secret databases on who is doing what to whom and who has what from which places and who has what capabilities to do what to whom.
I haven’t named names here … but if you’re looking for threat intelligence to help you defend your network man do I have a bridge to sell you.
Active Threat Product Hunting
I audited every booth (well over 100) on the main floor (and I have as a consequence another email account you may have trouble reaching me at).
I had lengthy conversations with over half of the vendors.
What did I learn?
Apparently most of that fresh security VC money  was dumped on shops who heroically think this thing called cybersec is going to be solved with saber wielding cyber warriors kitted out with tripwires and sensors and heads up displays (okay, the hololens thing at least had a cool factor) hunting threats stalking helpless press on enterprise networks. This despite the fact the enterprise network is quickly evaporating as endpoints get dumber and applications move onto third party networks.
It’s true that if you dump enough money on it more intelligence allows cybersec and infosec pros to make prescient minority-report style observations and maybe your firewalls can think for you too.
However if there is one truism I garnered it was that the solution landscape is just as technically difficult to navigate as the threat landscape and that the “machine intelligence” solutions all require superhuman intelligence to deploy.
I guess that means hire more infosec gurus? Oh yeah … there aren’t any more. 
So, you’ve got yourself a mythical infosec pro.
Despite 25% of infosec positions remaining unfilled and the labor market being overpriced and big game hunters have given up poaching to capture cyber warriors in the wild …. you captured yourself a unicorn or five (or maybe 10? lots of this threat hunting stuff looks like it takes work).
Do your security pros have the juice to actually force stakeholders to react at the speed of real time threats?
Does your organization have a rational resource allocation based on quantified or qualified risks?
Of course my observation has been that only small organizations are nimble. In large organizations being big just means falling harder (not being more rational).
In an industry that’s supposed to be based on methodical evaluation of security economics how did we end up with market solutions so out of balance with what can solve for outcomes?
Shouts out to evident.io with their risk based view of organizational cyber vulnerabilities, and I grok what both Upguard and Threatstack are building. There are others, I’m not the only one who gets it; but there’s not enough of us.
Threat firms out of touch with threatscape implications.
I believe their intelligence and tooling is impressive, but the economics of the situation are that we should be spending where we can be most effective first. Very few firms seem focused on delivering feedback to management which can inform the risk management process so it can fill strategic holes.
Most organizations need more strategy and an effective balanced deployment of contemporary security controls (which together can eliminate most risk).
Why do I see threat firms selling the idea of literally enabling counter-attack against cyber threat (and the US congress is making this legal) when they should be helping organizational stakeholders improve ready-state posturing?
So what should we do about cyber?
(Yes, this seems to be the mainstream parlance. No pointing in making a stand here.)
Yes I know strategic posturing is mostly the remit of consulting engagements and CISO planning and big thick paper reports that sit around collecting exactly a year of dust.
I’m focusing on helping businesses improve outcomes and this might just mean augmented reality, machine learning and cyber-acrobatics don’t take a front seat.
 "Significant Cyber Incidents", Csis.org, 2017. [Online]. Available: https://www.csis.org/programs/cybersecurity-and-warfare/technology-policy-program/other-projects-cybersecurity. [Accessed: 14- Dec- 2017].  "the list of publicly reported groups tracked in ATT&CK", Attack.mitre.org, 2017. [Online]. Available: https://attack.mitre.org/wiki/Groups. [Accessed: 14- Dec- 2017].  M. Chapman, "VC Firms Back Record Number of Cybersecurity Startups in 2016", Bloomberg.com, 2017. [Online]. Available: https://www.bloomberg.com/news/articles/2017-02-08/vc-firms-back-record-number-of-cybersecurity-startups-in-2016. [Accessed: 14- Dec- 2017].  "Cybersecurity Unemployment Rate, Jobs and Statistics", Cybersecurity Ventures, 2017. [Online]. Available: https://cybersecurityventures.com/cybersecurity-unemployment-rate/. [Accessed: 13- Dec- 2017].  J. Wolff, "Oh Good, the Worst Idea in Cybersecurity Is Back Again", Slate Magazine, 2017. [Online]. Available: http://www.slate.com/articles/technology/future_tense/2017/10/hacking_back_the_worst_idea_in_cybersecurity_rises_again.html. [Accessed: 14- Dec- 2017].