Augmented Security

The following are notes I have taken from the book launch of "Augmented - Living Life in the Fast Lane", by Brett King on the 8th June 2016 in Singapore. I have taken efforts to make sure that the information here is as close to what he had said during the launch as possible. If there are any misrepresentation of facts, they are probably mine.  Please accept my apologies in advance.

========

Fundamentally Moore's Law has been proven right since it was coined - that computer processing power will double every two years. What we have in our pocket mobile phone is many times the processing power of the early computers that occupied an entire basement of a large building.

Four points that the book is based on:

1. Artificial Intelligence (AI) - that it will take over many aspects of our life. It executes many tasks better than humans. For instance, automatically driven cars are safer. It has a lower accident rate than cars driven by humans; AI diagnoses cancer with a 90% certainty, whereelse a  human oncologist can achieve only a 50% certainty. This is because AI is fed a lot more information to execute the tasks than a human being can handle. Besides, AI remembers the data and a human-being may forget some data during his analysis or diagnosis.

2. Internet Of Things (IOT) - Everything will be connected via the internet by the year 2030. There will be more robots than humans by then, though the former comes in different forms. That is, not all robots will look like humans, nor should they be. It depends on the tasks the specialise in.

3. HealthTech and Genome - The progress of HealthTech and Genome, thanks to the computer processing power will result in more early detection of diseases and fixing the problem via genetic engineering. This may cause a upheaval with Big Pharmacies, who now face a challenger that can fix health problems better and faster.

4. Smart Infrastructure - Solar power will be half the price of the nearest cheapest fuel by the year 2030. Coal mines will not be economical. Eg. Recently, China has laid off 1.5m mine workers. They know that it will not be economically feasible to mine coal.

The cheapness of solar energy and other alternative free energies, will disrupt the commodity markets and decimate it.

-----

Every leading company will be a technology company by 2030. If you are not, than you are not making profits. Profitability in large technology companies like Apple, has a profit per employee of around $0.5m, compared to $30k for walmart or $50k for banks.

The service industry will be disrupted dramatically in employment patterns. People will not live their life "working for a living". Governments may be compelled to give a universal basic income (covering lodging, food, electricity...) to everyone for free. Humans will adjust to this new state.  There will be new jobs like geo-engineering, that aims at reversing the climate change, while many traditional jobs or jobs that are here now, will be gone. Perhaps some of us will be re-invented as robot psychiatrists to counsel misunderstood and mishandled robots!

Global population growth will flatten by the year 2050 at around 9.5 billion people. People will be living longer and longevity itself will be a challenge. For instance, if we are all going to live till 200 years old, then all of us here in this hall are mere 'teenagers' within our lifespan. Major culture shifts will be needed.

If you do not have a digital persona, you may be treated with suspicion, pay a lot more for things,...etc. It will  be impractical. In ten years time, 60% of our online purchases will be handled by an AI agent.

Banking will be required in the future, but not banks. Banks that base their business on the conventional business streams of credit cards, POS,... etc will be gone. There will be contextual credits evaluated when you walk into a store that will handle your transaction.

Not all entities that hold a bank account will be humans. For instance, autonomous driving cars will have bank accounts to get on with their 'life', like to pay for their Electronic Road Pricing (ERP) fees, electricity top ups, for receiving payments for ferrying people around like an Uber cab,...etc.

AI, robotics...etc will become so much part of the system that we will not even think about it, like electricity - we just switch it on and use it and hardly (if at all) think of it as 'technology'.

Governments will be the last industry to be disrupted and replaced by technology.

---------

Do you agree with Brett King's projection of the future?

But let's just say we take it just as an exercise for now. That should the projections come true, how will we protect our information?

Some of the security issues that I predicted 15 years ago are now a reality.

• For instance, wearable computers are now easily available and affordable by the man-in-the-street, so it won't be practical to check them at the gates. 
• About collaborating for collective intelligence among big companies, especially banks. This is now happening via cloud-based Web Application Firewall providers.

Pervasive Security

With IOT, the hacker playground has enlarged. Whoever hacks in will have connectivity to hack the next adjoining device, affecting another community which will be likely dispersed worldwide. Surely this sounds much more fun to the hacker than it is now.

With device getting very small and many of them embedded, it will be impossible to rely on perimeter security. Security controls will have to be pervasive. Already in the present day, every business process will trigger six or seven other security processes. 

For instance, just to transfer money in an ebank, the following non-business processes are triggered:

1. Identification - the user is a bot or human.
2. Authentication - if the user is the user he claims to be.
3. Double authentication - to make sure that the user device is not hijacked. This possibly using technologies like cognitive biometrics. 
4. Authorisation  - to check the extent of the privileges the user is entitled to access.
5. Central data logging - to log all transaction data such that if need be the transactions can be easily reconstructed.
6. Prediction - with the large amount of data logged, it becomes possible to predict if the transaction is a fraud. If suspected, then transaction logging will be stepped up.
7. Notification - notifying the user by an alternative channel of his transaction. 

Many more processes will be added over time to make the transaction even more secure. And even item 1, will have to be re-assessed when non-human entities legitimately have bank accounts, eg. autonomous cars. 

How will we be able to safely identify one robot from another? Do they have unique characteristics and behaviour, like humans, beyond their (encrypted) id tag? Will accumulated machine learning in the robot develop habits and character in them?

Data Ownership

Also, in an IOT world, who owns the data? When there is a hack, who is the custodian that has not kept the data well and had resulted in some people (or robots) violated? With so much data generated, it will be impossible to manage data ownership. To compound the problem, some legitimate data owners may not want to own the data, as ownership comes with responsibilities.

Quantum Computing
When Quantum Computers come into the market, many computers will be hacked in the interim period, before information systems had time to convert to quantum cryptography to protect their systems.

What are your thoughts?

I am sure you can come up with many other scenarios from now to the next ten years and how we can pre-empt security breaches.

----

Brett's view of the future seems to be solely based on the advance of Moore's Law. That computers will get more powerful and progress is mostly enabled by more number crunching and processing. 

There are other visionaries that embraces, in my opinion,  a wider scope of how progress may come about, like Buckminster Fuller, Alvin Toffler and Peter Schwaltz. They dwell into the future with scientific fundamentals and a scope beyond computers. Not surprisingly, many of their projections have even come true.

Here are other technologies that we may see in the future:

• Personal Rapid Transit
• The Straggling Bus
• Zepplins
• Environment and Demographics
• Life Extension
• Transhumanism

Information Security Across New Frontiers

New technology and business motivations

Consumer devices are getting smaller, faster and cheaper. With that, they have become mobile and convenient to execute online purchases, payments, administration and a host of other chores swiftly, many of which were not possible just a few years ago. Such consumer conveniences also generate massive amounts of data. Not just transaction data, but also other personal data, like location, user behaviour, and user relationships with other entities. These information are valuable for businesses to profile, target their potential customers and cross-sell products.

What is Valuable?

Data means different things to different people. One man's information is another man's bland data. For instance, company staff directories are treasure coves to executive headhunters, but are merely data to the layperson. In other words, data is 'King', but data in context is information - a 'bigger King'. Further, in the online world of rapidly flashing ether, data in context in immaculate timing is 'King of Kings'. For example, time-sensitive market data exploited for high frequency trading in the financial markets, is a 'King of Kings'. They make millions of dollars literally within seconds. Here, we are referring to immaculately precise and timely operations happening in orders of nano-seconds.

Who are the CyberThieves?

And there are those who lurks in the dark side of Cyberspace, waiting to deceive, steal and disrupt. While the bulk of hackers are 'script kiddies', the ones that we should be worried about are the determined, clever and focused, who vies for  monetary, non-monetary, business, political or social objectives.  It may also be worthy to note that the bulk of security breaches still comes from within organisations. Inside, it is easier to hack. Being in the system, it is easier to know the loopholes and how to clean the tracks once the intrusion is complete. A survey of 100 banks across 30 countries by Kaspersky estimated that internal hackers may have stolen up to a $1 billion in the year 2013.

Future devices now

New consumer devices easily available in the retail market are getting smaller and harder to detect. Wearable computers are gradually creeping into our daily life, in the form of spectacles (eg. Google Glass), wrist watches or wrist bands (eg. Apple Watch), spy pens,...etc. It will not be practical to restrict employees and workers from using such wearable computers.

New control doctrines

As such, information security controls will no longer be perimeter defence, but checks and controls pervasive throughout the system. No entity is completely trusted. There will be numerous cross-verification among users, processes, servers and technologies. Cloud-based intelligence sharing and collaboration will be paramount to keep the system secure.

And so we must implement: more adaptable supervisor-and-executor dual controls for transactions; persistent checks against user account takeovers; centralised loggings capable of reconstructing transactions; and leverages on Cloud-based Cyber-intelligence services.

Eventually, you will notice that for every business function, say a "Make Payment" request,  the application system will invoke six or seven security processes of identification, authentication, verification, logging,...etc. So be prepared for added computing power or suffer a deterioration in application response time.

New Controls

In moving across new electronic frontiers, merely implementing the conventional firewalls, intrusion detection system, malware detection system, encryption and identity access management is no longer sufficient.

Increasingly, new controls will be based on different root technologies, as it is difficult to arrest an intrusion with the same technology. For instance, it is difficult to use web technology to detect the Man-In-The-Browser attack. Such attacks are so elusive that they can happen right under the user's nose, without the realisation that his transaction is compromised. The user would be under the impression that he is safe, having observed all the secure procedures like, entering his id, password and even one-time code generated from a secure physical token, but oblivious that he has been attacked.

To detect such attacks, other technologies such as, cognitive biometrics and trend analysers, among others,  have to be deployed.

Cognitive biometrics recognises the usual pattern a user touches and moves his devices, and differentiates if it is from a Cyberbot or a human intruder. Trend analysers detect usage anomalies, like sharp jumps in frequency of usage, or the sums of money being transacted.

Extending beyond Security

Trend analyses require broader aspects of data collection and mining, leading to what is called 'Big Data' processing. And with the ubiquitous use of the Internet and the growing ambitions of businesses, Big Data gets bigger everyday.

Back in the early 1990s when I was in oil and gas exploration, we thought the seismic trace interpretation data we were processing were massive. These were data of induced and echoed sound captured from vast oil exploration sites stretching thousands of square kilometres in surface area and kilometres deep into the subterranean. Think of it as a gigantic 3-dimensional volume of sound amplitudes at one-hundred metre grid intervals. Upon collection of the data, we cleaned up the noise, modeled an algorithm and mined them for useful information with the goal of discovering oil and gas deposits. Much the same as in modern day generic Big Data operations. However, while those Petabytes of data were notoriously large to handle with the technology those days, they are no longer considered big by today's standards.

Besides the intimidating size of the data, diversity, data properties and data locations, are some of the other challenges. Data can come from varied sources, in structured and unstructured, formal and informal formats. In my opinion, using data just from the organisation's daily transaction gravitates towards 'Business Intelligence'. It is not just a matter of definition, it does have semantic differences in scope. In Big Data operations, data comes from many sources, and sometimes we may not even know what the real question is when we stumble upon unexpected and interesting patterns. When that happens, basic assumptions are challenged and re-established. We will then have to go back to the basics to clarify our objectives, before  moving forward.

The extent of Big Data is powerful. It can be used not only to detect fraud, but also to (for the case of banking) verify that clients are clean enough to bring onboard and and yet comply to central bank regulations against anti-money laundering (AML).

Implementation

Before proceeding to implement, make the aforesaid benefits clear to your stakeholders. Start your security controls small within the less ambitious goals, but make it known to your sponsors and stakeholders that these technologies can be extended to offer a lot more in the future.

Now, go down to basics  and define the Proof of Concepts (POCs) of the technologies that can solve your problems.  The challenge here is to define what constitutes a successful POC. For instance, if we are testing a cognitive biometric system to weed out fake users, is the product coming up with a lot of suspected users a better one than the one that comes up with lesser suspects? How do we know which one has more or less False Positives and False Negatives? It is all well and good if we are testing them on simulated data, but how would simulated data be of any real help? Ultimately, the real proof is in the pudding - that is, with real-time transactions, and for that, the results may be difficult to ascertain.

Then, we will have to dwell into the fundamental science the product is based on. If the vendor's description of what their product is based on are fuzzy and ill-defined (granted that they have to keep their trade secret), then chances are that they are not to be trusted.

Ultimately, a quantitative and qualitative POC definition success indicators is essential, before each technology is tested.

Once the POCs are proven, it is now time to take stock of your existing system to make sure that it is fundamentally sound. For instance, to ensure that the user authorisation, centralised log server and the fraud management rules engine are operating smoothly and securely administered, before the new technologies are added.

As usual, implement the new controls in stages starting with the quick and easier wins to convince your stakeholders, to secure the approval of the next phases of development.

Conclusion

New devices are attractive because they bring in new businesses and opportunities. Data cleverly harnessed are valuable and can literally make you millions of dollars in seconds. As with all treasures, there will be thieves lurking. Given all these new technological frontiers opening, we need better and more sophisticated controls. These controls, unlike in the past, comes from varied technologies and must no longer be perimeter defences, but pervasive throughout the information system. New pervasive controls are powerful and can serve beyond the objectives of data protection. These new controls can be leveraged to analyse business trends and manage fraud. Implementation must be approached step-by-step and iteratively, while keeping the management informed of their massive potentials for the future.

This article is a very brief summary. It dwells on the salient points of the new frontiers of information security and how we can proceed to implement the technical controls. There are a myriad of other business and managerial considerations in a real life situation. Given the limitation of space here, we shall leave those other discussions in another article, another time.



Note: We are now an official media partner with BIGIT INSIGHT. This article will be published in their magazine.