Cybersecurity Predictions from a Generation Ago (25 years)
By Steve Foote (CISSP), March 2023
This article is dedicated in memory of Dr. William (Bill) Bail in appreciation for his decades-long commitment to national security and software engineering excellence. Thank you for priceless years of guidance, wisdom, and mentorship.
In November 1998, I authored a magazine cover article titled “19 Infosecurity Predictions for 99” for Information Security Magazine’s (an ICSA publication) Crystal Ball Forecast edition for 1999. [1] The world-wide-web (WWW) was in its infancy [2], as were many of today’s readers of this article, but the field of information/computer security was already vibrant and rapidly expanding.
Given that an entire generation of humanity has gone by since I first made these predictions (25 years – 1998 to 2023), it is entertaining, sometimes enlightening, and even a bit concerning to reflect on the predictions I had made, whether or not they proved to become accurate, and how many of these cybersecurity challenges still need to be addressed today.
For example, here is one of those predictions: "Change Will Be Constant - As organizations evolve into virtual businesses, new opportunities – and, consequently, new threats – will continue to crop up daily. The challenges of secure e-commerce will continue to test the limits of technology; remote partners will require an increasingly higher level of access to critical business applications and information; hackers will develop new tools and techniques for breaking through today’s security barriers; savvy end-users will explore new ways to use (and abuse) their privileges." [1] Seems obvious today (in 2023), but in 1998 there were far fewer security threats - we didn't know what we were in for.
To set the context for these predictions, here (below) is the visualization of what the Internet looked like back then.
The Internet sure has changed a lot since 1998.
(Yes, the image to the left is of the ARPANET from 1973 – quite literally the grandparent of today’s Internet. In 1998, people looked back 25 years to 1973 and reflected upon images like this one.)
Thank you to David Newbury for sharing that image via his Twitter account, and to his father for saving the original document for posterity.
Below is a list of each of the predictions from 1998. [1]
Understand that there was considerable “editorial craftsmanship” put into the exact wording of the original article and its predictions, in order to fit the article into a tight footprint of word-count, spacing on printed pages (around graphics), etc. so the wording of some of these predictions is relatively pithy and provocative – and without the benefit of the fuller narrative (I cannot quote the entire article due to copyright restrictions), a few of these predictions do not immediately appear to be security-related. But they all most definitely have substantial security ramifications.
"19 Infosecurity Predictions for 99" [1]
- “Applications Will Have Millions of Moving Parts”
- “Companies Will Establish Numerous Security Perimeters”
- “Firewalls Will Become More Adaptive”
- “Personal Firewalls Will Take Off” (be adopted)
- “Securing Business Partner Access Will Become Easier”
- “Viruses Will Take on New Life Forms”
- “Detecting Intruders Will Become Almost Impossible”
- “New Technologies Will Open More Security Holes” (more obvious today than in 1998)
- “Companies Will Emphasize Legal Evidence of Break-Ins”
- “User Communities Will Grow into the Millions”
- “The Corporate Walls Will Come Tumbling Down”
- “Single Sign-On Will Move into the Mainstream”
- “Certificate-Based Authentication Will Move Up” (in prioritized adoption)
- “Integrated Security Strategies Will Gain Popularity”
- “Operating Systems Will Be Hardened” (stop laughing)
- “Granular Authorization Will Continue to Lag” (meaning “access control”)
- “Real-Time Cryptography Will Arrive” (key mgmt. was manually intensive in 1998)
- “Security Will Eclipse the Y2K Bug” (if you have to ask “Y2K bug?” then I was correct)
- “Change Will Be Constant” (leading to ever-changing & expanding attack surfaces)
(And now you know why I’m the guy you do not want to get stuck talking to at a cocktail party.)
The details and evidence for or against each prediction can be found below.
Fortunately, interested readers have an independent source with which to assess the outcomes of these predictions: Dr. Michel E. Kabay [3] has been a diligent custodian and archivist of much of what has transpired in the field of computer/information security from 1997 thru today via his “Infosec Year In Review” – an outstanding compendium of computer security related news article summaries from around the world. [4]
As my prior colleague, the infamous and incomparable computer security expert and evangelist Dr. Dan Geer, once stated: “What I want is to predict the future. I want it for reasons that are no doubt emotionally clear, but I also want it because of my own definition of security: The absence of unmitigable surprise…. There is never enough time. I thank you for yours.” [35]
Computer security predictions from a generation ago (25 years)
(This one was a “softball pitch” to get warmed up. They get better; trust me.)
In 1996, Microsoft released its Distributed Component Object Model (DCOM) which enabled software components to communicate with each other across networks, including the Internet. By 1998, software companies in the industry were beginning to ship large numbers of applications built using Microsoft’s DCOM, enabling those applications to interact with other applications’ components inside and outside of companies’ firewalls.
“One widely criticized aspect of the DCOM model, is that there is no absolute way of addressing an object instance – everything is done through object interfaces. As such, it can be difficult to manage a large set of worker object instances or temporarily disconnect and reconnect at a later time. Another problem DCOM is facing is that currently there is no good solution to the problem of keeping track of possibly thousands of objects spread over thousands of computers on the network. The user has to supply the network address of the host machine for the server object, or that address must be hard-coded in the client application itself.” – Tom Markiewicz, 1998 (Introduction to DCOM)
Additionally, advanced object-oriented languages like Java (initially released in 1995 and Java 2 was released during 1998) were quickly gaining popularity and features such as “object serialization” (added to Java in 1997), combined with the nascent CORBA brokers (v2.2 was released in Feb 1998), were enabling the sharing of business objects across networks and even between business partners.
Also in 1998, web pages were quickly becoming polluted with 3rd party applets and JavaScript libraries used for marketing purposes and tracking users’ behaviors and browsing traffic. As such, by 1999, it was nearly impossible for an information security specialist to get an accurate picture of exactly what live software properly comprised any given legitimate “application”.
Ok, so “millions of moving parts” did not quite come to fruition, but there were “thousands” of application components and objects inside any business’s network in 1999. And the same is certainly true even today, as we are presently discovering through organizational efforts to compile Software Bills of Material (SBOMs).
The image is of Sun Microsystems’ homepage @ www.sun.com in December 1998
2. “Companies Will Establish Numerous Security Perimeters”
In 1996, a Microsoft employee created the first virtual private network (VPN) then known as peer-to-peer tunneling protocol (PPTP). (Apologies to SIPP from the U.S. Navy in 1992, SwIPe from Columbia University and AT&T in 1993, and IPsec from Trusted Information Systems in 1994.) In 1998, when I was publishing this prediction, companies were already adopting the use of VPNs. By 1999, the specification for PPTP was published [5] which facilitated the creation of other VPN offerings.
“As this technology was expensive in its infancy, the first VPNs were generally only used by businesses exposed to several threats that could compromise the confidentiality of their information or steal critical data when they were still using open internet connections. This special security was also needed so that remote users or operators could use the institution's files without running the risk of them escaping.” – “The First-Generation VPNs of the 1990s”
Knowing that companies were already trying to establish secured business-to-business channels over which to share business components and objects (see prediction #1 above), it was easy to recognize that any given company would want to terminate their incoming VPN connections in varying locations within their own corporate networks. A company’s supply chain partners’ VPN connections might terminate near its procurement application (so that I could place digital purchase orders directly with suppliers), where as the same company’s customers’ VPNs might terminate near its sales applications (so that it could digitally receive purchases).
In 1998, VPN technologies were relatively non-sophisticated by today’s standards. Gauntlet from Trusted Information Systems was one of the more advanced VPNs. It was easy to improperly configure a VPN (see details in prediction #3) and mistakenly bridge together networks that allowed traffic to flow freely between a company’s various businesses partners – which enabled them to see each other’s network traffic and enabled network intrusions to jump across corporate firewalls and along business supply chains. To complicate matters, in 1998 there was essentially no international body of law that could regulate liability for company-to-company security intrusions across national borders.
(Why is that image so blurry? Because 800 x 600 was the typical resolution in 1998. Its for nostalgic "effect".)
By 1999, security-savvy companies were quickly establishing “numerous security perimeters” through which they could safely manage their Internet traffic separately with each business partner using VPNs that terminated in different network locations (sometimes even in specific geographies) within their own firewall. There’s more to “security perimeters” but the VPN discussion here should suffice to paint the picture as it was evolving in 1998 to 1999.
6. “Viruses Will Take on New Life Forms”
The Melissa virus spread around the world (March 1999) via email in merely hours and the Chernobyl virus was first detected in 1998, but its payload was not triggered to be executed until April 26, 1999.
Another example from 1999 is the Kak Worm which was a JavaScript computer worm that spread itself by exploiting a bug in Outlook Express.
“Viruses and security holes actually caused real damage during the (1999) year, not the mere hype we’d seen before. Everyone knew Melissa, but that wasn’t even the year’s worst bug…. ‘Exploding e-mail’ - Security historian and virus industry cynic Rob Rosenberger in August (1999) quietly unveiled a technique to bring e-mail servers to a crashing halt…. Rosenberger created files that violated established protocol: COM files of zero length, Zipped files with no content, and other techniques. To the server, these methods don't make a difference, but many anti-virus and content scanners freeze when they scan such a file. The problem: When the scanners die, they take the servers with them. While several industry insiders had problems with the way Rosenberger announced the flaws -- and the fact that he targeted anti-virus software, few disputed the efficacy of the techniques.” – “The biggest computer bugs of 1999!”, ZDNET, December 1999
In 1998, Java applets and browser plug-ins containing malicious code were just starting to show up on the Internet. And because “personal firewalls” were not yet available (see prediction #4), there was little defense against these new and emerging threats. Users of browsers were turning off their browsers’ features in order to prevent these types of attacks. While the concept of “sandboxing” applications (running them in separate environments inside an operating system) was already available in Unix operating systems, it wasn’t until 2001 that the web browsers’ vendors began introducing “sandboxes” into their browsers [7]; and the early attempts at containing intrusive malware inside of “sandboxes” left a lot to be desired. To the left is the Monthly Rate of Virus Infections Per 1,000 PCs…
“Consumers' privacy also became a big issue in information security this year (1999). ‘Privacy was always related to information security,’ said Jason Catlett, president of pro-privacy Junkbusters Corp. ‘But I think 1999 was the year when lots of people really started taking Internet privacy personally. We have moved our lives into a place that isn't very secure or private, so everyone's understandably feeling kind of nervous and uncomfortable.’" – “The biggest computer bugs of 1999!”, ZDNET, December 1999
7. “Detecting Intruders Will Become Almost Impossible”
Full disclosure: Fred Cohen had already made the claim in 1987 that there is no algorithm that can perfectly detect all possible viruses. My 1998 prediction focused on intruders(implying an active human attacker). And I had based my prediction upon a number of professional papers published in the 1990s.
In 1998, the state-of-the-art for Intrusion Detection Systems (IDS) was to use your company’s firewall’s logs to detect intrusion attempts. There were very few IDS implemented, and most that did exist were co-located with a company’s firewall, at the edge of their corporate network. These came to be known as “network-based intrusion detection” systems. With all the external connectivity (see prediction #2) and moving application components (see prediction #1), it quickly became impossible to detect intruders coming from all these new “directions” (sources of entry). So “host-based intrusion detection” systems (or “agent-based”) quickly arrived on the market.
Was I correct about what would happen in 1999? In fact, I was.
“By the early 2000s, IDS started becoming a security best practice. Prior to then, firewalls had been very effective for countering the threat landscape of the 1990s. Firewalls process traffic quickly as they have no ‘deep packet inspection,’ meaning they have no visibility into the content and context of network traffic. Firewalls only have the ability to react based on port, protocol and/or IP addresses. In the early 2000s new threats like SQL injections and cross site scripting (XSS) attacks were becoming popular and these attacks would pass right by the firewall. Hence the real beginning of putting the IDS into use. The popularity of IPS (Intrusion Prevention Systems) would come later.” [8]
To the left are the estimated market shares (by vendor) for 2000, from International Data Corp (IDC)…projected to be $234 million total (worldwide) in 2000…
10. “User Communities Will Grow into the Millions”
In 1998, very few companies could boast about having 1 million users (customers, employees, or both combined) under their management. Netflix (founded in 1997) was still in the DVD rental business (e.g., no online customer accounts for streaming until 2007). Amazon was on a very steep growth curve, having announced in 1997 that they had 1,500,000 customer accounts. [13] And AOL claimed to have reached 5 million users by 1996. But most of today’s largest companies (from a user community perspective) had yet to be founded: Tencent (founded in November 1998 – the same month my predictions were published), Alibaba (1999), PayPal (2000), Facebook (2004), Instagram (2010), etc.
As e-commerce was blossoming in the late 1990s, user community sizes were growing, and companies were about to exhaust their home-grown approaches to (customer) user account management. Vendors with security offerings began to launch federated (LDAP compliant) directory products and services during 1999.
Today, it is not unusual for the largest social media companies to support billions of user accounts. Facebook (now META) claims to have 2.963 billion active monthly users (in 2023). [14] Similarly, Instagram reached 2 billion active monthly users in Q3 2021. [15]
The image is of AOL's homepage @ www.aol.com on 11 December 1998
17. “Real-Time Cryptography Will Arrive”
n 1998, cryptography was being leveraged in business-to-business commerce (largely via VPNs, EDI, and the use of shared secrets for encryption). But cryptography still required a fairly manual effort to install, implement, and maintain. [26]
Security for the early online commerce sites was largely based upon username/password pairs, which were sometimes transmitted in clear text across the Internet (though SSL did exist since 1995 and so too did the SSL vulnerabilities – version 1.0 of SSL was never released because it had serious security flaws and version 2.0 was quickly replaced by 3.0 because it too had serious security flaws). [27] Hampered by the lack of cryptographic security for consumer transactions, “U.S. retail e-commerce sales accounted for 0.5 percent ($15 billion) of total sales ($2,868 billion).” [28] But all that was about to change.
Consumer-related security standards and products began to proliferate in 1999. The Transport Layer Security (TLS) was defined in 1999, around the same time that IEEE published 802.11b and introduced WEP security. These along with many other cryptographic-related evolutions formed a stable basis upon which to build modern e-commerce businesses.
Napster launched in June 1999, sharing (sometimes pirated) music online. Apple released iMovie in 1999 and iPods (for downloading music) were released on 23 October, 2001. Even Disney Interactive Media Group was founded in 1999.
Additional advancements in the field of applied cryptography would arrive shortly thereafter. By 2002, the W3C had released XML-Encryption which would be used to secure more advanced e-commerce transactions (those that leveraged SOAP). XML-Encryption provided a standard and easy means by which to encrypt content using one-time symmetric keys (which were fast) and then encrypt the one-time symmetric key with a public-key/private-key pair – enabling the now-encrypted one-time symmetric key to be attached to the encrypted content and delivered across the Internet to the receiving parties. [29] And elliptic curve cryptography algorithms (created in 1985) would enter widespread use by 2004 and 2005 – which helped to secure the content for some of the earliest streaming services.
(The image is of Apple’s homepage @ www.apple.com in October 1999)
19. “Change Will Be Constant”
Artwork © 2001, Ward Cunningham (www.agilemanifesto.org)
The age of “Agile” was about to be launched in February 2001 by the publishing of the Agile Manifesto. [32] But software development companies around the world were already adopting agile software development practices (without having the “agile” moniker as a reference name just yet). Back in 1986, Harvard Business Review had already published “The New New Product Development Game” article by Hirotaka Takeuchi and Ikujiro Nonaka [33], which Jeff Sutherland (co-author of the Agile Manifesto and co-creator of SCRUM) has credited as influencing the creation of the SCRUM agile development methodology (the posterchild methodology for “agile” now in the 2020s).
By 1998, I myself had already spent well over a decade working for software companies (e.g., Oracle, OpenVision) and technology companies (e.g., GTE) at which my teams were performing nightly software builds (compilations), daily automated code inspections, and weekly automated testing of our software code. (It was humbling and enlightening to get such timely and critical feedback regarding my software code.) We didn’t know we were being “agile” because there wasn’t a name for our type of software development yet (e.g., non-waterfall). The closest concept in 1998 was Dr. Barry Boehm’s “spiral model of software development” from 1986. [34]
Based upon this prior exposure to rapidly building and releasing software products, and upon my years as a computer security expert (CISSP, etc.), I made this prediction:
“As organizations evolve into virtual businesses, new opportunities – and, consequently, new threats – will continue to crop up daily. The challenges of secure e-commerce will continue to test the limits of technology; remote partners will require an increasingly higher level of access to critical business applications and information; hackers will develop new tools and techniques for breaking through today’s security barriers; savvy end-users will explore new ways to use (and abuse) their privileges…the list goes on.” [1]
In hindsight, and with a compendium of published news articles from 1999 and beyond as evidence, it is safe to conclude that this last prediction was a “home run”.
Endnotes:
[1] Foote, Steven, “19 Infosecurity Predictions for 99”, Information Security Magazine, November 1998, https://www.infosecuritymag.com/(Note: the original publisher seems to have been acquired by Tech Target, Needham, MA)
[2] Tim Berners-Lee released the first browser, called “WorldWidWeb”, in 1990. https://www.w3.org/People/Berners-Lee/WorldWideWeb.html Netscape released its Mosaic browser (soon to be renamed Navigator) in late 1994. The browser was the most advanced available and was an instant success. The rich functionality piqued the interest of millions of people, launching explosive growth in browser users worldwide.
[3] Dr. Michel E. Kabay’s contact homepage: http://www.mekabay.com/contact.htm
[4] Kabay, Michel E, Dr., “Infosec Year in Review”, https://www.mekabay.com/iyir/index.htm
[5] https://www.techtarget.com/searchnetworking/definition/virtual-private-network
[6] https://www.networxsecurity.org/members-area/glossary/i/ipsec.html
[7] www.dmst.aueb.gr/dds/pubs/conf/2001-Freenix-Sandbox/html/sandbox32final.pdf
[8] https://www.secureworks.com/blog/the-evolution-of-intrusion-detection-prevention
[9] https://cve.mitre.org/and most recently https://www.cve.org/
[10] https://www.techtarget.com/whatis/feature/SolarWinds-hack-explained-Everything-you-need-to-know
[11] https://news.sophos.com/en-us/2021/12/17/inside-the-code-how-the-log4shell-exploit-works/
[13] https://www.sec.gov/Archives/edgar/data/1018724/000119312513151836/d511111dex991.htm
[14] https://datareportal.com/essential-facebook-stats
[15] https://www.businessofapps.com/data/instagram-statistics/
[16] http://dotnet.sys-con.com/node/45908“Exclusive .NET Developer’s Journal “Indigo” Interview with Microsoft’s Don Box”, Dotnet.sys-con.com
[17] https://www.informit.com/articles/article.aspx?p=27295 “History of Web Services”, informIT, June 21, 2002
[18] https://www.ics.uci.edu/~fielding/pubs/dissertation/rest_arch_style.htm
[19] https://jumpcloud.com/blog/what-is-single-sign-on-sso
[20] https://www.rfc-editor.org/rfc/rfc3280
[21] https://www.wired.com/1999/08/hotmail-hackers-we-did-it/
[23] https://www.redhat.com/en/topics/linux/what-is-selinux
[24] https://www.csoonline.com/article/3318238/the-opm-hack-explained-bad-security-practices-meet-chinas-captain-america.htmlFruhlinger, Josh, “The OPM hack explained: Bad security practices meet China’s Captain America”, Computer Security Online, February 2020
[25] https://www.gao.gov/assets/gao-17-614.pdf“US Government Accountability Office (GAO), “OPM Has Improved Controls, but Further Efforts Are Needed”, GAO-17-614, August 2017
[26] https://web.archive.org/web/20160103124500/https://www.isoc.org/inet97/proceedings/C5/C5_1.HTMElectronic Data Interchange: Concepts and Effects, 29 Jul 1997
[27] https://www.acunetix.com/blog/articles/history-of-tls-ssl-part-2/
[28] https://www.census.gov/content/dam/Census/library/publications/2001/econ/1999estatstext.pdf
[29] https://www.w3.org/TR/xmlenc-core/
[30] https://people.com/human-interest/y2k-millennium-bug-20-year-anniversary/
[32] https://agilemanifesto.org/
[33] https://hbr.org/1986/01/the-new-new-product-development-game
[34] Boehm, B (August 1986). "A Spiral Model of Software Development and Enhancement". ACM SIGSOFT Software Engineering Notes. 11 (4): 14–24.