25 Years of Trends at the RSA Conference

2016 marks the 25th RSA Conference in San Francisco. In two and a half decades, this IT gathering has established itself as a communal space for both digging deep into current threat vectors and taking a hard look at the future: What’s the on the radar, and how can enterprises get prepared?

With a quarter century in the bank, it’s worth taking a look at where InfoSec pros missed the mark — and where they were spot on.

1991: Standards

The official RSA Conference page serves up word clouds for each conference of the last 25 years. In 1991, computing standards and standardization were on the minds of IT pros. No surprise here since this year marked the creation of the world’s first website at CERN labs, which went online Aug. 6, 1991. With an entirely new information access medium rapidly coalescing into a publicly accessible source, it’s a safe bet that InfoSec pros were trying to get a head start on access, privacy and content distribution standards.

So how well does this security concern fare today? Put simply, IT professionals are still fighting the same war — it’s just a different battlefield. Small-scale ISPs and 14.4 kbps connections have been replaced with 1 GB throughput and public cloud servers, but the need for standardization still remains.

RSA nailed an evergreen concern here: As long as technology evolves, users consume it and InfoSec pros are called on to limit the chance of malicious cyberactivity, there will always be a need for standardization. Perhaps more telling is that there will always be resistance to broad-spectrum standardization as companies look to protect proprietary interests while users seek maximum access with minimum impact on privacy.

1995: Sign on the Dotted Line

In 1995, the conference theme centered around the Egyptian Scarab Seal. Because these beetles were never seen in their larval form, many believed them to be immortal and as such used their likeness as seals and symbols to sign contracts, which were considered permanent or everlasting. With the dot-com boom taking the economy by storm in 1995, the focus makes sense — security expectations were on the rise, but the development of InfoSec as a niche discipline was still years away. Contracts were a critical part of defining responsibilities while reining in expectations.

In 2016, meanwhile, the focus has shifted from contracts to service-level agreements (SLA). These more dynamic legal links now cover everything from service provision and data security to recovery time objectives (RTO) and uptime assurances. RSA 1995 represents a good start but ultimately missed the mark as service took precedence over static terms and conditions.

1996: Encryption

Not surprisingly, encryption was a focus for many RSA Conferences over the last 25 years. In 1996, however, the conference centered on one of the best-known examples of encryption: the Navajo language. This complex dialect — which has only a few thousand fluent speakers at any given time — bears little resemblance to any Asian or European language. As a result, Navajo code talkers were able to send and receive messages for Allied forces without fear of eavesdropping during World War II.

Encryption remains a powerful force in security today. Ask any InfoSec professional about the best way to start the process of data security and it’s a safe bet encryption tops the list. Worth noting, however, is that RSA participants didn’t consider the potential backlash to public encryption efforts: Advanced ransomware threats that scramble and then encrypt all files on a desktop and any attached media have become a massive problem for private users and enterprises alike.

As noted by The Hill, the ransomware industry is approaching $1 billion a year in revenue, and some high-profile targets have taken to paying off malicious actors in bitcoin in a desperate attempt to regain file access. Bottom line? Strong encryption remains a top priority for enterprises, but experts now face a new threat: breaking encryption algorithms designed to compromise user data.

2004: Cryptography

Given RSA’s foundation as a public-key cryptosystem, it makes sense that more than a few conferences focus on the discipline of cryptography.

In 2005, for example, the Chinese Remainder Theorem took center stage. Originally developed in the third century by Sun Zi, the theorem was put to practical use in the 13th century by Ch’in Chiu-Shao in the war against the Mongols. He understood that Sun Zi’s theorem wasn’t just good for counting large numbers, but also concealing them as needed. Today, his work is considered foundational in the development of public-key cryptography.

Today, cryptography remains a hot-button issue. Many companies still don’t properly hash passwords and other personal data stored on their servers, making it easy for criminals to make off with massive amounts of critical information. The opposite problem also exists: Many governments and agencies worry that improved cryptography means better protection for ordinary citizens and malicious cybercriminals alike.

This issue will likely come to a head in the near future. But it’s security professionals who will make the biggest difference when it comes to locking down devices and endpoints.

2013: Big Data

By 2013, the RSA Conference was understandably concerned about the security implications of big data. The theme that year was Gutenberg’s printing press, which changed the way people saw and consumed information in their daily lives — in effect, a precursor for big data. The struggle? As information becomes readily available, it’s impossible to discriminate the audience, and all have equal access to emerging innovation.

This is perhaps the conference’s most prescient insight: Big data is now a cornerstone resource for enterprises, and the emergence of Internet of Things (IoT) technologies only serves to increase the volume and availability of this data. Moving forward, InfoSec professionals must adopt a view of big data not as a security challenge but as a foundational component of security architecture. This is a cultural shift far more than a computational one.

For 25 years, RSA has brought security professionals together and let them loose to discuss, discover and dissect InfoSec issues. While they’ve had their share of hits and misses it’s safe to say this is a worthwhile venture. Here’s to another quarter century!