How long does it take to go from excitement to panic? Put differently, how long is the vulnerability lifecycle?
We know the hardware side of the story. Moore’s law predicts transistors density double every 18 months. On the street, factoring in leasing, this means computing power jumps up every 36 months.
Now let’s cover the software side of the story. It takes a couple of years for software ideas to be developed and to reach critical mass. We see a 24-month development cycle. Add another 6-12 months for the software to become prevalent and investigated by hackers, both ethical and not.
I made a prediction this past weekend. Some at BSides Chicago were calling this Wolf’s Law. Not me. I checked the video replay. Nope. It is simply a hunch I have. Start the clock when developers get really excited about software, tools, or techniques. Stop the clock when a hacker presents an attack at a well-known conference.
Wolf’s Hunch says it takes 36 months to go from excitement to panic.
As a security industry, the trick is to get ahead of the process. How could we engage the developers at months 1-12? One way might be to attend dev conferences. Here is how I put it at BSides Chicago:
“You know what is scary? Right now, as we are all in here talking, there is a software developer conference going on. Right now. There are a whole bunch of software developer guys talking about the next biggest thing. 36 months from now, what the developers are really excited about, we will be panicking about.”
I checked the news this morning. During this past weekend, NY Disrupt was in full swing. At approximately the time I was speaking, developers were hard at it in the Hackathon. Lots of people are excited about the results, such as Jarvis:
“Jarvis works, using APIs provided by Twilio, Weather Underground and Ninja Blocks to help you control your home and check the current conditions, headlines and what’s making news, and more, all just by dialing a number from any telephone and issuing voice commands, It’s like a Siri, but housed on Windows Azure and able to plug into a lot more functionality.”
Uh huh. A Jarvis. Voice control. Public APIs. What could possibly go wrong?
Will my hunch play out? Check back here in May 2016. My money is on a story about a rising infosec star who is demonstrating how home APIs can be misused.