What does 2022 have in store for cybersecurity and cloud security specialists?
They just so happen to see a lot of challenges that their software is well suited to resolve... no surprises there.<p>My predictions for 2022: An awful lot of work to be had before you go insane.<p>I&#x27;d expect the trends of &quot;massive complexity causing problems solved by more complexity&quot; to continue, because that&#x27;s <i>literally</i> the only thing the hardware and software industry seems capable of doing anymore.  Stacks of complexity that then require more complex hardware to run, and the cycle continues.  <i>Nobody</i> understands the whole stack anymore, except perhaps the malware authors who freely move up and down the stack to accomplish their goals.  Those writing the software and, theoretically, auditing the software don&#x27;t seem capable of finding badness hidden in it - and decades of experience says, &quot;Humans can&#x27;t find suitably stealthy badness hidden in software, intentional or not.&quot;  Look at how long some of the really nasty bugs have been floating around (exploited or not, we don&#x27;t know) before someone finally got around to noticing them.  I mean, <i>how long</i> was Debian only generating one of 32k SSH keys?<p>I don&#x27;t see a good path forward for &quot;connected, computer based, all the things.&quot;  If we were willing to consider dumping, say, 80% of the features of modern computing, we could probably do a pretty good job securing the other 20% (the commonly used ones).  But at too many places, payment and promotion is for features, not bugfixes, not security patches.  So new features just keep getting released, old stuff gets abandoned, and the cycle of promotion goes on.  The incentives are simply wrong to create anything faintly resembling secure software.<p>And I expect a continuing wave of people who&#x27;ve been doing security for 20-30 years just... quietly retiring to a life of not much consumer tech.  The joke in my circles is that we&#x27;ll be goat or llama farmers, and I&#x27;m not sure it&#x27;s too far from the truth.  I expect a large collection, in decades to come, of &quot;You clearly enjoy this farming thing, I don&#x27;t think you care a bit about making money, and why is the most advanced bit of technology on this place a couple Arduinos?&quot;  You&#x27;ll find them run by former low level security types.<p>I don&#x27;t know how much runway is left in the current trends of tech, consumer and enterprise, but we&#x27;re clearly at a point where <i>nobody</i> can reason about the stuff anymore, and even if you&#x27;re using all the patches, all the best practices... you can still have your whole company shut down by ransomware and such.  It&#x27;s less likely, but still far from impossible, when we see things like former NSA 0days used to deploy ransomware.  Pretty hard to defend against 0days.<p>Were I to do a business these days, I&#x27;d probably take a serious look at doing things like &quot;Training employees on Qubes&quot; (and buying hardware that can run it).  You may not be able to make things impossible for an attacker, but you can sure make them want to go somewhere else for easier pickings (if they&#x27;re not targeting you, specifically - if they are, you&#x27;re probably screwed).  The whole &quot;Giant Windows Domain&quot; thing repeatedly proves impossible to secure in practice.<p>Or maybe just go back to typewriters and a good secretary or two.