Chaotic actor: Understanding Anonymous and ourselves

18.05.2011
Josh Corman (@joshcorman) asked if he could share an important piece of writing with our readership. As one of our few IT security philosophers, Josh almost always makes you think. His current bully pulpit is at The 451 Group as the Research Director for Enterprise Security leading a pretty atypical motley crew of anti-analysts with street cred. This may be his day job, but Josh has been on a personal mission for years to challenge and improve the way we approach security.

IT security has intensified and accelerated. The velocity of change has reached ludicrous speed -- "we've gone plaid." I kid, but 2011's more than a breach-a-week and events on the street are becoming harder to follow or understand (and more disturbing with each turn). In my 7-minute speed talk at the 2011 RSA Conference "", I asserted that our myopic focus on highly replaceable card data came at the neglect of protecting what's in our brains (less replaceable intellectual property and corporate secrets). With security providers large (EMC/RSA losing some of SecurID) and small (HBGary Federal, Comodo Group, Barracuda), suffering public breaches, more than a few vendors wonder, "will we be next?"

Do you know how you would fare if your mail spool was posted to the Internet for all to see? Many Fortune 100 companies that conflated compliance with best practices for all security have now suffered public breaches of corporate secrets and intellectual property. As part of a series of spotlights, I've introduced specific insights and lenses to help end users and vendors navigate these uncertain times.

In this piece, I focus on the overlooked class of chaotic actors. From the leaks of classified materials on to the rise of the hacktivist group to the toppling of Middle East regimes to the revelations of potentially unlawful and gray area activities from security vendors -- we're a long way from Kansas.

More about Wikileaks