Image: © Tierney/Stock.adobe.com
As the year begins, there are a few key areas that cybersecurity professionals should keep in mind.
After the excesses of the holiday period, you are more than likely looking at the blank slate of a new year before you with a sense of optimism and hope for times ahead.
Those in the infosec industry may view it more as a future filled with potential threats and attack vectors to worry about. With this in mind, Siliconrepublic.com spoke to some experts in the field about what cybersecurity trends could be on the horizon as the year begins.
IoT will continue to be a pain point
Of course, the internet of things (IoT) ostensibly brings a lot of convenience with it, but it will continue to be a major source of vulnerability for enterprises and consumers alike.
Guy Rosefelt, product management director for threat intelligence and web security at NSFocus, said routers and cameras will remain popular targets, adding: “We have every reason to believe that attacks leveraging the IoT will become more diverse in the future.”
According to Gary McGraw, vice-president of security technology at Synopsys, IoT remains a “security disaster waiting to happen”.
Shadow IT systems in the workplace need to be examined – this will be a year where good cyber-housekeeping is a key differentiator.
Phishing gets personal
According to vice-president of email security at Barracuda Networks, Asaf Cidon, account takeover is one of the biggest threat vectors in the cybersecurity industry today.
“Attackers are moving away from the relatively standard phishing emails, as they are finding that strategically targeting business executive accounts is much more lucrative.”
He added that attackers will be tailoring email attacks to each individual target.
Multifactor authentication will grow in popularity
As a growing number of people become aware of the value of their personal data, multifactor authentication is set to become the standard.
Co-founder of secure communications platform TeleSign, Stacy Stubblefield, said that increased collaboration between mobile network operators and online businesses will boost adoption.
“The increasing prevalence of SIM swap fraud and porting fraud (where attackers take over an end-user phone number so they can intercept one-time passcodes) has led to more collaboration between online businesses and mobile network operators, who can tell those businesses (in real time) when a SIM swap or porting change has occurred.”
This data will be used to augment multifactor authentication.
AI cyberattacks a real possibility
Artificial intelligence (AI) is already becoming intertwined with people’s day-to-day lives, so it is natural for cybercriminals to examine its potential.
CTO of data protection at Gemalto, Jason Hart, predicts an AI-augmented attack as a real threat. “Creating a new breed of AI-powered malware, hackers will infect an organisation’s system using the malware and sit undetected, gathering information about users’ behaviours and organisations’ systems.
“Adapting to its surroundings, the malware will unleash a series of bespoke attacks targeted to take down a company from the inside out.”
Data regulation goes global
The first anniversary of GDPR is only a few months away and many other countries are examining data privacy on home turf. The California Consumer Privacy Act 2018 will pave the way for similar legislation this year, while there are other changes afoot in Canada and Brazil.
This looks likely to continue as we begin to see the impact of GDPR enforcement in tangible ways.
IIoT under threat
Organised criminal groups and nation state collectives are increasingly looking towards the industrial IoT (IIoT) as a lucrative target.
According to Forcepoint: “In 2019, attackers will break into industrial IoT devices by attacking the underlying cloud infrastructure. This target is more desirable for an attacker – access to the underlying systems of these multi-tenanted, multi-customer environments represents a much bigger payday.”
Targets include human-machine interfaces, industrial control systems and distributed control systems.
Cybercriminals take aim at the cloud
As more and more businesses migrate to the cloud, Hart says that a new role of cloud migration security specialist will be a key part of large IT teams.
“As companies move across, there is an assumption that they’re automatically protected as they transition workloads to the cloud. The channel has a role to play in educating companies that this isn’t necessarily the case, and they’ll need help protecting themselves from threats.”
Security-wise, continuous moderation with the help of automation can help teams. Customer misconfiguration, mismanaged credentials or insider theft are the likely risks present – not so much provider vulnerabilities. Cloud hygiene will only grow in importance over the next 12 months, particularly in avoiding devastating data breaches.
McGraw added: “The ‘inventory’ problem (that is, what is running where, who made it, what its constituent parts are) is exacerbated by the move to the cloud and massively distributed architectures.”
C-levels wake up to cyber-risk
As the financial risks that come with data breaches rarely seem to leave the news cycle these days, financially minded board members are now realising how important security is as a business element.
According to an IBM study, the average global cost of a data breach is close to $4m – and this is before you take reputational damage into account.
Software vulnerabilities set to be exploited
In the average enterprise, there is now usually an array of software systems in use, from messaging to emails and productivity trackers. According to McGraw, this is where we will see major issues emerge in 2019.
“Software design flaws will be on the rise as targets of attack. Witness the recent Facebook and Google Plus attacks and their massive impact. Design flaws are much harder to find and fix than simple bugs. As a result, even very strong software security groups sometimes miss them during review.”
