Top 20 Cybersecurity Predictions

Ransomware Morphs Into Blackmail

The threat from ransomware is continuing to evolve. Threats are shifting from encrypting data to blackmailing data owners. Nation-state threats and hacktivists are the wild cards in the ransomware game and their reach stems from the wide geopolitical arena.

End Users: You Are Still the Weakest Link

Hackers will continue to target end users with more sophisticated phishing and targeted malware. Hackers know how to take advantage of unpatched desktops. Don't take your eyes off the end users.

Identify Verification Services Expand to Banks

We will see an expansion of identity verification services to large banks, such as Bank of America, Capital One, Citi, and Wells Fargo. Researchers also said customers will be able to use bank-issued credentials to log into government services. Blockchain will also likely emerge to help verify identities based on federated, consortium-based transaction data.

Hey, Google Unlock the Garage Door

Households are filled with multiple connected devices via the Internet of Things, including Google Home and Alexa. The products are not only convenient for households but also for hackers. Without security software, anyone can gain access to your home and your personal information. Because loT has widespread network capabilities, there is potential for large-scale DDoS attacks taking down entire websites or Internet-based services.

Worms Are Back

As a popular method of fast propagation of malicious payloads, worms can bypass firewall and phishing controls, easily accessing the soft underbelly of the enterprise network.

Adversaries Hiding in Plain Sight

Attackers are adopting everyday tools to eliminate signs of the attacks. There is no need to look for the backdoor features that allow access and makes attribution more difficult. Pinpointed attribution becomes more challenging, leaving the door for ambitious cyberattacks and influential campaigns open.

Security Integrated With Product Design

Companies will increase their demands that security is included in new automation equipment purchases. For example. the encrypted software will be required for remote terminal units. And, products will be tested for the ISA Secure certification.

You Already Know Your Vulnerabilities

SANS estimates that over 80 percent of cybersecurity incidents exploit known vulnerabilities.

Gartner estimates that "through 2020, 99 percent of vulnerabilities exploited will continue to be ones known by security and IT professionals for at least one year."

Cisco estimates that IoT will account for nearly half of connected devices by 2020, as cars, refrigerators, medical devices and gadgets not yet imagined or invented will be connected to the IoT. This will lead to the tremendous growth of threats and vulnerabilities.

The Takeover of Known Tools to Gain Access

Malwareless hacking attacks — these consist of attacks that abuse non-malicious tools or compromised applications to carry out their efforts. These are also predicted to increase.

Battle of the Bots: An Arms Race in Machine Learning Emerges

Machine learning can process massive quantities of data and perform operations on a large scale, exploiting newly discovered vulnerabilities faster than defenders can patch them. Organizations must effectively analyze machine judgment, balanced responses, and human strategic intellect to anticipate plans of attacks.

Two-Factor Authentication in Cyber Cites

Attacks that attempt to subvert two-factor authentication will rise as sophisticated attackers set their sights on two factor authentication-protected accounts and use flaws in SS7 to redirect SMS text messages.

In addition, software supply chain attacks, like the Medocs compromise with NotPetya, will be more prominent.

Adversaries Target Endpoint Antivirus Software

Hackers will leverage and exploit trusted security products. The public and business perception of security software, particularly that of antivirus solutions (AV), will further deteriorate.

Sweet Data in the Supply Chain

The vulnerability of the supply chain means an increased risk of compromise. When that information is shared, direct control is lost to the integrity and security of all connected data systems. We have seen "manufacturing organizations losing manufacturing capability because they were locked out and their supply was being affected due to vulnerabilities."

Security Policy Sharpens Focus on Insiders

This means remote work and access increase risks for cyber attacks. "An employee with access to sensitive information in their network can sabotage the company if something goes wrong" from their remote access point. It is as simple as leaking "their own credentials unknowingly, providing a malicious cybercriminal access to your network."

"Internal cybersecurity policy will likely be more rapidly adopted than before to accommodate the security needs of the company and exchange with remote employees. You can expect more emphasis on user behavior analytics, permissions management, and video logs."

Breach of Critical Infrastructure Faces Mandatory Reporting

[Eddie] Habibi notes that the lack of a mandate to disclose attacks on corporations continues to hinder accurate intelligence gathering and the development of targeted defensive strategies against an evolving threat landscape. He expects the U.S. will follow the European Union's lead, and that Congress will begin to hold hearings that include mandating disclosures of cyber-attacks within certain critical infrastructure industries.

Data Is a Liability, No Longer an Asset

Delete unnecessary data and become diligent regarding what we store and where it is stored. It's a defense, in-depth measure — "the less you store, the less you have to lose."

Platform Agnostic Ransomware Emerges

The financial payment for ransomware is going to evolve significantly so that it will be as easy as clicking once to pay the ransomware. It will target time-sensitive systems and events, so watch out if you are taking part in the World Cup next year as cyber-crime will always be looking for major events to trick and take advantage of people wanting to get access to their favorite sport or concerts.

RansomScare will also be the next threat, which will become a life and death situation unless a ransom is paid.

CFOs Demand Smarter Spending on IT Security

Corporations will favor smarter investments that provide better integration and augment the value of existing products in the security portfolio.

Network Behavioural Analysis Emerges as a Cornerstone

Technologies that measure network behavior and take an intelligent approach to attempts of suspicious activity will illicit IT response and investigation. An analysis will look at the activity that attempts to mask itself against routine network operations.

Standalone IDS and IDP Go Back to the Future, But Better

Layered security defenses will be re-emphasized as a "consumerization of technology" increases. Multiple detection methods will build stronger IT infrastructure.