We’re about mid-way through January of 2018, which means that it’s about time I follow up on my new tradition of sharing my top cyber security predictions of the new year!
This year, in many ways, shares the same line-of-thought as last year’s post, with bad-actors still being the first-adapters of many of the freshest innovations and some emerging technologies still largely in their infancy. However, the maturity of and research devoted to many of these possibilities, has shown us a much clearer picture of the future of security. So, without further delay, here are my 2018 top 5 cyber security predictions.
Blockchain is the buzzword of the moment as Bitcoin becomes a household name and tech and business bloggers race towards thought-leadership, unpacking its implications and suggesting hypothetical use-cases. While this upcoming year, I predict a lot of experimentation, and not a lot of systematic implementation of blockchain as a mainstream, cybersecure protocol, the implications for the future of cybersecurity are promising. There are many great videos and articles explaining blockchain. Here is one of my favorites.
Essentially, it’s an encrypted leger where everyone on the leger has a private key whose code is randomly generated so that it changes with every message. Aside from the cryptographic protections, there is another secure, unique feature to the blockchain which is that it serves as a single-source of truth. How can this be so? Collectively, we choose to trust the longest chain, so any bad actor would have to outpace the legitimate blockchain to fool someone. While theoretically, the data itself might not be less susceptible to a breach, it will lessen bad-actors’ abilities to tamper with data due to its immutability and transparency. However, the immutability and transparency paired with the advanced cryptography makes blockchain a candidate for a new standard of security.
There have already been some use-cases of blockchain, such as MIT’s “Digital Diploma” Program, banks have begun implementing blockchain for currency transfers, and there’s even been a case of government investigation via blockchain uncovering the Silk Road Task Force federal agent who was behind the theft of millions of dollars in bitcoin. The key for blockchain as a step towards reliability and transparency on the internet is for more adoption. Before more organizations will be willing to rely on blockchain, the technology is going to have to go through much more experimentation with limited objectives, before it can become a comprehensive solution.
Researchers will have to begin trying to hack blockchain and finding the technology’s vulnerabilities, as well as theorizing possible vulnerabilities, to ensure blockchain is as secure as we’d all like to believe. 2018 will be the year for increased experimentation and eventual implementation of blockchain in enterprise companies and beyond. One new idea being discussed is the “Chain of Things” or, as Don and Alex Tapscott put it, “The Internet of Everything needs a Ledger of Everything.”. As I’ll discuss next, internet-of-things (IoT) security is top-of-mind for many in the coming year; the blockchain may be a perfect mate to ease the anxiety around IoT vulnerabilities- the damage that was proven in 2016 and 17 and the perceived, more harmful damage awaiting the IoT in 2018.
IoT Attacks get more Aggressive
2016 brought us the Mirai botnet, 2017 brought us Brickerbot malware and the CloudPet breach. Over the past few years, we’ve seen the potential of broad, massive damage the exploitation of IoT vulnerabilities can bring. 2018 will bring us more focused, aggressive and money-motivated attacks than we’ve previously seen. This is a huge concern, as organizations are ill-prepared for such harmful and far-reaching IoT attacks, yet research firms like Gartner have predicted that by 2020, more than half of major new business processes and systems will incorporate elements of IoT.
In a research paper published by Trend Micro in May of last year (2017), they estimated that there will be over a million industrial robots employed by enterprise companies in 2018 alone. In the report, they also outlined industrial robot attack scenario tests which showed how robots can be compromised through industrial routers and other vulnerabilities. Dimensional Research and Tripwire partnered up to conduct a study asking IT professionals about their preparedness for industrial IoT (IIoT) related threats. In that study, they found that while 96% of the experts surveyed said they expect to see an increase in IIoT-based attacks, 51% said their organization is not prepared to mitigate malicious campaigns targeting IIoT.
What does all this mean? Just like most technological innovations, progress is outpacing security. While I don’t see the progress slowing to allow for better testing innovations for vulnerabilities and setting security policies and guidelines, I do see a few possibilities for IoT security going into 2018. The first, as I mentioned above, is the implementation of newer, more secure technologies such as blockchain to help safeguard IoT devices and IIoT robots. Another expectation I have is for more regulations tackling IoT security.
I imagine that consumer concerns will take precedence on business concerns for governments, but these types of regulatory compliance mandates can serve as skeletons for organizations to build similar policies and protocols for their own IoT implementations and management. In the meantime, expect more ransomware utilizing IoT devices to infiltrate networks and systems and seeing more politically-based attacks of voting machines and other government-owned IoT devices.
The Scramble to GDPR Compliance
Speaking of regulations, this list wouldn’t be complete without at least a mention of GDPR and how this regulation will change our approach to privacy and data handling on an international scale. GDPR stands for General Data Protection Regulation and will be mandating a set of data processing, handling and storing requirements that give EU resident consumers more control over the data companies collect from them.
The regulation includes requirements around notifying customers of data breaches within seven days of a breach and giving customers the right to be forgotten and the right to transparency, forcing companies to keep their data organized and accessible as well as the need for justification as to why organizations are collecting the data they collect from their customers. The general pulse on organization’s readiness for GDPR is that they are confused. With GDPR going into effect in May 2018, Gartner predicts that at least 50% of companies affected by the regulation will not be compliant with GDPR in time.
If this prediction holds any truth, and I believe it does, 2018 will bring us some fast examples of why companies need to prioritize GDPR compliance. This upcoming summer and fall will show us the real repercussions of the fines and litigation GDPR promises as consequences for non-compliance. In 2018, more companies like Microsoft will be aligning data handling and auditing capabilities with GDPR and partnering with companies like us, who will help other organizations learn how to leverage their IT environments to ensure GDPR compliance and transparency. GDPR won’t be the end of this trend either.
Many other nation states will quickly see the benefits of such regulations and start passing similar policies of their own. What this means for companies managing consumer and employee data is a need for much more transparency into their data, and better policy setting capabilities at the data level. We’ll continue seeing software and data handling companies tackling these challenges going into 2018, as more and more companies fall into litigation and massive fines for their inability to keep pace.
Enterprise Hacks through Mobile Devices
The possibilities for hacking mobile devices are endless and our smartphones’ software is far from secure. The infamous WannaCry ransomware attack reportedly started with an attack on a mobile device and demonstrated 2017 Q1’s increased mobile ransomware attacks of 253% . At Mobile Pwn20wn 2017, security researchers proved multiple ways people can hack smartphones and other mobile devices, including iOS 11.1 This presents an enormous problem for enterprise companies, as their mobile workforces grow along with the number of devices connected to an organization’s network at any given time.
A report published by Dimensional Research and CheckPoint this year entitled The Growing Threat of Mobile Device Security Breaches pointed towards some harrowing challenges for enterprises to overcome in the coming year. Some of the highlights that stuck out to me were that while 20% of companies know that they’ve experienced a breach via mobile device, 24% don’t know whether they have or have not experienced an attack. The survey also found that many organizations do now have an advanced mobile cybersecurity solution beside mobile device management (MDM) or enterprise mobility solutions (EMM). The most fascinating statistic about why people don’t use a more advanced solutions is that 33% of those surveyed claimed their reason to be a lack of experience in implementing such a solution.
Obviously, education is an important first step, but won’t be enough to protect enterprises from mobile device based attacks. In 2018, I predict that enterprises and other organizations are going to start investing more in endpoint, network and cloud solutions to enhance their mobile device security as well as other areas requiring advanced cybersecurity solutions to prevent harmful and costly attacks. New technologies to combat mobile attacks will be created, tested and even implemented this year, and we’re going to see enterprises and large organizations start stepping up to the plate and pushing for more secure and comprehensive security solutions.
More Adoption of Adaptive and Layered Security Approaches
Last year, I talked about how cyber criminals will be leveraging automation for more forceful attacks, this year it seems enterprises are beginning to realize the necessity for deploying automation for cybersecurity. Leveraging automation in this way is known as an “adaptive” security approach because machine learning and artificial intelligence can detect risks and their threat levels at not only an accelerated, but also more accurate rate, with the capacity to quickly learn the behaviors of new kinds of attacks.
Enterprise companies experience hundreds of thousands of security events daily, but few of these events are actual threats. Automated systems can use machine learning determine which events are malicious attacks and artificial intelligence to carry out the functions necessary for mitigating said attacks.
In an article published on Technopedia, fantastically entitled Cybercrime 2018: The Enterprise Strikes Back, Arthur Cole calls 2017 “a wake-up call for the enterprise, which is now poised to come out swinging with new security practices backed by some of the most advanced technologies known to man.” The tech giants, including Microsoft and Google, have already begun exploring and implementing cognitive systems to instate better security protections in their software.
Security start-ups and research firms are also exploring behavioral analysis using machine learning and automated defenses. As organizations realize the complexity of attack vectors and the need for security at all levels, more will begin investing in and practicing a layered approach. We have courses discussing the layered security approach, but in essence it’s having protections set in layers ranging from physical to virtual, application to data-level. With a layered approach, organizations can maintain open, flexible IT environments while keeping their data, identities, apps, systems and networks secure.
Secure Your Microsoft 365 Environment for the Future
Wanting to do more towards the security of your organization in 2018? We now have classes covering Windows 10, EM+S, Office and GDPR Compliance with Microsot 365!
CyberTraining 365 is an online academy that offers nearly 1,000 hours of relevant and cutting edge cyber security training. Our training provides the most in demand industry certification prep courses including EC-Council, CompTIA, (ISC)2 and Cisco; all taught by leading cyber security experts. All of our offerings are aligned with the national initiative for cyber security education (NICE) and ensure the most up-to-date information for this constantly shifting field. With engaging content in a scenario-based format, CyberTraining 365 uses bite-sized micro-learning methodology ensures learners are not overwhelmed with information. On Demand LMS platform has white-label capabilities ideal for internal training purposes.