The close of one year and the arrival of another always calls for some reflection and predictions. While antivirus software developers and endpoint security researchers are always looking ahead, it’s often related to the micro challenges – the threats that companies face now – the known knowns.
The cyber threats are undiminished but new types of threats emerging in 2019 will become normal occurrences in the coming 12 months. In some ways that’s good – a known quantity to work to in an unpredictable world. Yet as anyone who has been on the frontline of attack will tell you, ‘normal’ is often quite horrendous.
Pascal Geenens is a security reseracher and evangelist at Radware.
And normal really could be that bad next year when you look at the world’s big macro challenges. Forthcoming elections, tensions between countries, climate change and social issues like equality and poverty can and will influence how and when companies and organisations are attacked.
It may seem strange to suggest that climate change could influence your security strategy but if your supplier or a partner has any links that hackers take umbrage too then it’s your network they could target too.
These wider threats are all things that should be used to set strategy and identify which of the predictions are worth taking note of. It’s also a chance to consider how the tools we use to fight back could be the very ones that are used against us if in the wrong hands. Developing strategic plans against hacking and malware has never been so complex.
So what are the risks we face?
1. AI and Fake data/disinformation
This is the stuff of fiction, yet sadly it is very much reality. Fake data, disinformation and its dissemination will become an import tool in the cyber arsenal of nation states.
We’ve seen it happen already. It’s disrupted voting and public opinion, and caused misunderstanding and confusion. The truth has lost. There is no doubt in my mind that we will see more of the same. Its use against business and organisations will be prolific next year.
Artificial Intelligence is of course the battle cry to fight back. But it’s also the technology behind the fake data. It’s the catalyst for generating targeted and individualised fake data to influence individuals in every facet of their lives. We must expect that this tactic will be used to influence major political and economic events right through to the Olympics and future World Cups.
Companies will need to look at how they can be a single source of truth and know that there is no risk of information being manipulated.
2. Privacy vs Security imbalance
The balance is turning in favour of privacy over security. How so? Cyber defence is getting exponentially harder and more expensive because of the pervasive growth in dark data and privacy measures (for the technical among you that’s things like cfr Quic, DoH, TLS 1.3, …).
People can hide more easily. It’s becoming more mainstream. It’s sparked by big data breaches and a growing sense of big brother.
This means organisations will need to re-consider how they manage the complexities associated to compliance of legislation and keeping networks secure, in a world where anonymity is growing.
That’s a tough conundrum. How can you ensure security and privacy, and how can you still run a business that delivers high quality customer service and profit to shareholders?
3. Data breaches through stupidity or ignorance will fade out
For many, the first experience with cloud services was a bad one, but this is a prediction to take comfort in. Data breaches caused by storing data publicly, or as a result of bad password management with online storage, will fade out as cloud and service providers put technology in place to prevent this from happening.
They have acknowledged that the managed service on security has been at times inadequate and to keep their infrastructure management and cloud sales growing they need to address the associated security risks. Automation has opened up the door for this.
4. Attack surface of the Cloud and Distributed enterprise
Just when you thought things were getting better something else comes along. It’s well known that the move to hybrid-, multi-, and edge-clouds means the attack surface of organisations is expanding exponentially.
But if you add to this the complexities associated to privacy and managing more dark data, it will become harder to secure the enterprise and maintain visibility of the threats. Every security strategy will need to look at how threats are found, categorised and fought. It’s going to take technology and great skill to get it right, as well as sponsorship from the whole board.
5. Automation is a double-edged sword
We’ve already mentioned that AI and automation is helping to bring down attacks. Its real power comes when it is coupled with deep learning, and explains why it has become the go to strategy for many ground-breaking technologies and solutions and for IT service management.
But for all that positive force, there is a negative: fooling automations will likely lead to the next disaster. What do I mean? Fooling a cars’ autonomous driving capability by slightly altering traffic signs or road markings is a real possibility. In fact, it has already happened.
Imagine the impact on cyber defence systems, weapons of (physical) warfare, planes... It’s probably best not to. But that is the dawn we face. As new ways to poison or influence the decision making of deep learning algorithms are discovered, a new attack surface is forming. So long as we recognise this we have a chance of fighting back.
6. Quantum computing
Finally, quantum computing will become an import part of the security policy of organisations that trade secrets and highly valuable information.
Quantum key generation and distribution as well as quantum encryption will start to be applied. We’ll likely face a scenario of 'better to be safe than sorry’ as the first nations develop quantum computers with enough qubits to crack the planet’s encrypted communications.
But while this last prediction might be sobering, there are some practical things companies can do to get ready. An audit of the attack surface, including suppliers and partners, and every IoT device connected to the network is a good place to start, followed by a skills analysis. Your team has to be ready to think through the complex challenges and devise tactics and strategies that will build solid defences. It is possible with the technology available today. The trick is to invest in the right ones.
Pascal Geenens is a security reseracher and evangelist at Radware.
- Protect yourself against malware online with the best cloud antivirus.
