For cyber security, predicting the future is not nearly as scientific as tracking the next major hurricane or earthquake, but certainly, does follow trends and patterns.While technology evolves from on-premise resources to the cloud, the reality of drone swarms becoming a weaponized medium for attacks, and governments openly performing cyber-attacks, we can see that if it is connected to the net, it is fair game for an attack. Nothing is immune – from cameras and thermostats to alarm systems and mobile devices. It does not matter who owns them either. Everything from personal systems to voting machines are valid attack vectors and, surprisingly, systems not considered worthwhile for an intrusion, become key beach heads for advanced cyber-attacks.
If you consider all these crazy trends, blips in the news about attacks, and the patterns – from password re-use to the rise in usage of end of life systems – predicting the future for cyber security is really not that outrageous. We’ve assembled a crack team of security experts (YouTube video), and here are our thoughts for the forthcoming year…
We have seen cyber-attacks range from disrupting power grids to Stuxnet. 2017 will see the first large-scale attack by a nation, against another sovereign nation, and be acknowledged as an attack and the techniques used considered as weapons (albeit software, malware, vulnerabilities, and exploits).
Re-using passwords is fundamentally one of the most dangerous habitual cyber security human practices. Large-scale breaches from Yahoo and Twitter will help fuel the fire until everyone realizes the dangers of this practice. It will take a few more major incidents in 2017 to raise awareness. Once this happens, people will begin using unique passwords as often as they lock their car doors in a parking lot.
Ongoing threats related to IoT devices will force manufacturers to tighten security layers, including patchable firmware/software, secured authentication, and controlled privilege access. Regulation will be pushed forward for vendor responsibility around IoT device software updates. Today, most IoT devices are considered throw away devices and security patches are not issued. But, new regulations will be driven by large-scale attacks using IoT to amplify the attack as we saw with KrebsonSecurity against an industry that has powerful lobby interests.
One of the largest denial of service (DoS) attacks to date targeted a French service provider and was hosted on mobile smart devices, proving that if it is connected to the Internet, it can be weaponized. Internet-connected devices need to meet minimum security standards just like automotive safety. This type of hack will escalate until legislators step in and provide a plan. We predict that a major hardware manufacturer will disclose vulnerabilities that are in firmware of devices they ship. Until then, IoT devices will be released with all sorts of flaws and potential exploit vectors, and many of them will be used to conduct malicious activity.
Speaking of DoS attacks, following constant DDoS attacks above the 500GB mark, a new startup that directly attacks and patches botnet systems will launch in an unregulated country. This attack/defense service will be directly responsible for patching a hundred million hosts.
Driven to ensure their products are not compromised by ever-more sophisticated cybercrimes, companies such as Apple and Lenovo will start to release products that have biometric sensors built into the touchpad. This will enable the integration of tools and technologies that advance the concept of biometric/facial recognition into areas like typing speed, pressure and other behavioral-type detection systems.
Identity will continue to be a focal point for security as credentials being used in highly visible attacks combined with mobility, cloud deployments and increased regulation drive awareness and allocation of dollars. Organizations will continue to look at adaptive- and behavior-based authentication to balance security and operational concerns.
Since the government has infiltrated the Tor network, a few large companies will start to setup cross-country file transfer networks that have terabytes of bandwidth and the equivalent of exit nodes everywhere. This “Tor v2”-type experience will start to be included in most releases of Google software and will move us toward a network that is fully encrypted and clear-text at all times.
More companies will get aggressive with outdated software and will do direct checks to make sure software is in compliance. A hard stance on outdated software accessing banking systems knocks user acceptance down 40 percent but increases the purchase of new computers, Chrome books, mobile devices, and tablets because they are much more secure than old, outdated computer systems.
We will continue to see the majority of attacks beginning with an exploit taking advantage of a known vulnerability where a patch has been readily available. Ongoing and timely patch and shielding processes continue to be a challenge.
We will see attacks targeting cloud management platforms, workloads, and enterprise SaaS applications, causing organizations to expand their privileged access management budget allocation beyond traditional desktops and servers.
Sarah Conner (Terminator) said, “The future has not been written. There is no fate but what we make for ourselves.” As security experts, we develop defensive and offensive strategies to combat cyber-attacks and these predictions will probably come true in the next year or so simply based on the trends that appear every day in our industry. As the end of the year approaches now is the time to evaluate your cyber security practices!
So, how do these predictions jive with your own? Let us know!