As cyber attackers become more sophisticated, organisations and cyber security experts become better at dealing with threats. And as cyber security evolves, so too does the ingenuity of the cyber criminal. It’s not quite chicken-and-egg, but rather an ongoing cycle of improvement on both sides.
That’s not to say that the cyber attackers are winning; it just means in the current threat landscape businesses need to do all they can to mitigate the risk to their operations and customers, whether that’s from running the latest antivirus software, to having to deal with ransomware, DDoS, or a data breach. Especially when it comes to the fallout of these attacks.
Looking back at 2019, there were a number of high-profile security breaches, but it was GDPR that stole the headlines. In July we saw the first fines handed out as a consequence of the EU regulation. Marriott hotel group was fined nearly £100m after losing personal and credit card data in a massive hack of its guest records; while British Airways received an £183m fine for a similar data breach.
Anthony Young, Director at Bridewell Consulting.
So, what are we in for in 2020? How will the threat landscape change and what should businesses look out for when putting together their cyber security strategies for the new year? Here are our five predicted trends for next year:
Greater risk in the cloud
Security has long been a challenge to cloud services. While it has been largely overcome, with the sharp increase in moving workloads to public cloud, there will be increased opportunity for hackers to use some aspect of technology to hack a business.
In part, it is the convenience of cloud that increases the risk, such as single-sign-on functionality used by many software-as-a-service (SaaS) based applications, as well as PaaS and IaaS, making it easier for hackers to gain access to the wider business.
Look at Office 365 as an example; Microsoft has included a number of security features within the product but it’s still down to the business to make sure they are implemented. Through lax folder permissions or phishing attacks, hackers can gain access to accounts and then the rest of the corporate network.
Bigger, better, more attacks
The more data there is in cyber space, the greater the risk for businesses and bigger the opportunity for hackers. It stands to reason the more data growth, the more attacks. Plus, as organisations continue to integrate systems and applications, cyber attacks will become far wider reaching. For example, in the past a DDoS attack, could take down an organisation’s website. While this could be devastating, the business could at least still operate in other areas, talking to customers and suppliers, etc. Now, a DDoS attack has the potential to take down the whole company.
Moving forward, we will see more cyber attacks impacting the entire business. Using the organisation’s connectedness against it, hackers can take down a website, revoke access to key documents, systems and applications, and even cut lines of communication.
AI and machine learning; smarter defence, smarter malware
There’s both a positive and negative element to the use of machine learning and artificial intelligence (AI). It’s already being used in endpoint security solutions, automating activities that used to be laborious manual tasks that human analysts needed to carry out. AI adds tremendous value in stopping threats and mitigating risk. In 2020 and beyond, it will be used a lot more as it matures, the depth of coverage broadens and barriers, such as cost, are overcome.
In the same vein, cyber criminals will use AI and machine learning more in the development of malware. This will be seen increasingly in self-evolving code where malware adapts and learns from past behaviours; for example, if a particular behaviour gets it blocked from an organisation’s network it will change that behaviour and try another approach.
The growth of social media as a weapon
Social media has long been a treasure trove of information for cyber criminals targeting businesses. It’s a key tool in social engineering, helping attackers identify staff, get an understanding of the organisation, its reporting structure, culture, the way they talk, office locations and even security systems, such as access control, through posts and photos on social media platforms. It will also be used more and more to craft spear phishing attacks, for example getting employees to click on links or extract their passwords and usernames.
In 2020 we will see social media move away from being primarily an intelligence gathering tool to being a threat vector itself; a mechanism to deliver attacks, be it delivering malware or sophisticated phishing attacks.
More connections, more vulnerabilities; the role of IoT and 5G
As costs come down, IoT adoption will rise next year, especially in the corporate environment. These connected devices are becoming less “nice to haves” and more expected in business. With more devices connected to the internet via 5G, the more opportunity cyber attackers will have to compromise systems and networks. And while we’ve seen an increase in IoT-enabled office spaces, we haven’t necessarily seen the same rise in security around them.
Beyond 2020
While identifying trends and keeping abreast of developments in cyber security are important, so too is getting the basics right. You still need a solid foundation to build your layered cyber security strategy on. This means paying attention to patching, staff cybersecurity training and being aware of using out of date software that is no longer supported by the developer, such as Windows Server 2008 and Windows 7. Developing a good cyber security posture may be a moving target, but mitigating risk and protecting your organisation is achievable.
- Protect your business with the best cloud antivirus.
