Each new year hails the latest slew of predictions for all sectors of business, with cyber security becoming one of the hottest topics around the world as companies of all sizes, operating in an array of sectors, scramble not to be the next headline.
Will it be a case of "same old" on the cyber security front? I would say definitely not as cyber criminals appear to be able to come up with new threats and keep pace with emerging technologies that have been developed specifically to keep them out.
Interestingly, it is predicted that 2019 will see smaller companies enlisting the same cyber security approaches as deployed by large corporations, which in turn is likely to mean leveraging the benefits of a robust security operations centre.
Previously regarded as hackers' low-hanging fruit, small to midsize businesses are expected to find ways to detect threats and respond timeously. The impetus to do so may well be accelerated by larger organisations, which may start demanding the businesses they work with meet certain cyber security standards.
For example, Forbes predicts that while breaches within huge corporations will continue to grab the headlines, businesses of every size are under attack, especially in industries like healthcare, law and finance which, by trade, store and manage vast amounts of sensitive data.
Cyber criminals are already effectively upgrading IOT-based botnets with swarm-based technology to make their attacks more efficient.
ITWeb reports that biometric hacking, an increase in phishing attacks and sophisticated use of artificial intelligence (AI) will be among the top cyber security threats in 2019.
As attack vectors, techniques and types quickly adapt and change in response to network protection policies, each attack type warrants a conversation about how it continues to develop and stay relevant as technology evolves.
In fact, each year new attack types and the advancement of old techniques reveal specific themes. The 2018-2019 Radware Global Application and Network Security Report highlights trends in different years, such as 2017 was the ransom year that saw campaigns like WannaCry wreak havoc; whereas 2018 proved to be the year of automated incidents, with sensational attacks on APIs (85%, according to the Radware research) especially bot attacks.
Hackers took advantage of the ability to leverage weaponised artificial intelligence, both for enhanced speed of decisions and the defeat of cyber security tools.
What will the 2019 cyber security landscape look like?
Predictions include a massive security attack on the public cloud that will shake the confidence of all users. Ransomware is expected to hijack the Internet of things (IOT); nation/state availability-based attacks are estimated to increase, as are distributed denial-of-service (DDOS) attacks, swarmbots and hivenets.
The latter two may sound like an alien invasion in a B-grade movie but the reality is that cyber criminals have embraced the bot concept. Over the years, we have seen the development and deployment of massive IOT-based botnets, built around thousands of compromised IOT devices. Most of these weaponised botnets have been used in cyber attacks to knock out devices or services in a relatively straightforward manner.
Cyber criminals are already effectively upgrading IOT-based botnets with swarm-based technology to make their attacks more efficient.
2019 should see even greater adoption of the public cloud as part of enterprises' IT infrastructure as a way to deliver services and run applications efficiently. This in turn generates a greater need to prevent breaches and ensure data and process integrity.
What about ransomware hijacking IOT?
This is a very profitable high-tech business for criminals. It can range from encrypting victims' data and asking for payment to release it, or attacking through DDOS and demanding payment to release services. Examples include the hijacking of stock trading services, video or music services, emergency services or AI-enabled services.
IOT device ransom is similar to a hijack ransom, except the attackers go after the device itself. Any device connected to the Internet is susceptible to security lapses. The market will soon determine if users are willing to pay on the spot to regain control of IOT devices.
Health ransom/tech hostage is probably one of the most disturbing ransom attacks, as it is one that seeks to take advantage of people who are dealing with health issues. Many ailments are treated with cloud-based monitoring services, IOT-embedded devices and self or automated administration of prescription medicines. Common ransom attacks could establish a foothold in the delivery of health services and put people's lives at risk.
In South Africa, we don't have to look too far to understand what the rise of nation-state availability-based attacks means. Techniques in this arena include Internet outages, such as those we saw recently in Zimbabwe during protests about fuel hikes.
If growth of attack surfaces, techniques and means continues into 2019 through various hits on automated technologies, the best years of system security may well be behind us. As we constantly strive for cyber serenity, peace in cyberspace seems an optimistic, yet unrealistic hope. The one certainty is that 2019 will bring the next phase of threat evolution.
Unfortunately, our collective behaviour creates more network breach opportunities for both individual and organised groups of hackers. As long as there is no clear stance on topics such as a cyber security privacy Bill, the status of virtual currencies as a means of trade, the responsibility for hardening vulnerable IOT devices and the existence of fictitious identities, the tug-of-war game will continue with each side exploiting the vulnerabilities of the other.
Share