Biggest Cybersecurity Threats In 2016

Headless worms, machine-to-machine attacks, jail-breaking, ghostware and two-faced malware: The language of cybersecurity incites a level of fear that seems appropriate, given all that's at stake.

In the coming year, hackers will launch increasingly sophisticated attacks on everything from critical infrastructure to medical devices, said Fortinet global security strategist Derek Manky.

"We are facing an arms race in terms of security," said Manky. Fortinet provides network security software and services, and its customers include carriers, data centers, enterprises, distributed offices and managed security service providers.

Here's how the 2016 threat landscape looks to some experts:

Research firm Gartner predicts there will be 6.8 billion connected devices in use in 2016, a 30 percent increase over 2015. By 2020, that number will jump to more than 20 billion connected devices, predicts Gartner. Put another way, for every human being on the planet, there will be between two and three connected devices (based on current U.N. population projections).
The sheer number of connected devices, or the "Internet of Things," presents an unprecedented opportunity for hackers. "We're facing a massive problem moving forward for growing attack surface," said Manky.
"That's a very large playground for attackers, and consumer and corporate information is swimming in that playground," he said. Many consumer connected devices do not prioritize security. As they proliferate, expect the number of attacks to skyr
 
In its 2016 Planning Guide for Security and Risk Management, Gartner puts it like this: "The evolution of cloud and mobile technologies, as well as the emergence of the 'Internet of Things,' is elevating the importance of security and risk management as foundations."

Smartphones present the biggest risk category going forward, said Manky. They are particularly attractive to cybercriminals because of the sheer number in use and multiple vectors of attack, including malicious apps and web browsing.

"We call this drive-by attacks — websites that will fingerprint your phone when you connect to them and understand what that phone is vulnerable to," said Manky.

Apple devices are still the most secure, said Manky. "Apple's had a good security policy because of application code review. So that helps, certainly, to filter out a lot of these potential malicious applications before they make it onto the consumer device,…With that, nothing is ever safe," he said.

The new-year will likely bring entirely new worms and viruses able to propagate from device to device, predicts Fortinet. 2016 will see the first "headless worms" — malicious code — targeting "headless devices" such as smart watches, smartphones and medical hardware. "These are nasty bits of code that will float through millions and millions of computers," said Manky.

Of course, the potential for harm when such threats can multiply across billions of connected devices is orders of magnitude greater.

"The largest we've seen to date is about 15 million infected machines controlled by one network with an attack surface of 20 billion devices. Certainly that number can easily spike to 50 million or more," said Manky. "You can suddenly have a massive outage globally in terms of all these consumer devices just simply dying and going down."
 
Expect a proliferation of attacks on cloud and cloud infrastructure, including so-called virtual machines, which are software-based computers. There will be malware specifically built to crack these cloud-based systems.

"Growing reliance on virtualization and both private and hybrid clouds will make these kinds of attacks even more fruitful for cybercriminals," according to Fortinet.

At the same time, because apps rely on the cloud, mobile devices running compromised apps will provide a way for hackers to remotely attack public and private clouds and access corporate networks.

Firms need to stop thinking just about cyberattack deterrence, and focus on detecting breaches early and often, says Hitesh Sheth, CEO of Vectra Networks.

As law enforcement boosts its forensic capabilities, hackers will adapt to evade detection. Malware designed to penetrate networks, steal information, then cover up its tracks will emerge in 2016. So-called ghostware will make it extremely difficult for companies to track exactly how much data has been compromised, and hinder the ability of law enforcement to prosecute cybercriminals.

"The attacker and the adversaries are getting much more intelligent now," said Manky.

Alongside ghostware, cybercriminals will continue to employ so-called "blastware" which destroys or disables a system when detected. "Blastware can be used to take out things like critical infrastructure, and it's much more of a damaging attack," he said.
"Because attackers may circumvent preventative controls, detection and response capabilities are becoming increasingly critical," advises Gartner in its report.

Many corporations now test new software in a safe environment called a sandbox before running it on their networks. "A sandbox is designed to do deeper inspection to catch some of these different ways that they're trying to change their behaviors," said Manky. "It's a very effective way to look at these new threats as we move forward."

That said, hackers in turn are creating malevolent software that seems benign under surveillance, but morphs into malicious code once it's no longer under suspicion. It's called two-faced malware.

This is at least partially the sheer volume of attacks is so high — Fortinet sees half a million security threats per minute.

"The reason we see so much volume as well is because cybercriminals are trying to evade [detection]. They know about security vendors, they know about law enforcement, they're trying to constantly morph and shift their tactics," said Manky.

"Companies should definitely enforce more security policies," said Manky. "Security's becoming a board level discussion, so that's already happening, and it should continue to happen."
Part of any cybersecurity strategy should be the use of antivirus software, the education of employees not to click on unknown attachments or links as well as keeping software up to date, also know as patch management.

"A lot of these devices are not going to be patched that quickly or they might not have an update mechanism on them," said Manky. "Certainly, any time a patch becomes available, companies should enforce that because these are closing a lot of the holes where attackers are navigating through."

Here is how Gartner frames it for business seeking to protect themselves in 2016. "While some traditional controls have or will become less effective, techniques such as removing administrative privileges from endpoint users should not be forgotten. Similarly, vulnerability management, configuration management and other basic practices have to be priorities in organizations that have not yet implemented them effectively."

And ultimately, something is better than nothing, advises the firm: "Addressing priorities does not mean striving for perfection, but rather ensuring, at least, that critical exposures are remediated (or, if applicable, mitigated with compensating controls) and that the residual risks are minimal and acceptable (or at least enumerated and tracked)."

CNBC: http://cnb.cx/1mLqnto

« Cyberwar: Islamic State, Russia & China Hold The Advantage
ISIS Secret Cyber Terrorism Forum Exposed »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Cloud Industry Forum (CIF)

Cloud Industry Forum (CIF)

Cloud Industry Forum is a non-profit industry body that champions and advocates the adoption and use of Cloud-based services by businesses and individuals.

IoTium

IoTium

Secure Cloud Managed Software Defined IoT Networks. IoTium simplifies establishing and managing secure network infrastructure for Industrial IoT.

Mocana

Mocana

Mocana provides a software platform that allows you to develop, test and distribute more secure IoT devices and services.

PakCERT

PakCERT

PakCERT is the national Computer Emergency Response Team for Pakistan.

Greenbone Networks

Greenbone Networks

Greenbone Networks delivers a vulnerability analysis solution for enterprise IT which includes reporting and security change management.

Black Kite

Black Kite

Black Kite (formerly NormShield) provides comprehensive Security-as-a-Service solutions focused on cyber threat intelligence, vulnerability management and continuous perimeter monitoring.

ESNC

ESNC

ESNC’s vulnerability management and real-time SAP security monitoring solutions help largest corporations in the world to effectively prioritize SAP security tasks and secure their business.

Polyrize

Polyrize

The Polyrize continuous authorization platform for SaaS and IaaS stops tomorrow's public cloud cyber threats, today.

Brimondo

Brimondo

At Brimondo we help you to maximize and protect your brand value by being a proactive and strategic partner within brand protection with experts within intellectual property and digital assets.

CYMOTIVE Technologies

CYMOTIVE Technologies

Combining Israeli cyber innovation with a century of German automotive engineering. CYMOTIVE operates under the assumption that connectivity is a game changer for the automotive industry.

Trenton Systems

Trenton Systems

Trenton Systems are committed to providing high-performance computing solutions to customers running mission-critical applications in harsh settings worldwide and across various industries.

CryptoDATA

CryptoDATA

CryptoDATA develops products and services based on Blockchain technology, that ensure user security and data encryption, applicable in various fields.

Armolon

Armolon

Armolon provides comprehensive data breach and cybersecurity, as well cybersecurity audits and certifications, and disaster recovery/business continuity services to clients.

ANSSI Burkina Faso

ANSSI Burkina Faso

ANSSI is responsible for managing the security of information systems and cyberspace in Burkina Faso.

Qevlar AI

Qevlar AI

Qevlar AI empowers SOC teams, to eliminate redundant tasks and refocus on what truly matters - making the most of every employee within the SecOps team.

Saidot

Saidot

Saidot is a Finnish AI governance and alignment company committed to helping businesses safely and transparently integrate AI into their operations.