Five Cybersecurity Predictions for 2017

To call 2016 ‘eventful’ in the IT Security space would be an understatement. 

The enterprise security Ninjas at Tanium list their top five predictions for cybersecurity in the year ahead.

From Mirai to ransomware and NSA shadow brokers to Yahoo!, this year introduced new threats birthed from age-old challenges. Given the unique turbulence of 2016, and the industry’s overall failure to manage and protect networks any better than the year prior, the year ahead will be an important opportunity for changing how the world understands and approaches defending our most precious information. 

To that end, read on for our five predictions for a year that will certainly prove to be a lot more than eventful.

1.    Criminals and threat actors will increasingly leverage vulnerabilities in IoT devices to conduct DDoS and other attacks

The impactful attack against the Internet infrastructure company Dyn in October signaled a long-expected evolution of the underlying technologies that can be exploited and leveraged to launch Distributed Denial of Service (DDoS) attacks that benefit from economies of scale. Connected, Internet of Things (IoT) devices that are insecure by design are coming online en masse, in both homes and businesses, while available bandwidth likewise continues to grow. The Dyn attack demonstrated that bringing down a carefully selected set of targets can yield highly-visible and impactful outages.

2.    Machine learning won’t be the security silver bullet many expect it to be

Approaches for machine learning are evolving at a fast pace and, when used effectively, can provide organizations with powerful tools to help automate attack detection and response at-scale. Unfortunately, machine learning is also often misunderstood, and increasingly, mislabeled to generate hype for a product’s claimed capabilities.

Machine learning is not a general purpose solution to all shapes and size of security-relevant data, nor is it always superior to other forms of data analytics. Certain specific use-cases provide ample opportunity for unsupervised and minimally supervised learning that can be critical to an effective solution that makes the “right” decisions on its own. 

Others may appear effective in controlled lab scenarios and test cases, but fail amidst the chaos and noise of most large enterprise networks. The latter is particularly challenging to prove out during a typical vendor evaluation process.

3.    Nation states will expand their use of hacking as a mechanism for influencing the media, public opinion, and public policy.

2016 was the year of misinformation on the Internet. The hacks on the World Anti-Doping Agency, Democratic National Committee, and prominent political figures focused on obtaining and selectively disclosing information, not disrupting systems. 

The attacks, perpetrated by what is believed to be Russian state sponsored hackers, demonstrated Russia’s willingness to use cyber espionage to influence world events, gain crucial information, and sow distrust and discord in the democratic process. Fake news sites and use of groups like WikiLeaks, DC Leaks, and Cyber Hunta to wage an information war aimed at discrediting sovereign governments proved to be a powerful, and effective weapon.

We will see an increase in nation-state hacks aimed at influencing world events and politics. This includes increasing use of the Internet to spread both damaging facts and misinformation.

4.    Healthcare attacks will continue, but increased HIPAA oversight won’t jolt the industry

Data-rich healthcare records are becoming one of the hottest commodities on the dark web, and it shows. After the rampant ransomware attacks throughout 2016, healthcare is now the number one industry target for threat actors. New compliance mandates are coming in 2017: The US Department of Health and Human Services Office for Civil Rights (OCR) is increasing funding for HIPAA audits in 2017 by as much as 50%. 

But increased HIPAA fines this year did little to curb attacks, and audits won’t move the needle. In the field, we see organisations with limited budgets, layers of antiquated legacy software and hardware that can’t be immediately replaced, and a priority to consider whether each dollar spent on technology is worth taking away from saving lives. Put simply, hospitals first need to get the basics right and make healthcare systems more resilient as upgrades occur. The vast majority of breaches, even those involving advanced threats, could be prevented with basic security hygiene.

5.    Companies will wake up to overspending and pare down IT Security tools, creating industry consolidation

In 2017, we’ll see the number of cybersecurity players begin to contract. During the past decade, the incumbent monolithic Managed Security Service Providers (MSSP) largely failed to adequately detect or protect against the first wave of targeted attacks, which gave rise to specialty firms focused on so-called Advanced Persistent Threats (APT). 

Today, as companies review their security and IT operating budgets for 2017, they may find that they’ve committed to a laundry list of security services: threat intelligence feeds, vulnerability management feeds, managed security operations, cloud security solutions, managed attack defense and incident response, specialised “attack simulation” and penetration testing, and a bevy of EDR and network security applications that follow a service-driven delivery model. 

As companies wake up to this overspending, we’ll see them reduce the number of vendors, creating industry consolidation.

Tanium:                     McAfee Labs Six Cyber Predictions For 2017:

 

« Police Connectivity: In-Car Video & Body Cameras
German Police Will Squash Fake Online News »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Security Mentor

Security Mentor

Security Mentor provides innovative, online security awareness training designed for how people learn and work.

SentinelOne

SentinelOne

SentinelOne is a pioneer in delivering autonomous security for the endpoint, datacenter and cloud environments to help organizations secure their assets with speed and simplicity.

NITA Uganda (NITA-U)

NITA Uganda (NITA-U)

NITA-U has put in place the Information security framework to provide Uganda with the necessary process, policies, standards and guideline to help in Information Assurance.

Sky Republic

Sky Republic

Sky Republic offers a Smart Contract Platform to integrate and synchronize business networks beyond EDI and API.

astarios

astarios

astarios provide near-shore software development services including secure software development (DevSecOps), quality assurance and testing.

Cybersecure Policy Exchange (CPX)

Cybersecure Policy Exchange (CPX)

Cybersecure Policy Exchange is a new initiative dedicated to advancing effective and innovative public policy in cybersecurity and digital privacy.

Aversafe

Aversafe

Aversafe provides individuals, employers and certificate issuers around the world with a first line of defense against credential fraud.

Kennedys

Kennedys

Kennedys is a global law firm with expertise in litigation/dispute resolution and advisory services, particularly in the insurance/reinsurance and liability sectors, including cyber risk.

Guidepost Solutions

Guidepost Solutions

Guidepost Solutions are a diverse, global team of investigators, experienced security and technology consultants, and compliance and monitoring experts.

Tailscale

Tailscale

Tailscale is a VPN service that makes the devices and applications you own accessible anywhere in the world, securely and effortlessly.

Cynical Technology

Cynical Technology

Cynical Technology is a Nepalese cybersecurity company with expertise in security consulting, auditing, testing and compliance.

Radix Technologies

Radix Technologies

Radix offer end-to-end device management solutions, consolidating all the organization devices, processes and stakeholders into one easy-to-use management platform.

Sequentur

Sequentur

Sequentur is an award-winning Managed IT Services company. We are SOC 2 certified and provide Managed IT Services and Cybersecurity services to businesses nationwide.

Defence Innovation Accelerator for the North Atlantic (DIANA)

Defence Innovation Accelerator for the North Atlantic (DIANA)

The NATO DIANA accelerator programme is designed to equip businesses with the skills and knowledge to navigate the world of deep tech, dual-use innovation.

White Knight Labs

White Knight Labs

White Knight Labs is a cyber security consultancy that specializes in cybersecurity training.

LevelBlue

LevelBlue

LevelBlue simplify cybersecurity through award-winning managed security services, experienced strategic consulting, threat intelligence and renowned research.