Five Cybersecurity Predictions for 2017

To call 2016 ‘eventful’ in the IT Security space would be an understatement. 

The enterprise security Ninjas at Tanium list their top five predictions for cybersecurity in the year ahead.

From Mirai to ransomware and NSA shadow brokers to Yahoo!, this year introduced new threats birthed from age-old challenges. Given the unique turbulence of 2016, and the industry’s overall failure to manage and protect networks any better than the year prior, the year ahead will be an important opportunity for changing how the world understands and approaches defending our most precious information. 

To that end, read on for our five predictions for a year that will certainly prove to be a lot more than eventful.

1.    Criminals and threat actors will increasingly leverage vulnerabilities in IoT devices to conduct DDoS and other attacks

The impactful attack against the Internet infrastructure company Dyn in October signaled a long-expected evolution of the underlying technologies that can be exploited and leveraged to launch Distributed Denial of Service (DDoS) attacks that benefit from economies of scale. Connected, Internet of Things (IoT) devices that are insecure by design are coming online en masse, in both homes and businesses, while available bandwidth likewise continues to grow. The Dyn attack demonstrated that bringing down a carefully selected set of targets can yield highly-visible and impactful outages.

2.    Machine learning won’t be the security silver bullet many expect it to be

Approaches for machine learning are evolving at a fast pace and, when used effectively, can provide organizations with powerful tools to help automate attack detection and response at-scale. Unfortunately, machine learning is also often misunderstood, and increasingly, mislabeled to generate hype for a product’s claimed capabilities.

Machine learning is not a general purpose solution to all shapes and size of security-relevant data, nor is it always superior to other forms of data analytics. Certain specific use-cases provide ample opportunity for unsupervised and minimally supervised learning that can be critical to an effective solution that makes the “right” decisions on its own. 

Others may appear effective in controlled lab scenarios and test cases, but fail amidst the chaos and noise of most large enterprise networks. The latter is particularly challenging to prove out during a typical vendor evaluation process.

3.    Nation states will expand their use of hacking as a mechanism for influencing the media, public opinion, and public policy.

2016 was the year of misinformation on the Internet. The hacks on the World Anti-Doping Agency, Democratic National Committee, and prominent political figures focused on obtaining and selectively disclosing information, not disrupting systems. 

The attacks, perpetrated by what is believed to be Russian state sponsored hackers, demonstrated Russia’s willingness to use cyber espionage to influence world events, gain crucial information, and sow distrust and discord in the democratic process. Fake news sites and use of groups like WikiLeaks, DC Leaks, and Cyber Hunta to wage an information war aimed at discrediting sovereign governments proved to be a powerful, and effective weapon.

We will see an increase in nation-state hacks aimed at influencing world events and politics. This includes increasing use of the Internet to spread both damaging facts and misinformation.

4.    Healthcare attacks will continue, but increased HIPAA oversight won’t jolt the industry

Data-rich healthcare records are becoming one of the hottest commodities on the dark web, and it shows. After the rampant ransomware attacks throughout 2016, healthcare is now the number one industry target for threat actors. New compliance mandates are coming in 2017: The US Department of Health and Human Services Office for Civil Rights (OCR) is increasing funding for HIPAA audits in 2017 by as much as 50%. 

But increased HIPAA fines this year did little to curb attacks, and audits won’t move the needle. In the field, we see organisations with limited budgets, layers of antiquated legacy software and hardware that can’t be immediately replaced, and a priority to consider whether each dollar spent on technology is worth taking away from saving lives. Put simply, hospitals first need to get the basics right and make healthcare systems more resilient as upgrades occur. The vast majority of breaches, even those involving advanced threats, could be prevented with basic security hygiene.

5.    Companies will wake up to overspending and pare down IT Security tools, creating industry consolidation

In 2017, we’ll see the number of cybersecurity players begin to contract. During the past decade, the incumbent monolithic Managed Security Service Providers (MSSP) largely failed to adequately detect or protect against the first wave of targeted attacks, which gave rise to specialty firms focused on so-called Advanced Persistent Threats (APT). 

Today, as companies review their security and IT operating budgets for 2017, they may find that they’ve committed to a laundry list of security services: threat intelligence feeds, vulnerability management feeds, managed security operations, cloud security solutions, managed attack defense and incident response, specialised “attack simulation” and penetration testing, and a bevy of EDR and network security applications that follow a service-driven delivery model. 

As companies wake up to this overspending, we’ll see them reduce the number of vendors, creating industry consolidation.

Tanium:                     McAfee Labs Six Cyber Predictions For 2017:

 

« Police Connectivity: In-Car Video & Body Cameras
German Police Will Squash Fake Online News »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Cyberis

Cyberis

Cyberis are pioneers in customer-focussed information security. Since 2011, we’ve been helping businesses protect their brands, customers and reputation.

National Centre of Incident Readiness & Strategy for Cybersecurity (NISC) - Japan

National Centre of Incident Readiness & Strategy for Cybersecurity (NISC) - Japan

NISC was established as a secretariat of the Cybersecurity Strategy Headquarters in collaboration with the public and private sectors to create a "free, fair and secure cyberspace" in Japan.

Cybonet

Cybonet

Cybonet is committed to empowering organizations of all sizes with the tools and capabilities to detect and engage cyber security threats.

TeachPrivacy

TeachPrivacy

TeachPrivacy provides computer-based privacy and data security training that is engaging, memorable, and understandable.

Sqreen

Sqreen

Sqreen is a web application security monitoring and protection solution helping companies protect their apps and users from attacks.

Blaze Information Security

Blaze Information Security

Blaze Information Security is a privately held, independent information security firm born from years of combined experience and international presence.

URS Certification

URS Certification

United Registrar of Systems (URS Certification) is an independent certification body operating in more than 30 countries within the multinational URS Holdings.

ISMAC

ISMAC

ISMAC was founded to create a security solution that would work for smaller to medium as well as bigger corporations at an affordable price.

vCISO Services

vCISO Services

vCISO Services is a small, specialized, veteran-owned firm focused on the needs of SMBs only.

eaziSecurity

eaziSecurity

eaziSecurity has built an eco-system of technology and services that bring enterprise scale security solutions to the SME marketplace.

Hexens

Hexens

Hexens introduces a whole new approach to cybersecurity solutions. Indisputable skills and a unique super-focused perspective on every single case are the values we create.

Crayon

Crayon

Crayon is a customer-centric innovation and IT services company. We provide guidance on the best solutions for our clients’ business needs and budget with software, cloud, AI and big data.

TrafficGuard

TrafficGuard

TrafficGuard is an award-winning digital ad verification and fraud prevention platform.

B2Bcert

B2Bcert

B2BCERT one of the top companies offering ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO 27001, ISO 20000,CE Marking, HACCP, and other globally accepted standards and Management solutions.

InnovateHer

InnovateHer

At InnovateHer, our vision is to make the tech sector more equitable, by increasing diversity across the spectrum and creating more inclusive workplaces.

Resonance Security

Resonance Security

Resonance offers powerful cybersecurity aggregation software that makes protecting against full spectrum cybersecurity threats effortless no matter what your technical level, budget, or scope.