With an estimated 4 billion records breached so far this year, it is safe to say that 2019 has been a very eventful year for the cybersecurity industry. Reported data breaches in 2019 have topped last year’s record of over 6,500 breaches reported and predictions are showing that attacks, and therefore possible breaches, are not slowing down. With the new year upon us, I wanted to highlight some key takeaways and share a few predictions the cybersecurity industry can possibly expect in 2020. The list below is not all-encompassing and you will find a wide variety of predictions on the internet depending on the focus of the article. There are some commonalities, which are below:
We have seen plenty of headlines this year regarding this topic (Anyone remember the Capitol One breach?). Though most security experts feel that infrastructure in the cloud is more secure than what enterprises have built for themselves on-premise, given the amount of security personnel and resources public cloud providers have access to, many organizations are still overlooking fundamental secure best practices in the cloud. Firms are still liable for securing everything on top of the infrastructure, see this security responsibility model, and human errors during the configuration process can provide adversaries with an easy way into their environment. Headlines will continue to pop up unless organizations begin to take a serious security-focused approach when migrating to the cloud.
Ransomeware, which is malicious software that locks up a victim’s device and data in exchange for money, has been the most dominating type of attack this year. You might have heard of some incidents taking place this year that involved this type of attack, such as the recent breach that forced New Orleans to declare a state of emergency. According to the 2019 Verizon Data Breach Investigation Report, ransomware accounts for 24% of incidents where malware was used. That number may not seem huge, but compare it to the 5% statistic this attack had in 2018. The number is expected to increase, with small-business owners and unprepared smaller cities as a target. Here are some eye-opening statistics:
- Ransomware attacks are estimated to cost $6 trillion annually by 2021.
- 50% of surveyed 582 information security professionals do not believe their organization is prepared to repel a ransomware attack.
- Businesses lost around $8,500 per hour due to ransomware-induced downtime.
- 30% of organizations that pay the ransom receive all of their money back.
MOBILE DEVICE ATTACKS
Today, nearly everyone has a mobile device on them – it has become a necessary evil in order to keep our lives seamless. There is an app for, literally, everything. Bored? Play Candy Crush. Need to calm down? There are meditation apps. Want to learn how to run a marathon? There’s an app for that. So it is easy to see how mobile devices have become a prime target for attackers. Mobile devices store a ton of sensitive, personal data and sometimes even important business data. Data that hackers want, and have been attempting to steal, by delivering malware (malicious code) through rogue applications you download from the App Store. Researchers at Check Point examined cyberattacks in the first half of 2019 and found that those targeting smartphones and other mobile devices have risen by 50% compared with last year. The report suggests one of the key reasons for the sharp rise is the increased use of using your phone for banking transactions. This has seen cybercriminals following the money and increasingly distributing malware designed to steal payment data, login credentials, and ultimately funds from victims’ bank accounts.
TARGETED PHISHING ATTACKS
Have you ever received an email claiming to be a long lost prince and they want to send you a million dollars out of the kindness of their hearts? All they require is for you to email back your full name, social security number, and banking information in order to catch this blessing? Well, that my friends is a phishing attempt. Phishing attacks continue to be one of the biggest IT security threats, as unsuspecting users continue to fall prey, taking the bait from well-crafted business email compromise (BEC) attacks, phishing emails, and malicious URLs. These days, attackers are not as clumsy and forth-right with trying to steal your information. They are actually pretty crafty at creating emails that look exactly as if it came from your bank or another company. Take this hotels.com email offering a coupon. If you are an avid traveler, you probably wouldn’t think twice about clicking this email – which is what attackers want.
Attackers are looking for an increase in their success rates and therefore taking the time to craft very-hard-to-spot phishing attempts.
THIRD-PARTY SUPPLIER RISK
Organizations are no longer siloed and integrations with other companies to supply service has drastically increased. A survey by One Identity has shown that 94% of organizations have granted third-party access to their network and 72% of them grant privileged access. Yet only 22% felt confident those third parties weren’t accessing unauthorized information, while 18% reported a breach due to third-party access. Attackers are now looking to breach major targets through indirect methods, i.e third parties, rather than attack the major target itself. For example, do you remember the Target breach that happened a few years ago? Attackers did not get into Target directly; instead, they were able to steal the credentials of an HVAC contractor (third party) that worked for Target and other major retailers and use those stolen credentials to infiltrate Target. This method is sort of like “low hanging-fruit” where the hacker is hoping that smaller businesses (such as that contractor) do not have proper security measures or processes so they can steal much easier in order to gain unauthorized access to bigger targets.
DISTRIBUTED DENIAL OF SERVICE ATTACKS (DDoS)
The rise of 5G technology and Internet of Things (IoT) devices are contributing to the rise in DDoS attacks happening. A DDoS attack is one where an attacker attempts to make a resource unavailable (for example, a website such as www.BuyJewleryHere.com ) to its intended users (customers) by flooding the resource to overwhelm or shut down its bandwidth. Examples of this were seen in 2019 when various social media platforms were down for a period of time unexplainably. IoT (Internet of Things) devices are exploding right now. I am sure you have seen an example of such a device, such as smart locks, smart bulbs or even smart fridges. These devices connect to the internet, exposing your device to potential risks. With devices connecting by the hundreds of thousands each day, and the possibility of smart cities on the horizon, it is definitely possible to see more DDoS attacks happening in 2020 as attackers look to take down the interweb of connected devices.
All in all, it is safe to say that Cybersecurity is on the minds of everyone these days – allies and adversaries alike. As we think about what lays ahead in the New Year, despite if you work in the field or not, it important that you think about security measures as well. Attackers are no longer just trying to target the big guys – they care about getting your information as well. Read this article for some tips on cyber hygiene and how the everyday person can deploy additional security measures to keep their information secure. As always, stay safe and secure!