Industry executives and experts share their predictions for 2019. Read them in this 11th annual VMblog.com series exclusive.
Contributed by Javvad Malik, security advocate, AlienVault
Looking Back a Decade, to Predict 2019 and beyond
‘Tis the season to be making cybersecurity predictions. But, are we any good at making cybersecurity predictions as a whole? Is there a method to the madness, or do we sit around trying to read some cyber tea leaves?
While the past cannot necessarily predict the future, it can give some good insight into how trends are shaping up or whether there are any repeated cycles that we can analyse to look forward. Lots of the old is new again; many of you may remember reading white papers in the mid-to-late 90s that discussed using machine learning and anomaly detection for security purposes. This has become rather fashionable again.
(source: https://pdfs.semanticscholar.org/773d/d507c7a2315848af3594a94b96a463af412f.pdf)
Other trends have not been so cyclical as they have been linear. For example, Microsoft has gone from arguably having bad security, to now (again arguably) having the best security team in the private sector. They like to say they “control the physics” as they are in a unique position to disrupt bad actors.
But security doesn’t evolve in a bubble and is tied closely to broader technology trends. So, we can expect to see security changes in as Virtual Machines and container technology continues to evolve.
Many questions come to mind when looking at emerging trends. We wonder if supply-chain attacks are an emerging trend that will continue to grow, will criminals continue to make use of TSL / SSL, and will more nation-grade exploits leak?
There isn’t an easy way to answer many of these questions directly, but we can look to indicators, trends, and history to help guide us. So, I took a look back over the last decade to see what were some of the trends, and how far the industry is moving the needle.
2008: We were discussing return on security investment and stating humans are an important part of the security landscape.
Security ROI: Fact or fiction?
Human Error Tops the List of Security Threats
Bad flash drive caused worst U.S. military breach
2009: Government started taking cybersecurity seriously, the skills gap began to show, and we were still explaining the difference between basic technologies.
Obama Set to Create A Cybersecurity Czar With Broad Mandate
Pentagon Seeks High School Hackers
Do you need an IDS or IPS, or both?
2010: International collaboration and diplomacy is touted as needed to win the cyberwar, while cynics claim cyberwar is overhyped.
15 nations agree to start working together to reduce cyberwarfare threat
Threat of ‘cyberwar’ has been hugely hyped
How to stop cyberattacks: Diplomacy. Well, maybe
2011: Small businesses begin to end up in the cross-hairs of attackers and social media begins to play a more prominent role.
Cruel new punishment for hackers: Twitter, Facebook bans
Trusted Identities: Single sign-on or single point of failure?
Small Businesses Don’t Take Cybersecurity Seriously
2012: The year of criticisms and misplaced anger.
ENISA criticises lack of international cohesion on cyber security
Is the United States Militarizing Cyberspace?
Cyber Legislation Will Cost Businesses and Hurt Economy
2013: IoT security rears its ugly head, we need more cooperation and security hygiene.
Cyber Security in the Internet of Things
The Public/Private Cooperation We Need on Cyber Security
Cyber security – the best weapon remains good information security hygiene
2014: Do healthcare organisations need security? Unheard of! While you’re here, stop wasting so many security dollars.
From scaremongering to business enablement: reframing the cyber security debate
Billions spent on cyber security and much of it ‘wasted’
How Important is Cybersecurity for Healthcare Organizations?
2015: The talent shortage is really real, so use more analytics and hire some hackers.
Cybersecurity has a talent shortage
4 reasons cybersecurity now requires an analytics-driven strategy
Know Thy Enemy. Hire a Hacker to Enhance Your Cybersecurity.
2016: You’re still spending too much money on security for no reason, and small businesses continue to feel the wrath.
More money doesn’t guarantee success in cyber security race
How to Protect Your Small Business as Cybersecurity Threats Rise
Dangerous escalation in ransomware attacks
2017: The bad guys are getting better at using emerging technologies so security leaders need to reevaluate their strategies.
Don’t Panic! Create a Winning Cybersecurity Strategy to Preserve CISO Sanity
91% of cybersecurity pros fear hackers will use AI to attack their company
Digital transformation forces businesses to rethink cybersecurity
2018: Stop, collaborate and listen. And critical infrastructure has more holes than cheese,.
DHS floats ‘collective defense’ model for cybersecurity
Even After Multiple Cyberattacks, Many Businesses Fail to Bolster Security
Targeting power grid is too easy, Energy Department says
Looking through the news samples over the last decade, many things seem to stay relatively static. However, beneath the surface it does bring to light some trends that will probably continue, these include:
- The skills gap will continue to be an issue that needs addressing
- Critical infrastructure will remain precariously insecure
- IoT security concerns and impact will grow
- Cybersecurity spending will be scrutinised in more detail
- Small businesses will continue to be a target
- More threat sharing both between governments and private organisations
Having laid out the past, and picked apart some of the themes, what does this mean for the future? What can we expect to see in 2019 and beyond?
Security Technologies Will Become Invisible
The future will concern itself less with security technologies and more with security outcomes. Enterprises will switch their requirements from, “I need an IDS, behavioural monitoring, a SIEM” – and simply state, “I need to be able to detect threats.” The ‘how’ will be less important.
This in turn will change the approach of vendors so that security tools aren’t sold on the basis of features, or some secret sauce, rather on the ability to deliver multiple outcomes through consolidated security technology stacks. We’ll see evidence of this across both on premise and cloud deployments.
Just When You Thought You Were Safe from GDPR
Up until the first half of 2018, the letters G, D, P and R were well worn out on the keyboards of most security professionals and journalists. Then, the regulation came into effect and everyone breathed a collective sigh of relief.
But like the villain in a horror movie, this doesn’t mean it’s the end. Rather GDPR is ready, knowing that most organisations are on thin ice, and when they fall through, it’ll be there to catch them.
Managed Security
Managed security service providers (MSSPs) have been increasing in their popularity over a number of years. Driven by an ever-increasing technology estate that needs to be secured, and a lack of available skilled talent to hire, we see more and more companies turning to managed security providers to help fulfill their security needs.
Within this, Managed Detection and Response (MDR) is a category of managed security that has seen particularly high growth; but one which will probably be absorbed under the MSSP umbrella in due course.
Information Warfare
Perhaps the least of the prediction on this list as we’ve already entered the realm of information warfare – but there’s nothing to suggest this will slow down.
Some wars will be only around information. The rise of ‘fake news’ and the difficulties many content providers have in validating the authenticity of information among a tidal wave of corrupted information has led to some setting up dedicated teams to fight misinformation.
We’ve also seen evidence of hybrid wars, where information is used as an attack method alongside traditional war.
On a more individual personal level, dox’ing will continue to rise on both a personal level, and nation-state level.
Regulations
Like Warren G and Nate Dogg said, “Regulators, regulate!” There are many pressing issues in the cybersecurity world. Critical infrastructure lies exposed, and IoT or smart devices continue to bring insecurity to a very personal level.
We’ve already seen the state of California forbid IoT device manufacturers from using weak default credentials on their devices. But this is likely only the beginning, with more standards and regulations likely to be coming out across the world in disparate pockets, each trying to address a particular cybersecurity threat.
Cyber Insurance
We’ve seen cyber insurance gain traction within the industry. Driven not just by organisations’ own desires to add an extra layer of business protection; but often times it’s mandated by large organisations on smaller partners to take out cyber insurance.
Therefore, it’s something we’re likely to see grow exponentially in the small and medium business sectors. It will also have the consequence of pushing SMBs to look at their overall security posture and make improvements.
We can also foresee cyber insurance as being the precursor to wider scrutiny of security vendors – perhaps even driving some to offer some form of assurance or liability protection.
The More We Share, the More We Have
Sharing threat intelligence, data, and methods is a trend we’ve seen grow over a number of years. But sharing will definitely improve, allowing companies to share all manner of useful information to allow them to thwart the ever-persistent attacks against them.
As we see more government agencies and large enterprises begin to share information more freely, the quality of data will only increase, as long as we don’t see mass Balkanisation in the cyber world.
Future generations will wonder why we ever lived in such a world where threat data wasn’t fully shared.
And they’ll wonder who was the legend that made this prediction.
##
About the Author
Javvad Malik is a security advocate at AlienVault and former security analyst at 451 Research. An award-winning information security consultant, author, researcher, analyst, advocate, blogger and YouTuber, Javvad is known as one of the industry’s most prolific influencers, with a signature fresh and light-hearted perspective on security.
