Industry executives and experts share their predictions for 2019. Read them in this 11th annual VMblog.com series exclusive.
Contributed by Luke Somerville, Head of Special Investigations, Forcepoint
A Collision Course to Cyber Cold War
News outlets have described 2018 as the beginning of a 20-year trade war. Historically, open trade borders have led to a cross-pollination of technology through existing and emerging markets. However, throughout 2018 we have seen a shift towards more protectionist postures in the form of trade embargoes-a result of fracturing trust between world powers.
On both sides, tariffs now accompany everything from consumer electronics to health and safety products. From the standpoint of disadvantaged nation-state players, trade disputes limit legitimate opportunities for the acquisition of software and hardware that could bolster their cyber capabilities. From an enterprise perspective, trade embargoes affect access to new technology, knowledge sharing, and even access to workforce talent.
Much commentary has been written around “cyber war” and its place alongside more conventional military techniques. This tends to result in fears of all-out war on the internet, and conjures visions of cyber attacks escalating into kinetic warfare. The Forcepoint 2017 Cybersecurity Predictions Report spoke of the implications of NATO Article 5, the new “Enhanced NATO Policy on Cyber Defense,” which allows for kinetic war in response to an incident in cyberspace. A better analogy for describing the likely implications of trade embargoes would be cold warfare, with cyber “operations” tied to the function of national foreign intelligence services. Changes to the flow and availability of information across national boundaries could lead to a future increasingly reminiscent of the years between the late 1940s and early 1990s, wherein access to technologies was acquired via espionage. Companies and nations have always been naturally protective of their IP, but as opportunities for legitimate access dwindle, people on the other side of embargoes will have real incentive to acquire it by nefarious means.
Instead of bigger walls to keep nation-state- sponsored hackers out of power generators and manufacturing plants, the cybersecurity industry needs to better understand how, when, and why people interact with this sensitive data, no matter where it is located. Nation states and enterprises alike need to understand who is touching critical content and why. To prevent IP theft, organizations should focus on understanding the normal behavior of legitimate users with access to trade secrets and knowing when this behavior changes-signaling an attempt to steal them.
##
About the Author
Luke is responsible for supporting the business with in-depth technical analysis of major incidents such as the WannaCry and Petya outbreaks, and for overseeing longer-term research projects to identify and track new and advanced threats and attack methods. The research from Luke and his team supports Forcepoint customers globally. He joined Forcepoint in January 2017 from Team Cymru.
The longer-term research projects which Luke and his team undertake provide customers and prospects with predictions and analysis of the threat landscape, examine potential new threat vectors, and explore how large shifts in technologies are going to impact organizations. Luke takes a particular interest in the broader effects that both large and small outbreaks have on the overall threat landscape, and aims to offer not only technical breakdowns of malware but actionable assessments of the threats so that organizations can continually refine and improve their security programmes.
Luke has spent almost the entirety of his career in IT security, having worked as a consultant to a range of public and private-sector organizations across Europe to design and deliver both technical and procedural cyber-security systems. Previous experience include the UK Ministry of Defense, NATO, Hewlett Packard and Deutsche Bank.
