Industry executives and experts share their predictions for 2021. Read them in this 13th annual VMblog.com series exclusive.
2021 Cybersecurity Trends: COVID-19 Will Still Dominate
By Kevin Peuhkurinen, Principal Research Director, Security, Risk & Compliance, Info-Tech Research Group
The pandemic has rewritten the rules for virtually every sub-discipline within IT, and security is no exception. In fact, the impact of COVID-19 is particularly acute within the security space, and cybersecurity specialists can’t afford to start off the new year without carefully thinking about the tectonic changes that are coming at them, and the best practices necessary to minimize the risks for themselves and the organizations they serve.
With this in mind, I’d like to share some of my key predictions in cybersecurity for the upcoming year – along with my thoughts on where we’ll need to focus if we hope to stay ahead of the threat curve:
1. New Insider Threats: While no one can agree on what “normal” actually is, there’s broad consensus that the pandemic will profoundly change how we work, and where. The so-called new normal will usher in an era of permanent remote work that will combine with a new corporate gig economy fueled by freelancers. While this holds the promise of improved end-user productivity and business agility, it also opens up the darker potential of a new insider threat landscape. Security protocols designed and implemented largely pre-pandemic, when most of us were in the office, haven’t kept pace with fast-evolving threats. Delivering effective security awareness and training to a remote workforce will create additional challenges; the days when cybersecurity teams could spend their time putting up posters in hallways and lunchrooms are gone, particularly given the increasingly casual, virtual nature of the employee/employer relationship. Providing security education to a growing cohort of untrusted remote employees and freelancers will require new, innovative approaches to awareness.
2. The End of Endpoint Protection: A permanent remote workforce, especially one that is geographically dispersed, will drive organizations to adopt bring-your-own-device and bring-your-own-PC strategies, heralding the end of traditional IT endpoint protection. In the past, organizations could mitigate the risks of employee-owned computing devices through the use of virtual private networking (VPN) software which could look for and enforce security controls. But with the growing obsolescence of VPNs, companies will need to come to grips with the growing presence of untrusted devices in their midst.
3. The Rush to Data Security: The pandemic has caused many companies to accelerate their cloud adoption strategies in order to enable a remote workforce that isn’t reliant on legacy VPN technology. New untrusted insiders, untrusted devices, and cloud adoption will force companies to rethink their security strategies. Companies should start considering how they will move their investments away from network and endpoint security to focus instead on data and cloud security. Zero trust, while still largely a marketing buzzword, should finally start to fulfill its promise in this new era.
4. The Growing Deepfake Threat: We’re more reliant on videoconferencing and virtual meetings than we’ve ever been before – and cybercriminals have noticed by increasingly targeting these mission critical platforms. Deepfake and other synthetic media attacks are already on the rise, and we can expect this trend to only accelerate. Cybercriminals will have plenty of opportunity, as remote collaboration tools provide them with ample video and audio samples needed to create virtual duplicates that can subsequently be used for AI-enabled social engineering attacks. With no effective technical countermeasures available, companies will need to invest in awareness of this growing threat, or risk having their primary collaboration platforms compromised.
There is no question that the world has changed – and nowhere is this more true than in the cybersecurity space. The accelerating pace and increased uncertainty of emerging threats is forcing organizations to finally start prioritizing their investments in cybersecurity. That, more than anything, represents the silver lining in the IT security roadmap as another challenging year dawns.
##
About the Author
Kevin Peuhkurinen is a Research Director in the Security, Risk, and Compliance practice. His primary focus is on helping clients align security activities to business objectives through strategic planning, control alignment to industry standards, and policy development.
Kevin has over 20 years of experience in IT and information security, principally within the financial industry. Prior to joining Info-Tech Research Group, Kevin spent six years managing the information security office for a global insurance and investments enterprise. In this role he led a team of analysts providing cybersecurity services across multiple companies and jurisdictions, and was responsible for information security governance, vulnerability and penetration testing, security awareness, risk assessments, and security assurance during mergers and acquisitions. Kevin’s expertise encompasses all aspects of security risk management, including compliance, control framework design, vendor risk management, and threat modelling. In addition, he has experience in security operations, security technologies, threat intelligence, and incident response.
