Industry executives and experts share their predictions for 2021.  Read them in this 13th annual VMblog.com series exclusive.

What Lies Ahead for Security and Marketing Teams, Securing the Remote Workforce, Protecting Online Brands and More

By Matthew Gardiner, Principal Security Strategist at Mimecast

This has been a whirlwind year – both globally and from a cybersecurity perspective. COVID-19 impacted how we work, travel and interact. In thinking through what we experienced in 2020, here are my top predictions for 2021:

Accelerated Digital Transformation Accelerates Security Transformation

On-premises based security controls, in particular those that are appliance based, will go the way of the Dodo Bird, and be replaced by cloud-based security controls. This will particularly happen, but not exclusively, in the areas of identity management, email security, web security, and network security. Where the user is in the world should not change the security protections that they receive. In effect the internet will provide better security for the internet.

Marketers and Security Teams Work More Closely Together

Online brand spoofing via email and the web drives marketers and security teams more closely together – for once! The people that are tasked with protecting and enhancing their organization’s brand – marketers – will increasingly realize that their brand is under attack by cybercriminals, severely damaging it in the eyes of their target audience. This fact will drive marketers and security professionals to work closely together to come up with strategies to better protect their organization’s online brand.

I also spent time talking to my colleagues at Mimecast to get their thoughts on what we might see in 2021 and beyond. From online brand spoofing and remote work security to IoT security legislation, check out the trends and themes they expect to see in the coming year:

Alex Bender, SVP, Global Marketing

Marketing teams have long recognized the need to protect their brand’s reputation, but brand safety in the digital age goes much deeper than it once did. Brand safety must incorporate efforts to combat rampant brand impersonation, search-ad phishing and phishing emails that trick unsuspecting, trusting customers into engaging with malicious content. Brand protection strategies can no longer simply protect the brand, they must protect customers and stakeholders in order to uphold a brand’s reputation and customer loyalty. This problem is only getting worse which creates a massive need for a strong organizational culture of brand protection in 2021 and beyond.

Search-ad phishing is another way cybercriminals impersonate brands to prey on the trusting relationships between companies and their customers. While search engines like Google strive to keep these types of brand exploitation and phishing attacks at bay, it’s a challenge to nip every problem in the bud. Brands must step up to fill the gaps – it’s no longer enough for marketers to focus their brand safety efforts on simply avoiding bad content or providing valuable content to customers and prospects at the right time. Marketers should start working more closely with corporate cybersecurity professionals to protect their customers from malicious phishing attacks that can damage customer relationships and harm brand safety.

Kiri Addison, Head of Data Science for Threat Intelligence

IoT security legislation will not be enforced, due to political attention being diverted to Brexit, the pandemic, the US election etc. At the same time, the rollout of 5G networks means that IoT device usage will increase and IoT devices will be linked to or control critical systems. Due to the economic pressures caused by the pandemic, entities have less cash available and are less willing to pay the ransoms demanded by threat actors after ransomware infection. This leads threat actors to adapt their methodology in order to increase the personal impact of not paying. Threat actors will exploit the unmitigated vulnerabilities in critical IoT devices and hold lives to ransom, threatening physical damage or death.

Jonathan Miles, Head of Strategic Intelligence and Security Research

Remote working will continue apace and is highly likely to be the preferred option for both individuals and organizations. This will of course present an increased attack vector if home networks and organizations VPNs are not secured.

Insider threats are highly likely to escalate. Use of a layered cyber security approach in the virtual space, leaves vulnerabilities (again humans) to exploit through social engineering. If attackers can’t get through defences, this will have to be bypassed by someone on the inside. Method, motive, and access are all that criminal entities need to exploit an individual.

Gar O’Hara, Principal Tech Consultant

Cosmic Lynx is an early example of the extra effort attackers will expend for large payouts. We’ll move from nickel and dime cons to Oceans 11 heist complexity for BEC. There will be a step change in terms of reconnaissance, execution and payout. Deeply researched targets. Novel approaches and execution using complex vulnerabilities across people, processes and technology but spanning multiple compromised and impersonated organizations to hit a target. Cyberattack complexity that would be analogous to the financial fraud only understood by quants and forensic accountants. 

Raafat Kastoun, Cybersecurity Expert

With KSA’s “Cloud First” strategy and providers like Amazon AWS and Microsoft Azure opening data centers in the region, many organizations are now having some form of cloud deployment in their environment. COVID-19 will keep accelerating this shift.

This will further elevate the importance of cloud security as most employees are working from home accessing the data stored centrally in the cloud and fewer IT security personnel are on site to maintain legacy on-prem security appliances. Cloud NGFW, ESG and WSG will become the new norm.

##