Industry executives and experts share their predictions for 2018.  Read them in this 10th annual VMblog.com series exclusive.

Contributed by Stephen Cox, Chief Security Architect, SecureAuth

Ransomware, Biometrics, Machine Learning and More

Stolen Credentials and the Third Pillar of Security

There was a common element in many of the major cyber breach disclosures of 2017:  the use of valid stolen credentials as a means of gaining a foothold into the organisation’s network. In the September Deloitte breach disclosure, valid administrator credentials that were not protected by multi-factor authentication were exploited by an attacker. Similarly the Equifax breach disclosure described an attack vector resulting from an employee portal utilizing weak and unprotected admin credentials. These breaches, among others, contributed to an unprecedented amount of highly sensitive data being compromised in 2017. Sadly, organisations are still making it very easy for attackers.

Stolen credentials are simple to obtain on the dark web. They can be used in many ways to initiate and execute an attack. They are a “path of least resistance” for opportunistic attackers, who typically want to save their high value security exploits for tackling more sophisticated and challenging targets. Many organisations are not allocating enough resources towards the identity layer, making it a perfect storm of a cheap attack vector with high efficiency and a reliable return on investment.

Multiple industry reports, including the 2017 Verizon Data Breach Investigations Report (DBIR), give clear evidence showing an increase in the use of stolen credentials in breaches. These reports leave little doubt that identity security is the new cyber-frontier. I see nothing that indiciates this trend will stop in 2018. Simply put, organisations are not doing enough to defend and respond to attacks against the identity layer. Identity security is now a pillar of cyber-security alongside the network and endpoint.

Biometrics in the Palm of Your Hand

2018 will be an interesting year for biometric technology, for the most part led by Apple’s adoption of Face ID on the iPhoneX. It will likely be the largest adoption of facial recognition technology in history and the response from iPhone users and security researchers is of great interest to the security community. It’s certainly a sign that biometrics is becoming more commonplace and has a critical role to play in authentication. It’s fascinating that the consumer market is leading the enterprise market in the widespread adoption of biometric authentication. In doing so, major smartphone vendors are making it easier for the enterprise market to move towards passwordless identity security.

Machine Learning Takes a Step Forward

Organisations will also continue to explore the application of machine learning (ML) to their identity security programs. We’ve seen the early growth of ML technology over the past few years with User and Entity Behaviour Analytics (UEBA), but in my view no one has successfully connected the dots between UEBA and access control yet, something that is direly needed.

The Ransomware Conundrum

2017 also saw ransomware emerge as a cyber-security epidemic. Many organisations and private citizens have poor backup practices, which is really the best defence against ransomware. Without proper backup ‘hygiene’, you’re left to pay the ransom or wait for a security researcher to crack the ransomware. Sadly, this is a trend we expect to continue well into 2018.

Towards a Passwordless Future

Fundamentally, the cyber-security industry should revaluate the importance and value of password based single factor authentication to enterprise security. Overwhelming evidence shows that relying on just the username and password  to authenticate a user is irresponsible and ineffective. The aforementioned Verizon DBIR recorded the number of breaches stemming from weak or stolen passwords in the last three years jumped from 63% to 81%.

To stay ahead of modern cyber criminals in 2018, businesses should take a holistic, intelligent approach to identity security. Removing the ‘human knowledge’ element from the authentication process improves security while not hardming the user experience. Going passwordless and using multifactor, adaptive authentication methods is a huge step in the right direction.

Here’s what a holistic view of identity security looks like in 2018: drawing on contextual data such as the device being used and a biometric modality, along with risk-based analysis such as IP address look-up against known attacker infrastructure, geo-location and IP intelligence services, and analysis of the user’s logical and physical behaviour. Adaptive authentication can completely remove the need for businesses to use passwords which, as we’ve established, are likely already compromised.

Yes, You Are a Target

Attackers are demonstrating just how adept they are at finding ways to monetise data exfiltration from pretty much any vertical. Data of interest includes personal data, financial information, intellectual property and even credentials (usernames and passwords) themselves. In 2018 if you have data that is of potential value, yes, you are a target.

##

About the Author

Stephen Cox, Chief Security Architect, SecureAuth

Stephen Cox is a technology veteran with over 15 years in the IT industry, including 10 years’ experience in leading software development teams in the security industry. A key player in some of the most influential IT security firms in the world, he is recognised as an expert in the systems architecture, threat intelligence and malware analysis as well as endpoint and network forensics.

A Chief Security Architect, Stephen is a top thought leader in the rapidly evolving security marketplace. Specialising in the unique opportunities represented by the convergence of cyber threat detection and adaptive authentication, Cos’s expertise shapes SecureAuth’s product and technical alliance strategies. With a deep understanding of evolving threats and the technologies that stop them, Cox is a recognised innovator in protecting the increasingly diverse world of VPN, legacy, mobile, on-premise and cloud applications.

Before joining SecureAuth in 2015, Stephen served as technical lead of the Endpoint and FireEye-as-a-Service development teams at FireEye/Mandiant. These teams specialised in endpoint forensics and endpoint event monitoring as part of the FireEye HX platform. Before Mandiant, Stephen was at RSA NetWitness, as principal developer of NetWitness Spectrum, served a number of years at VeriSign in support of the DNS Resolution Operations team and also in various software development roles at Northrop Grumman and American Online.

Stephen holds a Master of Science in Software Engineering and a Bachelor of Science in Integrative Studies, both from George Mason University.