10 Security Predictions, Trends & Challenges for 2018
To say 2017 was a big year for cybersecurity is a vast understatement. From the massive data breaches involving Equifax, Uber and Deloitte, to an ever-increasing number of new threats, the year has been one long lesson for organizations of all sizes that you can’t have enough protection.
“Cybercrime is becoming more and more sophisticated,” said Gregg Henebry, Cybereason’s vice president of channels. “It’s a lucrative business, increasing in both frequency and in damage, and thus is becoming a huge business for the adversaries. It’s not just impacting small businesses that don’t have the necessary tools; it’s impacting large corporations and ultimately disrupting organizations of all sizes, corporate earnings and shareholder value.”
Ankur Laoria, strategic solutions leader at Alfresco, said this year showed everyone just how vulnerable corporations are to cyberattacks.
“One thing is certain,” he said. “There will likely be more cyberattacks from bad actors in 2018. But, it will also be the year that corporations finally sit up and take notice of their systems, and how they store and keep data safe. One big catalyst: Europe’s General Data Protection Regulation (GDPR) takes effect mid-year and it’s likely to have a ripple effect around the world.”
In the gallery below, security experts give their predictions for 2018, including emerging trends and opportunities for the channel.
Prediction: Security 'haves and have-nots' will emerge.
In 2018, security haves and have-nots will emerge between those that begin to automate the research portion of security response and those that don’t. Companies with the tools and culture to embrace automation, and put technology to work for real business enablement, will perform better than those that don’t, according to ServiceNow.
Automation will help them better determine which systems to patch and when. They will respond to phishing attacks in minutes rather than days. For the haves, this will be a point of pride.
In the coming year, chief information security officers will do more to present their security concepts and programs in business terms, ServiceNow says.
Talking about securing data is one thing, but demonstrating the value that security offers the business is something else. This will eventually apply to every aspect of the business, but most immediately applies to regulatory compliance, potential lost revenue, customer relationships, legal liability, competition, intellectual property, stockholder loyalty and brand protection.
Prediction: A breach will enter our physical lives.
In 2018, people will see breaches in their physical, personal lives, ServiceNow said. It might be a medical device or wearable that is hacked and remotely controlled. It could be an industrial Internet of Things (IoT) device or self-driving car that gets compromised. Or something closer to home — literally. Devices from the garage door to the refrigerator are becoming smarter and more connected. The impact of such an attack will force government, business and individuals to take a closer look at the security of our infrastructure.
Prediction: The European Union will penalize a company for a GDPR violation.
On May 25, 2018, GDPR will be put into effect. It will provide a legal framework aimed at strengthening and unifying data protection and distribution for individuals within the EU. While the regulation will protect EU citizens, it will impact every company globally that serves a customer or employee in the EU — and businesses can be held responsible for the way they process, store and protect personal data.
The EU may choose to make an example out of one of the first companies it penalizes, sending a message that GDPR is to be taken seriously, ServiceNow said. As these penalties receive global publicity, other companies will be compelled to move forward with GDPR compliance plans.
Trend: Security upgrades creating big opportunities for the channel
“Security in and of itself is causing a huge upgrade cycle, and it is an architectural play when it comes to an emerging opportunity for the channel,” said Donna Turgeon, KnowBe4’s senior vice president of global channel. “We believe the most opportunistic emerging opportunity for channel partners is the move to a services-led sell and services-led implementation, and that training and awareness services within the security services space is key.”
Challenge: Keeping up with the bad guys
The biggest challenge for partners is staying ahead and investing in the latest technologies that will advance alongside adversaries, Henebry said. The bad guys will constantly evolve, and if partners don't move with them quickly, they “won't equip their customers with the right solutions to stop the bad guys,” he said.
“Partners need to be looking for ways to protect the defender (their customers) and put more and more sophisticated technologies in their hands — this give partners a big opportunity,” he said. “Partners should be looking to provide their customers with a comprehensive approach to security. Adversaries will always find a way ‘to get over the wall,’ so partners need to offer a holistic platform and portfolio of products.”
Challenge: Making the cloud more secure
“Collaboration between nimble private companies and the behemoth blue-chip tech players on how to make the cloud more secure, including an increased focus on hybrid clouds, multicloud management and a modern container-based approach, will become the rule instead of the exception,” Laoria said.
Prediction: Ransomware threats will continue to increase.
Ransomware will continue to be a mainstay due to its proven success, according to Trend Micro. There will be an increase in targeted ransomware attacks, in which the criminals go after a single organization to disrupt operations and force a larger ransom payout. Business email compromise (BEC) attacks also will continue to gain popularity with attackers, as the return on investment for successful attacks is quite high.
“This (ransomware) has been a popular method, and I think it will remain that way for the foreseeable future,” said Cameron Tousley, partner community manager at ESET. “I do believe we will see an evolution in how ransomware behaves though, given that as security providers have seen so many different samples they are getting smarter with respect to preventing these types of attacks.”
Prediction: Threats to IoT devices will grow.
Trend Micro predicts an increase in IoT vulnerabilities as more devices are manufactured without security regulations or industry standards. Overall, the increased connectivity and enlarged attack surface present new opportunities for cybercriminals to leverage known issues to penetrate a corporate network.
The IoT market is emerging for businesses, so it also is important that solution providers secure devices and infrastructure so that vulnerabilities do not result in breaches, both digitally and physically, Tousley said.
Trend: Machine learning, blockchain emerging threats
Threat actors increasingly will use growing technologies, like blockchain and machine learning, to enhance obfuscation against traditional cybersecurity protections, Trend Micro said. Like most promising technologies that were thought secure at one point, machine learning and blockchain warrant close attention.
For this reason, the company recommends a layered, cross-generational defense strategy.
