Forrester’s top 2018 cybersecurity predictions
The year 2018 will bring more connectivity, digital transformation initiatives, and data to companies, along with a number of new cybersecurity threats and landscape changes, according to a new report from Forrester Research.
Last year, Forrester predicted that 2017 would see a cybersecurity crisis for the Trump administration in its first 100 days, that healthcare breaches would become as large and common as retail breaches, that more than 500,000 IoT devices would fall victim to a cyberattack, and that security professionals would increase spending on security services and automation to fill the tech talent gap. All of those predictions came true over the course of the year.
Here are Forrester’s six cybersecurity predictions for 2018, and actions that your organization can take to mitigate the risks.
1. Governments will no longer be the sole providers of reliable, verified identities
The Equifax breach demonstrated that no single entity—including any government—can safeguard identity data and provide trusted and reliable identity verification for a large number of consumers, especially as customers increasingly engage with businesses through digital channels.
Forrester predicts that in 2018, we will see an expansion of identity verification services to large banks such as Bank of America, Capital One, Citi, and Wells Fargo. Researchers also said that customers will be able to use bank-issued credentials to log into government services. Blockchain will also likely emerge to help verify identities based on federated, consortium-based transaction data.
Action: Evaluate an identity verification service provider as soon as possible. When selecting a solution, Forrester recommends prioritizing support, coverage, compliance, security of data handling, and reputation of the provider.
2. More IoT attacks will be motivated by financial gain than chaos
The Mirai botnet that hit in late 2016 demonstrated how hackers can use a botnet army of compromised IoT devices to launch a massive DDoS attack. IoT-based attacks will likely continue to grow in 2018, including those on both devices and cloud backplanes, as hackers try to compromise systems for ransom or to steal sensitive information.
Instead of being motivated solely by political, social, or military reasons, cybercriminals will likely be motivated by financial gain moving forward, the report noted. We’ve seen that these hackers are already exploring the potential for ransomware that targets vehicles, operational technologies, and medical equipment.
Action: Assess IoT attack vectors, compliance risk, and organizational readiness. Ensure security in existing IoT deployments by conducting assessments of endpoint devices for gaps such as default passwords, weak encryption implementations, and inadequate patching or remediation capabilities.
3. Cybercriminals will use ransomware to shut down point of sale systems
Many merchants have updated their payment systems to use end-to-end encryption and prevent criminals from obtaining credit card data from point of sale (POS) systems. This has led criminals to turn to ransomware as a means of monetizing an attack, as opposed to stealing and selling data. Often, victims of ransomware choose to pay the ransom, because they have no other means by which to restore their systems and data.
Action: Don’t pay the ransom. Create strong plans for system and data recovery as soon as possible, including backing up all systems daily.
4. Cybercriminals will attempt to undermine the integrity of US 2018 midterm elections
The US has not addressed the systemic vulnerabilities that can be found in its voting systems, which depend on software to cast votes, count them, verify them, and report them, the report stated.
“A hacker doesn’t need the voting machine to alter results; he could modify the spreadsheet or database that tabulates precinct voting totals, or use compromised Windows machines to adjust the voting tabulation results in web-accessible software,” the report stated.
Data stolen in the recent breaches of Equifax, the Republican National Committee (RNC), and various state agencies can potentially help criminals commit voter fraud in contested districts, Forrester researchers wrote.
Action: Volunteer your time to assist precincts, counties, and states with securing a voting system.
5. Blockchain will overtake AI in VC funding and security vendor roadmaps
Blockchain offers strong security and encryption, leading security teams to explore ways it can enhance the security of their on-premises and cloud workloads through capabilities like distributed integrity guarantees, tamper detection of policy changes, and transactional integrity.
“Forrester predicts blockchain will become a foundational technology for: 1) certificate issuance and authentication; 2) IDV; 3) malware and ransomware protection via binary reputation checks; and 4) document authenticity and integrity verification,” the report stated. “Those are just the immediate use cases.”
Blockchain is now similar to artificial intelligence (AI) in 2016, in that it will soon be the functionality every security vendor is going to seek out. “We predict that 2018 will be the start of an avalanche of new startups offering blockchain-related security solutions and that incumbents will scramble to update vision, strategy, and road maps so they don’t lag behind,” according to the report.
Action: Begin asking all security vendors about their blockchain road maps.
6. Firms too aggressively hunting insider threats will face lawsuits and GDPR fines
It’s become easier for firms to monitor employees and their activities as a means to thwart malicious insiders, employees making mistakes, or an attacker with compromised employee credentials. However, employees may find this to be an invasion of privacy. In September, the European Court of Human Rights ruled that companies must inform employees in advance if their work email accounts are going to be monitored. Further, such monitoring must not infringe upon workers’ privacy, the court ruled. The EU GDPR also applies to employee privacy and data handling, and includes large fines for noncompliance.
“Conventional wisdom dictates that mishandling of customer data will draw the ire of regulators, but employee data is personal data, and Forrester predicts that regulators will be just as likely to focus on employee privacy violations as they are customer violations,” according to the report.
Action: Create privacy rules of engagement for employee monitoring.
