Blog: Cybersecurity Trends in 2020: What to Expect and How to Prepare

What to Expect in 2020: Top Trends 

The pace and scope of cyber threats is evident in how quickly criminals are adapting to changes in security practices. Among the top trends in 2020 are the following: 

Biometric Attacks. “Unique human identities” in the forms of fingerprints, voice and face ID are becoming more popular in consumer devices, but they also are attracting cyber attackers who seek access to comprehensive biometric data by breaking into these profiles. A stolen biometric password is “the gift that keeps on giving” as it is not likely to ever change. 

Social Media Alerts. Facebook and other social platforms increasingly play a part of governmental infrastructure as a way to disseminate information and promote awareness or engagement. However, social media can also lead to false alerts with potentially catastrophic results, such as the bogus missile attacks reported in Hawaii and Japan, as we recently experienced. 

Commercial Espionage. Such espionage is an ongoing threat, but nations on the losing side of a trade war may well be incentivised to enhance their efforts to steal intellectual property, using ever more sophisticated techniques. 

Supply Chain Vulnerability. Already, some nations are targeting the supply chain at the chip level to gain backdoor access. 

Zero Trust. This is not a threat but an approach more security teams are adopting to stop lateral movement once an attacker has gained entry. It involves micro-segmentation and granular access control, trusting nothing and no one inside the system. 

The challenge in protecting all of these fronts is that data runs our entire society from server to served. It must be accessible anytime and anywhere, that is, with a multitude of constantly open access points. Moreover, a recent study indicated that chief information security officers can monitor, on average, only 67% of an enterprise. That leaves a lot of exposure.

Prioritisation: Ranking of Vulnerabilities 

Generally, most firms can be assured of a safe data exchange with their major suppliers. But imagine a small vendor becomes the victim of a hired hacker. For as little as $300 in the current criminal market, an intruder can be hired to try to break the vendor’s security and gain access to an organisation’s IT system. 

The most common form of intrusion, according to the survey, is malware, which is introduced usually through phishing. Not only is phishing inexpensive, but it can also bypass the most extensive security protections. All it has to do is prey on the judgment of individual employees by tailoring its lure as a legitimate need. Once inside a system, an attacker can introduce viruses, malicious apps and ransomware, and next attempt to move laterally to compromise other systems. 

Recommendations to Bolster Security 

Boards and senior management can take a number of actions, ask probing questions and generally set the tone to make cybersecurity a priority. Among them: 

• Balance protective efforts with recovery capabilities. A breach will happen; what matters is how quickly an organisation can rebound. Attack drills would greatly benefit a firm’s ability to respond to the inevitable intrusions. 
• Don’t be overly confident. Surprisingly to some, digitally advanced organisations report more attacks than “beginner” firms. The lesson here is that digital security must be part of the digital transformation process, even for “born digital” firms. 
• Embed risk and cybersecurity into the work of innovation teams. The last thing an organisation wants is cybersecurity competing as a separate item for scarce budget dollars against innovation. 
• Maintain ongoing training programmes for the staff, and continue to assess insider risk. 
• Set risk appetite thresholds using a quantitative risk analysis, such as the Factor of Analysis of Information Risk (FAIR) methodology. Cybersecurity might seem expensive, but it could be a bargain compared to the exorbitant costs of exposing critical data. 
• Take constant stock of the ever-changing threat landscape. No longer are financial firms the prime targets. Now that ransomware has become a moneymaking activity, any organisation is potential prey for loss of data or functionality. 
• Take an active interest in cybersecurity. Ask probing questions, set clear expectations and monitor focused dashboards. Publics are now rating board performance on cybersecurity, as well as more traditional areas, such as safety and financial return. 

Baking in Security 

Cybersecurity is a challenging proposition, but it is part and parcel of doing business in the 21st century. Consequently, organisations that bake in cybersecurity as part of their growth DNA will be more prepared to maintain their systems and recover from attacks. These capabilities also become a component of an organisation’s competitive edge.