WatchGuard® Technologies makes top five cyber security predictions for 2020 and confirmed that even though the threats won’t be any less intense, complicated, or difficult to manage, 2020 will be the year of simplified security.
1) Title: Ransomware Targets the Cloud
Ransomware is now a billion-dollar industry for hackers, and over the last decade we’ve seen extremely virulent strains of this malware wreak havoc across all types of businesses. As with any big-money industry, ransomware will continue to evolve in order to maximise profits. In 2020, we believe ransomware will focus on the cloud.
Recently, untargeted “shotgun blast” ransomware has plateaued with attackers now showing preference for targeted attacks against industries whose businesses cannot function with any downtime. These include healthcare, state and local governments, and industrial control systems.
Despite it’s far reaching damages and soaring revenues, ransomware has largely left the cloud untouched. As businesses of every size move both their servers and data to the cloud, it has become a one-stop shop for all of our most important information. In 2020, this safe haven will crumble as ransomware begins targeting cloud-based assets including file stores, S3 buckets, and virtual environments.
2) Title: Multi-Factor Authentication (MFA) Becomes Standard for Midsized Companies
Multi-factor authentication (MFA) will become a standard security control for midmarket companies in 2020. Whether it’s due to billions of emails and passwords having leaked onto the dark web, or the many database and password compromises online businesses suffer each year, or the fact that users still use silly and insecure passwords, the industry has finally realised that it is terrible at validating online identities.
Previously, MFA solutions were too cumbersome for midmarket organizations, but recently three things have paved the way for pervasive MFA, both SMS one-time password (OTP) and app-based models, even among SMBs. First, MFA solutions have become much simpler with cloud-only options. Second, mobile phones have removed the expensive requirement of hardware tokens, which were cost-prohibitive for midmarket companies. And finally, the deluge of password problems has proven the absolute requirement for a better authentication solution. While SMS OTP is now falling out of favour for legitimate security concerns, app-based MFA is here to stay.
The ease of use both for the end user and the IT administrator managing these MFA tools will finally enable organisations of all sizes to recognise the security benefits of additional authentication factors. That’s why enterprise-wide MFA will become a de facto standard among all midsized companies next year.
3) Prediction: During 2020, 25% of All Breaches Will Happen Outside the Perimeter
Mobile device usage and remote employees have been on the rise for several years now. A recent survey by WatchGuard and CITE Research found 90 per cent of midmarket businesses have employees working half their week outside the office. While remote working can increase productivity and reduce burnout, it comes with its own set of security risks. Mobile employees often work without any network perimeter security, missing out on an important part of a layered security defence. Additionally, mobile devices can often mask tell-tale signs of phishing attacks and other security threats. In 2020, WatchGuard predicts that one quarter of all data breaches will involve telecommuters, mobile devices, and off-premises assets.
4) Prediction: The Cyber Security Skills Gap Widens
Cyber security, or the lack of it, has gone mainstream. A day doesn’t seem to go by where the general public doesn’t hear of some new data breach, ransomware attack, company network compromise, or state-sponsored cyber-attack. Meanwhile, consumers have also become intimately aware of how their own personal data privacy contributes to their own security (thanks Facebook). As a result, it’s no surprise that the demand for cyber security expertise is at an all-time high.
The problem is, we don’t have the skilled professionals to fill this demand. According to the latest studies, almost three million cyber security jobs remained unfilled during 2018. Universities and cyber security trade organisations are not graduating qualified candidates fast enough to fill the demand for new information security employees. Three-fourths of companies claim this shortage in cyber security skills has affected them and lessened their security.
Unfortunately, we don’t see this cyber security skills gap lessening in 2020. Demand for skilled cyber security professionals keeps growing, yet we haven’t seen any recruiting and educational changes that will increase the supply. Whether it be from a lack of proper formal education courses on cyber security or an aversion to the often-thankless job of working on the front lines, we predict the cyber security skills gap to increase an additional 15% next year.
5) Prediction: Attackers Will Find New Vulnerabilies in the 5G/Wi-Fi Handover to Access the Voice and/or Data of 5G Mobile Phones
The newest cellular standard, 5G, is rolling out across the world and promises big improvements in speed and reliability. Unknown to most people, in large public areas like hotels, shopping centres, and airports, your voice and data information of your cellular-enabled device is communicated to both cell towers and to Wi-Fi access points located throughout these public areas. Large mobile carriers do this to save network bandwidth in high-density areas. Your devices have intelligence built into them to automatically and silently switch between cellular and Wi-Fi. Security researches have exposed some flaws in this cellular to Wi-Fi handover process and it’s very likely that we will see a large 5G to Wi-Fi security vulnerability be exposed in 2020 that could allow attackers to access the voice and/or data of 5G mobile phones.
Mark Sinclair, ANZ Regional Director, WatchGuard Technologies, said, “Our key predictions for 2020 highlight that ultimately good security is often more about sustained behaviours than any one mistake or decision. If a cyber-threat takes down an organisation’s critical IT infrastructure, in part or entirety, a solid disaster recovery plan and good back-up, hosting and virtualisation services will see an enterprise get up to speed sooner following an attack and will ensure management and IT staff aren’t left scrambling to respond.”
