Imperva has been in the business of protecting the high-value applications and data assets at the heart of the enterprise since 2002. Security vendors are challenged at the end of each calendar year to come up with predictions for the year ahead. With the wealth of information, we’ve collected from our products when combined with the insights that we’ve gathered from our customers, we can provide expert guidance on the trends unfolding in cyber security. This knowledge has come from analyzing the data collected by our products in installations around the world, as well as from working closely with over 3,500 customers from across many verticals.
These are the top 5 predictions for 2016:
- BoT – Botnet of Things
In recent years, much has been discussed regarding the growth of IoT (Internet of Things), and its adoption in our everyday lives. With technology taking the necessary steps to minimize boards and reduce power consumption, fewer and fewer things remain that can’t hook up to your home WiFi or stay connected via Bluetooth.
And where some see this as progress, others see a decline. By naively connecting everything to the internet, we also made it vulnerable. IoT is screaming, “Hey, I am a small computer in here with excellent connectivity!” For malicious actors that also means “Easy prey!”
The security of operating systems for PCs has gone through an agonizing process of evolution, making it harder than ever to compromise a PC running a modern OS from a remote location. Embedded devices, on the other hand, haven’t done so well in securing themselves. From hard-coded default credentials, through publicly-accessible configuration panels and simple vulnerabilities, to simply non-existent patch management, IoT is an easy fish to catch for perpetrators. Even security-oriented devices such as CCTVs have been found to be completely vulnerable.
Attackers can exploit the abundance of soft targets in many ways: from running malware that participates in DDoS attacks and spreading spam, to running proxies, scanning other machines, or – in the worst case – acting as a leverage point for compromising all other devices on the local network.
Without a serious change in the security state-of-mind, it is just a matter of time until we see the first victim of a flood caused by zombie toasters and microwaves.
- Rise of the Insider Threat
External threats, in the context of cybersecurity, are relatively well understood, and there are many products/solutions in the marketplace to address such external malicious activities/agents. While awareness towards insider threats – both of the malicious and the careless variety is increasing, there has not been a high-profile data breach since Snowden, possibly resulting in firms maintaining status quo toward insider threats. 2016 will be the year that more data breaches will be due to insiders. Insiders have privileged access to data/databases and remain largely unmonitored even today. Encryption of data and transport does not help protect against insider threats. Data stored in the cloud is more at risk from the insider threat since IT security and controls in the cloud are still playing catch up.
While it’s impossible to eliminate the risk of internal data breaches entirely, the attack surface and time to detect can be significantly reduced by monitoring data access and using solutions based on behavioral analysis.
- Cyber-Attack on Major Infrastructure
Cyber-attacks are increasingly sophisticated, frequent, and disruptive; critical infrastructure has not been upgraded to thwart such attacks, and it could be significantly disruptive or potentially devastating. Some infrastructure like electric power grids may be able to recover quickly from an attack given the redundancy in distribution and transmission. But water and natural gas supply or transportation and communication network can suffer a crippling assault. ICS/SCADA protocols with poor to no authentication, control systems in dire need of patching, lack of firewalls that are not SCADA-aware firewalls, negative employment in cyber security and lack of training are all factors that widen the gap and make critical infrastructure more vulnerable. U.S. Cyber Command is earmarking $460 Million to build lethal cyber weapons that may eventually result in casualties. The primary targets for the cyber weapons are Industrial control systems, Stuxnet was the first successful use of lethal malware against nuclear facilities in Iran. It is only a matter of time before terrorists build their cyber weapons.
Luck has been on our side to date; we have not faced any serious attacks yet on SCADA/ICS. We would like for this particular prediction not to come true given the extent of the damage it can inflict.
- Contractors get a Cyber Pat Down
Major corporations will enforce cyber security assessments of the third party firms and contractors. The Target data breach happened because of a compromised HVAC contractor. The Anthem data breach occurred through a smaller insurance firm that Anthem had just acquired. JP Morgan hack resulted in increased focus on third party governance. Each of these companies had well-defined policies for the infrastructure that they directly managed, and the outside firms with privileged access became the weak links.
2016 is the year where major enterprises will require all vendors to demonstrate that their cyber security is on par or better than the standard set by the enterprise. The derivative effect will be an increase in liability/indemnity resulting in the maturity of the Cyber Insurance market. Similar to how high fire insurance premiums resulted in better building codes and ultimately safer buildings, the move to require increased cyber insurance coverage from the third party entities will result in stronger cyber security.
- Subversion of Free SSL Certificates for Malware
There is a revolution happening in SSL certificates handling – Free SSL certificates from new Certificate Authorities. “Let’s Encrypt” is one such free, open certificate authority that issues SSL certificates and can do so in an automated fashion. Man-in-the-Middle (MITM) exploits succeed by spoofing communications using stolen/abused certificates. A free certificate issued by a CA would significantly reduce the barrier for executing MITM attacks. To appear as a trusted vendor and use the digital certificate to sign malicious code with it, greatly reduces the possibility for malware to avoid detection.
Accelerated by the adoption HTTP/2 (which requires HTTPS for all popular platforms), the day is not far away where Free SSL is mainstream. While encryption helps drive better security, exploits find ways of spoofing and abuse the implicit trust within the model. The problem lies in the premise that HTTPS currently provides for security, both for end-users as well as security solutions.
For users, the reality is that most don’t distinguish between regular certs and EV, so a green lock in the address bar indicates a secure URL. Registering a fake domain such as 1mperva.com allows for a better attack surface and elaborate phishing campaigns. Compromised HTTPS sites that host malware/phishing pages will go undetected for a long time defeating all browser checks.
Security solutions especially proxies will have to inspect higher volumes of encrypted traffic, and decrypt all HTTPS flows, which will have a severe impact on performance and exponentially increase overall setup complexity.
Webinar On-demand: Top Cyber Security Trends for 2016
Hear Imperva CTO and co-founder, Amichai Shulman, share his thoughts on the top trends that will impact cyber security practices across the globe.
Try Imperva for Free
Protect your business for 30 days on Imperva.
