Companies still have a long way to go when it comes to digital security, and with cybercrime becoming ever more lucrative now is the time to fix your security policies. That in mind we’ve outlined some predictions for the rest of the year
1) The perimeter will be abandoned (somewhat)
Much security in the past has been concerned with building a wall around sensitive data. While this is likely to continue to some extent, hackers are always improving their game and are increasingly breaching the outer wall.
"We’ve created what looks like the semblance of security and the bad guys pretty much drive around the perimeter and do whatever they want," Eddie Schwartz, VP of global security at telecoms firm Verizon, said at a briefing back in May. "We’ve invested so much money in checklists, perimeter security and securing things that are not that important, that there’s not much money left for anything else."
The industry is increasingly encouraging companies to segment sensitive data and put resources where they are most needed. Attacks such as the one against the European Central Bank have proved the wisdom of this method, with hackers snatching less sensitive data while the good stuff stays safe.
2) More focus will be put on education
Hackers have long relied on social engineering in order to spread malware, most infamously through Nigerian Prince or 419 scams, but more commonly through phishing. As such many security experts believe that education is at least half the battle when it comes to security.
In its basic form this means discouraging users from clicking suspicious links or attachments, and other issues such as checking URLs to make sure they are legitimate. Marcin Kleczynski, chief executive of security firm Malwarebytes, told CBR he could do a lot with 15 minutes at a company, and many firms may decide it’s a service worth having.
Content from our partners
3) Privacy will become still more contentious
Since the Snowden leaks last year privacy has been increasingly on the table, both in terms of public concern and in discussion between states. Last week John McAfee told the Def Con hacking conference that the world had been complacent about of personal data collected on them.
"Google or at least certain people within Google, I will not mention names because I am not a rude gentleman, would like us to believe that if we have nothing to hide we should not mind if everybody knows everything that we do," he said. "I have to take serious issue with that."
But tech firms are not entirely malevolent. Microsoft, Google and Twitter were among a number of important companies who backed Facebook’s corner in a complaint over data seizure by the US government. The struggle between corporations and the state is only likely to intensify as the year continues.
4) Infrastructure will be targeted by hackers
The abandoning of Windows XP earlier this year and subsequent scrabble by the British and Irish governments to secure critical health and civil service systems shows how dependent infrastructure is on computing these days.
Yet the end of security patching is the lesser problem when compared to cyber espionage, a major problem facing governments at the moment. Malware known variously as Careto or the Mask was unearthed last year by Kaspersky, a security firm, and found to be targeting government institutions and energy companies.
Costin Raiu, director of the global research and analysis team at Kaspersky, described it as "one of the most advanced threats at the moment", and increased reliance on computing worldwide is unlikely to dissuade governments from building the capacity to make such attacks.
5) Virtual machines will be breached
The use of virtual machines (VMs) common in cloud computing has led to some IT managers becoming complacent about the security of their networks. A recent report by security firm Symantec revealed that only one in five malware samples were able to detect when they were running on VMware.
Yet it’s not a lack of talent that’s motivating this trend. Candid Wueest, threat researcher at Symantec, said: "Malware authors have realized that it is suspicious when an application detects that it is running on a VM, so they have stopped using those features in recent years."
Malware sometimes lies dormant for a few minutes or set number of clicks in order to bypass sandboxes designed to isolate viruses. According to Wueest, traditional security practices all still apply, but those using virtual machines should pay particular attention to virtual connections.
6) People will still be idiots with their passwords
This year CBR has been flooded with reports about the weakness of passwords, and many of the experts we spoke to highlighted problems with them. Last week’s CyberVor credentials cache confirmed what we already knew: people use passwords across multiple websites, so a hack against one can be a hack against all.
Many are pushing firms to move to two-factor security, as seen in the card readers that banks provide for home use, but until that happens users need to be smart. Networks should ban default or simple passwords, and make sure they are changed every so often. If you must reuse passwords, at least prioritise sensitive data with better passwords. And tell your colleagues to do the same.
