Cyber security has rocketed up the agenda in 2015, with the C-Suite and boards, as well as consumers realising the threat is very real, and very serious. It’s only going to rise up further up the scale in 2016.
Here, 10 cyber security industry experts tell CBR what they expect to happen in the 12 months to come.
1. Ransomware becomes a core attack
Ransomware has becoming an increasing concern in 2015, and it’s not going to be going anywhere in 2016.
Raj Samani, CTO EMEA at Intel Security, said: "The trend for cybercriminals in 2016 will in part to focus on what already works (and pays) so we can expect ransomware to be a mainstay throughout the year and beyond. This is in part will be driven by the cybercrime ecosystem that not only provides the tools to carry out crime, but also will be supplying warehouses of stolen data for sale.
Whilst all of this sounds rather ominous, the good news is that 2016 will see the continuation of shared threat intelligence, and partnerships between industry and public sector to target digital threats and those behind such campaigns"
2. The threat from IoT increases
Cars, Barbies…all sorts of things are becoming web connected via IoT, and that gives hackers far greater scope for attack, and this will escalate in 2016.
David Emm from Kaspersky Labs said: "At some point, attackers will turn their attention to using IoT technologies. This could take the form of DoS attacks, i.e. causing a product to fail (e.g. cars), the theft of personal data – directly via a device, or by hacking a provider who collects such data, or the abuse of technology to mask other activities cameras."
Content from our partners
3. Firms forced to innovate and deploy new technologies
Greg Day, Chief Security Officer EMEA at Palo Alto, thinks that the evolving threat landscape is forcing firms to reassess how the deal with cybersecurity, but new EU regulations will also have an effect.
"In recent years we have seen considerable growth in the number of unique attacks. The outcome of this is that existing security techniques become less effective, forcing businesses to look for suitable alternatives to their older security technologies. The point to consider here is whether continuing to respond to security risk by doing the same thing or taking advantage of new technologies will deliver greater success.
"The new EU regulations add to this pressure by pushing businesses to get closer to "state of the art" capabilities when it comes to cybersecurity
4. Growth of third party providers
Stan Black, CSO at Citrix siad "Companies are investing significantly in "extending the perimeter" via 3rd parties providing commodity and advanced services. Managed Security Service Provider (MSSP) are able to specialize or greatly reduce the cost of implementing security technology traditionally found in-house. A few examples are malware, intrusion, spam filtering, white/black listing, anti-virus, etc."
5. Malvertising
Malware delivered via websites has been one of the big stories of 2015, and Raytheon|Websenses’ Carl Leonard says "there’s no reason to say it’s going to stop."
"It seems to still be very effective because the malware authors now, they can host, for a very short period of time on a very high profile website.
6. Phishing
Michael Sutton, CISO at Zscaler said: "Phishing and spear phishing have always provided a primary means of communicating with victims, but as our communication mediums evolve, so too will phishing tactics. We tend to think of email when we consider phasing attacks, but email is only one form of online communication and one that is on the decline in terms of usage.
"We send and receive messages from a variety of applications and protocols from SMS to chat applications to social networks. Attackers recognise this and will continue to evolve and leverage alternate forms of communication for phishing attacks. Fortunately, some of these communication mediums aren’t as wide open and easy to spoof as email is so we have some advantages when combating such attacks."
7. Boost in investment
Simon Church, Executive in Residence at C5 Capital said warns against any return to the excess of the dot com boom, but says investment in cyber security will grow in the 12 months to come:
There’s going to be a lot of money coming in. The European guys still need specialists. There’s a lot of ‘let’s try and find people with a lot of market knowledge and expertise’. The recognition is there."
"I think you’ll probably see more (incubators). You’ve got guys who have cashed out recently now sitting in VCs who are looking do the same thing, perhaps in smaller organisations. Absolutely I think we’ll see that. The overvaluation of companies that we’ve soon in the US we’re seeing in Europe."
8. Moving away from passwords
Craig Lund, CEO, SecureAuth: "In 2016, eliminating passwords is going to be the right thing to do but it’s hard to accomplish.
"Biometrics for example are already catching on with healthcare but other verticals like financial services and consumer portals will follow quickly along. A good biometric solution can have the dual benefits of offering a good level of security while improving the user experience.
"2016 will be the year of adaptive authentication in the main stream."
9. APTs and Nation State attacks grow
Andrzej Kawalec, CTO Enterprise Security Services at HPE said: "By 2016 many cybercriminal cartels will have gained the capabilities and execution networks to rival some nation states. However they will be motivated primarily by financial gain, giving rise to increased use of ransomeware and blackmail, alongside more traditional easy attacks like spearphishing and DDoS.
"Nation state and APT actors will continue to penetrate networks and avoid detection for extended periods of time, evading traditional security countermeasures.
"Adversaries are becoming expert in exploiting the business process and valuechains for less cyber-mature vertical industry groups, such as healthcare, energy, media and entertainment."
10. APIs as an attack vector
Dan Kuykendall, Senior Director, Application Security Products at Rapid7 said: "Security experts are challenged with securing an increasingly inter-connected web of modern applications, APIs, and IoT devices that are constantly accessing, sharing, and updating critical sensitive data. We know that 2016 will bring continued growth, as developers will carry on leveraging API’s and microservices in order to deliver their products and services, and, as a result, expect that attackers will increasingly look to APIs as a path to sensitive information. Using threat exposure management solutions to reduce the risk of a breach through APIs will become a critical piece to any comprehensive security program."
