The year ahead: 7 predictions for IT security in 2020

cyber security digital concept with shield picture id1126779135
iStock

Keeping important data and applications secure from cyberthreats was top-of-mind in Australian organisations of all sizes throughout 2019. In 2020, its importance will grow even further.

Spurred by developments such as cloud migration, data analytics, artificial intelligence and the Internet of Things (IoT), organisations will be on the hunt for ways to improve workflows, reduce costs, and boost employee productivity.

In this environment of constant change, it’s impossible to ensure your hybrid networks remain secure at all times, but that does not mean we give up altogether. This year, it will be critical to make sure that you are doing all you can to stop a threat before it inflicts damage.   Here are some predictions to raise the bar on your security practices in 2020:

  1. Misconfigured cloud resources will remain an issue

During 2019, some of the biggest IT security challenges faced by organisations stemmed from the mismanagement of cloud-based resources. Time and again, Amazon S3 buckets were misconfigured or left open long after the job had been completed.  It looks as though this trend will continue to be an issue during 2020.

Going forward, you can help your organisation by opting for standardised storage methods rather than taking a more unique or bespoke approach. By selecting standard tools, your chosen cloud provider will be able to assist you in understanding what might be broken and how to fix it. Though it will not completely eliminate the problem it does take the right steps to reduce the prevalence of misconfigured cloud resources as the new year progresses.

  1. Risks around third-party security will grow

While you have worked hard to ensure your internal systems are secure, there will continue to be increased risk from third parties in the technology supply chain. A vulnerability you may have patched may still be open in your third party supplier leaving a backdoor open to your network. It’s also a data security concern. For example, a company may be outsourcing a portion of its human resources functions to a third-party firm. The organisation needs to be very clear on what types of data it is sharing with the third party and exactly how that data is used. Extra precaution must be taken to protect sensitive data.

Pay attention to the types of data you are securing. There is a big difference between an external party having access to employee data for processing and having access to a marketing database for outbound sales activity. Employee records are likely to contain personal details such as tax file numbers that need to be locked down from would be hackers. Use your company data classification policy to help you decide on data priority and the protections that must be utilised.During 2020, take time to understand the security of your third party vendors as well as the data that exists within your organisation.  This will give you a more holistic understanding of your potential exposure including how and where your data is being shared externally.

  1. The ongoing IoT evolution will increase risk and sophisticated attacks will grow

As IoT continues to grow and become a greater part of the IT landscape,  the risk of a major breach from an IoT device has increased dramatically. This is largely due to the fact that IoT manufacturers have not made IoT security a top priority. Statistics show that security is severely lacking in the devices themselves and that fact will not change anytime soon.

Attacks in the first half of 2019 were relatively unsophisticated but we expect that attackers will continue to evolve their tactics and attacks to become more damaging. IoT devices are used in critical applications and a compromise will only adversely affect an organization but a person’s health could be in jeopardy, as in the case of a connected insulin pump or critical infrastructure.

According to Moore’s law, processor chips double in power every 18 months, but unfortunately IoT security is not progressing at a similar pace. In 2020 you will need to be aware of what is connected to your network and exactly how it is protected. Patching IoT devices needs to become a greater part of your IT priorities.

  1. Security issues won’t just matter to the big end of town

While media attention naturally focuses on the high-profile cyber breaches, the ones we don’t hear about are a bigger concern. Smaller organizations that are hit with a breach will not be able to recover if they suffer a severe loss of data or IP.

Without the big budgets of a larger enterprise, smaller organisations are an easy target for hackers who look for financial gain or to inflict reputation damage. In the past few years we’ve seen good statistical models of common passwords. We’ve also seen bad actors trying low and slow login attacks with these known passwords and known accounts. Organisations with a lower security maturity may use these passwords to secure data and applications.

With this in mind, more mature firms will move more of their data and applications to the cloud. If this is your plan, make informed decisions about what data should be shifted to the cloud and how it should be secured when there.

  1. Security staffing shortages will find new creative approaches to ease the burden

Given the fact that organisations can’t find and retain as many security  specialists as they require and budgets remain constrained, more creative approaches will surface in 2020.  A greater reliance on a team approach between network and security teams will lead to more successful outcomes. A single viewpoint that helps teams analyse network data to detect threats as well as performance problems will speed operations and lower MTTRs.

The Cloud Security Alliance’s Cloud Control Matrix provides clear guidelines for organisations considering moving their data to a cloud platform. Frameworks such as the US National Institute of Standards and Technology (NIST) Cybersecurity Framework can guide activities when it comes to security. During 2020, evaluate these alternatives and determine which is right for your organisation.

  1. Passwords will remain the weakest link

It’s been the case for years that passwords offer relatively week protection when it comes to data security. In 2020, consider deploying multi-factor authentication across the board.

Investigate  advanced protection initiatives being promoted by companies such as Google’s USB-C Titan Key  firmware which is permanently sealed into a secure element hardware chip, which they say makes the key more resistant to physical attacks. An approach like this can add significantly to the protection that is already in place for critical data stores.

  1. Awareness and Usage of DoH will grow more widespread

In 2020 there will be increased adoption of DNS over HTTPS (DoH). This is a trend that touches two major technology trends. The first is the increasing use of encryption on both the public internet and inside enterprise networks. The second is the so-called "privacy-washing" that’s happening to new technologies.

To date, browser vendors have positioned DoH as a privacy enhancement for users. The actual effect of this change is to move DNS out of the operating system and into the control of the browser application. The net effect is to reduce or obscure user choice about how their data is handled while providing only modest security and privacy benefits in return.

During 2020, evaluate DoH carefully and determine what value it would bring to your organisation if deployed.

We are getting smarter about security but as we evolve so do the hackers. It’s important to take inventory of your current state of affairs and assess what you can do differently in 2020 to protect your organisation. Together, these seven trends will help you shape your approach to cybersecurity during the next 12 months. Now is the time to focus on what lies ahead for your organisation to be in a much better position to tackle new challenges as they arise.

Related:

Copyright © 2020 IDG Communications, Inc.

The 10 most powerful cybersecurity companies