#Security predictions for 2018 from the Advent IM Team
News and information from the Advent IM team.
News and information from the Advent IM team.
Its that time of year. We look back over our shoulder and use the previous 12 months to try and work out what we can expect in the coming 12 months. Sometimes we get it horribly right, such as our prediction of the meteoric rise in ransomware and also that it would start to impact physical systems and lives.
So once again, the question was put to the team at Advent IM, and this is how they answered…
Bold prediction – We will see the first cyber attack on physical assets designed to cause harm driven by ideology – cyber terrorism will finally become a reality. Unprotected physical assets in the IoT are the weak link in the chain for the next 12 months if not more. There will be more not less data breaches and Spring will see a panic around GDPR as many businesses realise they have left too much to do to be genuinely prepared.
Dave Wharton – Principle Consultant:
Like most of us I cannot help thinking GDPR will grab most of the headlines and it will be interesting to see when the first financial penalty will be imposed and whether it will be against a private or public sector organisation.
I also cannot help thinking a major cyber-attack/security breach against a central government dept is overdue (not withstanding Wannacry and the NHS of course. My main prediction though is that nothing new will happen:
• The board will continue to ignore security
• Organisations will still suffer breaches/attacks for stupid reasons
• Citizen personal data will continue to be compromised
The other big thing for next year will of course be Brexit. So I do wonder what will the implications be for data protection and off-shoring . Is it a given that the EU will accept our Data Protection Bill as an adequate interpretation of the GDPR? What hoops might we have to jump through to meet the adequacy requirement or will the UK have to negotiate a EU/US Privacy Shield Framework?
Advent IM Security Consultant:
Insider Threat is paramount, whether with bad intent or by ignorance of good security practices. Increased training with automated tests for staff like simulated phishing/social engineering attacks will probably increase and help to drive the message home but it will still be the biggest challenge for organisations in the quest for cyber health.
Del Brazil – Senior Security Consultant:
There is a distinct lack of understanding and appreciation of the impact that GDPR will bring to the way organisations store, process or capture personal data. This lack of understanding is rife throughout organisations from TLB/MD who may know of GDPR but do not fully appreciated the work required to ensure that their organisation may need to meet the requirements; through to the end processor who regards personal data as important as the daily newspaper and as such treats it in the same manner.
On a slightly different topic….
As always education and awareness needs to be delivered to the right people in the right places at the right time. A large number of recent security related incidents/breaches have been preventable by simply applying basic security principles i.e. ensure patches are up to date, safe guarding property and monitoring/managing user accounts.
So my prediction is that organisations will continue to be subjected to attacks/breaches irrespective of their business and unless staff are given more training/ awareness there are always going to be breaches. Maybe the only way organisations are going to learn is by being hit with a large fine as it seems to be the only way organisations actually take note when there’s an impact to their profit margins.
Steve Foley – Security Consultant:
GDPR: The myth that there is a ‘period of transition’ will catch many businesses out and some may find themselves on the wrong side of the ICO. Elizabeth Denham was clear that in the case of the UK, monetary penalties are most definitely a last resort and the level of guidance and content they have issued makes it clear they want to see businesses raise their game rather than punish them, But not all nations may feel the same way.
Mark Jones – Senior Security Consultant:
Sometimes it feels like very little has changed in the past 30 years I have been involved with the topic e.g. internal threat actors are the main problem, lack of leadership, training the solution but the first thing to be cut, technology seen as a substitute for proper understanding of the risks etc. Brexit chatter will continue to dominate with EU GDPR taking centre stage for a while and as one of our colleagues pointed out, a successful major cyber terrorism attack on our CNI is well overdue.
Emma Clark – Security Consultant:
Firstly, GDPR as stated by many. There seems to be many organisations confused about what is required from them in terms of GDPR and the protection and management of Personally Identifiable Information. Secondly, in turn, Cloud security (or insecurity). I think there will be more problems that arise as users put more and more data on to the cloud and as it is down to the users to secure the information, I think there will be an influx in breaches. With the introduction of GDPR in May , it is going to be even more important as well to ensure that PII stored in the cloud is properly protected.
Lastly, the insider threat. With more education needed around cyber security with increased requirements in industries through 2018, there may be challenges to provide sufficient training and awareness to keep the threat to a minimum.
I see the continued growth of ransomware with the subset of ransomware as a service driving the overall trend. The fact that some businesses are stockpiling bitcoin to pay ransoms is as depressing as it is frustrating. For as long as they continue to pay ransoms, the impact will be felt by everyone as they fund their own and everyone else’s victimisation and place increased funds in the hands of organised crime. I would hope 2018 is the year that businesses realise this approach is folly and start to plan their own resilience and response in a more comprehensive way that helps drive protection for everyone.