Call us now Email a specialist
+353 1 6420100 | info@ward.ie
  • Resources
  • Blogs
    • News

    Cyber Security Predictions for 2020 

    Author: Paul Hogan, Chief Strategy and Innovation Officer, Ward Solutions

    It’s at this time of year that I typically sit back and reflect on the trends in cybercrime and cybersecurity in 2019 and make some predictions around cyber security and the threat trends that we think we may see in Ireland in 2020.

    Ransomware: More of the same but smarter

    2019 was an active year for Ransomware, with a range of targeted and broad indiscriminate attacks. I would expect to see more of the same in 2020, possibly with more targeted attacks, as they tend to be more successful. Where phishing was once the predominant attack vector, there is growing evidence of attacks exploiting vulnerable RDP services on servers as well as other software vulnerabilities.

    Business Email Compromise (BEC) coming to your inbox

    Our incident response service dealt with a BEC related attack on a near weekly basis. In 2020 I would expect to see this trend increase as cyber criminals find more creative ways of executing impersonation attacks, CEO/CFO fraud and BEC. Email in general will continue to be used as an attack vector for threats such as Ransomware and Phishing as well,

    Cloud First must be Security First

    As organisations migrate more and more workloads to the cloud, their attack surface increases and I would expect to see more attacks both against cloud service providers and the apps and data that organisations manage in the cloud. Hacks like those we saw in 2019 most likely will be as a result of misconfigurations of cloud management, identity and security features.

    5G Networks with unprecedented data theft speed

    5G networks will become more prevalent in 2020 delivering high speed access from just about anywhere. This increased access could facilitate theft/exfiltration at greater speeds from expanding attack surfaces. Speed to deploy is also critical with malware based attacks, so we expect to see more attacks from those networks.

    Cyber Terror

    An area that can sometimes be over dramatized, however we do see more and more attacks aimed at industrial processes rather than just data. In 2019 we witnessed nation state activity such as the US cyber operation against Iran last September, in 2020 we expect to see this continue as nation states look to consolidate and extend their influence. And without ruling out the possibility, it’s not something we are likely to see more locally.

    To meet these growing threats its clear that organisations understand their security posture, have in place the right controls and technologies to protect them from advanced threats, and have the ability to detect, respond and recover from the advanced threat that we expect to see in 2020.

    Insights

    Did someone just steal my password again?

    fimg
    Did someone just steal my password again?
    I was reflecting on last week’s news that a Russian gang had stolen over 1.2 billion passwords from 420,000 different sites, mainly through security vulnerabilities exposed using code injection techniques such as SQL injection. Although there is some scepticism to the veracity of this story, it’s clear that large scale security breaches are becoming more and more prevalent.
    For example: In 2011, Sony announced that personal details of over 100 million accounts were compromised. In December 2013 we learnt that Target (a large American retail chain) was hacked resulting in over 40 million credit cards and 70 million addresses being compromised. In May of this year, eBay announced that 145 million accounts were compromised in a massive hack. Although these are not quite a ‘tip of the iceberg’ stories there are lots of further examples out there, some closer to home.
     
    What do you as a user do?
    So as a user when you hear these stories what should you do? Well the best reactive measure when you hear that a website where you have an account has been hacked is to change your password immediately. However even before that happens, and hopefully it won’t, there are some guidelines to help minimise your exposure.
    1. Use strong passwords, ideally a minimum of 8 characters with combination of upper and lower case letters, numbers and symbols.
    2. Don’t use the same password for different sites. The issue here is that a compromised account on one site may lead to your account on another site also being vulnerable.
    3. Use 2 factor authentication where possible. A number of online services now offer alternatives to passwords, see here for further details.
    4. It’s difficult to remember lots of different usernames and passwords so consider using a local password manager or wallet.
    5. Change your password at regular intervals.
     
    What do you as an organisation do?
    First work on prevention; security should be part of your strategic thinking so adopt a security approach designed to protect you by reducing the attack surface area that you present. This typically results in deploying a range of security solutions such as firewalls, intrusion prevention system and advanced threat detection systems. Once in place perform threat based risk and vulnerability assessments at regular intervals to determine just how well your defences are working and what other forms of protection you may need. Finally as a last line have secure incident and event management solutions in place to quickly identify if someone is trying to compromise you and how they are doing it.