Experts agree that these are three of the hottest themes in cybersecurity this year.
Hot Theme 1: Raising User Awareness of Phishing
Five cyberattacks most commonly victimize U.S. businesses, according to data gathered by Statista. Phishing schemes top the list at 37%, followed fairly closely by network intrusions at 30%. Down the scale considerably are the inadvertent disclosure of data or login credentials (12%), lost or stolen records or devices containing records (10%), and the misconfiguration of systems, system settings, or system software (4%).
Numerous sources have identified phishing as the primary cause of cybersecurity incidents or data breaches.
Key Ingredient. The central ingredient of any phishing scheme is the company employee who is targeted to receive a spoofed email pretending to be from an executive, or from a trusted third-party vendor. The employee is requested to provide information to the executive or to take a seemingly innocent action that will unleash malware or ransomware into the organization.
Those actions typically involve clicking on links, opening attachments, or sending a reply to the spoofed email.
Phishing relies on employees who are too busy, who are distracted, or who are poorly trained in spotting suspicious or spoofed emails. (Or, in rare cases, suspicious or spoofed phone calls.)
Popular Phishing Formats. The most popular phishing format today, by far, is spear phishing. This is a highly focused attack targeting an individual, a group of users, or a single company. It takes a rifle rather than a shotgun approach, in which the phishers criminally gather information about their specific target in order to be more successful.
Another common type of phishing is whaling, which attempts to exploit high-level executives or other high-value targets with appeals they are likely to respond to. Another is clone phishing, in which attackers use a legitimate employee or executive email they have stolen and tweak it to look like an authentic part of an ongoing email conversation.
According to a survey by ISACA, when employees were asked to choose between a secure Internet connection and a fast connection, one-third went for speed over security. And 20% admit to having been victimized by a phishing scheme. Phishing works.
Trending Now. The rising popularity of phishing schemes, due to their effectiveness, has created the hottest theme of 2021: the compelling need to increase user awareness of phishing in all its forms. Employees must be trained to spot phishing scams when they see them, and to report them to their IT executive, CISO, or other designated contact. Training must be repeated and updated periodically, and must also include executives because everyone is vulnerable until their awareness has been sharpened.
Hot Theme 2: Improving Cloud Security
More and more companies, especially SMBs, are using cloud-based services for collaboration, data backups and storage, and other important business needs. These and other services fall under the general term Cloud Computing.
Clients store their data with a cloud service provider and access the data over the Internet. Cloud service providers may maintain multiple cloud locations, and some value security more than others. These facts present a number of data security challenges, most of which are the responsibility of the cloud service client.
According to McAfee, a well-known U.S.-based computer software security company, the cloud computing customer is responsible for protecting their data from security threats and controlling access to it. This is true in every cloud service, from cloud software such as Microsoft Office 365, Azure, and Teams to infrastructure services like VMware and Amazon Web Services.
Common Challenges. One of the most common challenges for cloud service clients is the inability to monitor and control their data as it comes and goes between cloud applications and their users’ computers. This is closely related to having incomplete control over who can access sensitive data in the cloud. Another challenge is the lack of visibility to their data and lack of certainty as to exactly what data is in the cloud.
Recent ransomware attacks have involved large service providers and their multitudes of clients, as in the Blackbaud incident. As a result, cloud service providers and their clients are increasingly becoming the targets of malicious attacks. Many believe that if a company like Blackbaud can be victimized, and in turn its downstream clients, it can happen to any service provider.
All of this has compelled cloud service clients to become more proactive in managing their cloud security, both in-house and at third parties. Increasingly, clients are recognizing that they must implement better controls at virtually all points.
Trending Now. Encrypting data in transit to and from the cloud application is a growing trend. So is closer scrutiny of the security safeguards put in place by cloud service providers. Many clients are beginning to require regularly scheduled security audits and documentation of data breach notification protocols. They are also implementing other measures to hold their cloud service providers more accountable and their processes more transparent.
Hot Theme 3: Addressing the Cybersecurity Skills Gap
The third theme that is driving changes this year is the shortage of skilled information technology and data security professionals. The supply of skilled, experienced, and/or certified labor appears to be shrinking just as demand for these services is growing. This is all the more surprising given our public education system’s focus on science, technology, engineering, and mathematics (STEM) education in the past decade or more.
According to the industry group CompTIA and Cyber Seek, a tech job-tracking database maintained by the U.S. Commerce Department, there were approximately 465,000 open cybersecurity positions in the U.S. as of May 2021. That’s about 5% of the 9.2 million current job openings nationwide across all industries.
Negative Impact. Tech teams are often overwhelmed by the sheer volume of data their networks and systems collect. With staff sizes down due to the skills gap, it is easier for staff to overlook event alerts and improperly prioritize events requiring attention. Often there is no way to separate noteworthy or actionable events from background noise that can mask a data breach or other cybersecurity event.
Clearly, we must continue promoting STEM education among elementary and high school students, and technical certifications among tech workers new to the cybersecurity profession. The need to have humans at the helm is not going away. However, at least one emerging solution promises to address the skills gap sooner rather than later.
Trending Now. The hot trend here is the availability of a growing portfolio of cybersecurity software, including data analytics software, that incorporates machine learning and artificial intelligence. When cybersecurity employees are able to use smarter tools, they can become more productive and effective, even at reduced staffing levels. While data analytics and the use of AI and machine learning are just beginning to be leveraged in cybersecurity, they hold great promise. The use of data analytics can help IT by transforming volumes of raw data into actionable information quickly and accurately. It can help fine-tune intrusion detection, correlate disparate information to spot more subtle anomalies, discover data breaches far faster, and protect data more effectively.
Summary
Three themes are dominating the cybersecurity landscape this year.
The skyrocketing number of phishing schemes leading to ransomware attacks is driving greater corporate investment in employee security training. Spear-phishing targets employees as whale-fishing targets executives and all levels and groups within an organization require training to learn to recognize suspicious emails.
With universes of data stored and used in the cloud, service providers have become highly attractive targets for ransomware attacks that also impact their downstream customers. Those clients are increasingly proactive in demanding accountability from their cloud service providers, as well as in hardening their own cybersecurity for cloud applications.
A cybersecurity skills gap in the U.S. has contributed to IT staff shortfalls and increased vulnerability in many businesses. A growing inventory of cybersecurity software is leveraging machine learning and artificial intelligence to bridge the gap and provide new levels of data protection.
The need for smarter employees, smarter software, and smarter cloud security is driving solutions that are the hot themes of 2021.
