2019 Cyber Security Predictions
Fed up with ridiculous infosec predictions for the upcoming year, I decided to aggregate them all and use the power of Markov Chains to generate my own list. What follows is the result, very lightly edited solely for readability. You can see last year’s edition here.
In 2019, we predict 2019. Cyber espionage, cybercriminals — in 2019, they materialize. What if this is a dangerous reality? For example, consider how the world feels sometimes. According to Ponemon, security leaders around the world feel sometimes.
During 2019 we expect to see an increase in cyber space. The prospects are understatement. If a sophisticated attack involves not one but five top-notch threats synergistically working together, the defense panorama could become very blurry. Security experts have a recipe for disaster.
We predict that criminals will further focus their efforts injudiciously, ignoring the lower severity vulnerabilities with known exploits in favor of largely academic high severity vulnerabilities. In 2019, we will see a version of this fictional attacker.
The purchase of cybersecurity has led to expanding attacks that will become more sophisticated in 2019 and beyond. We will continue to influence societal expectations on security, which will trickle down to companies through hundreds of thousands of vulnerable and easy targets for attackers to profit. Driven by many falling victim to feature misconceptions, more will become key targets. Cyber products that provide consolidated feature sets have a hard time understanding each customer’s specific pain points and the bad guys know this.
In 2019, even more high-profile breaches will push the security and privacy, finally. Security is argued about until we die. That’s a particularly terrifying threat.
Prediction #1: AI TECHNIQUES: ATTACKS WILL RESULT, HACKERS
In this day and age of big data, artificial intelligence is the next weapon. The gold standard in hacking efficiency, weaponized AI offers attackers unparalleled insight into what, when, and where to strike. Attempts to weaponize AI offers attackers actual attacks. Systems could launch coordinated cyber criminals to increasingly AI. Is it a matter of anomalies.
AI could be exploited and could also leverage machine-learning and artificial intelligence and machine-learning technologies. The consistent threat is very real. In 2017, a Vietnamese security group claims to have created a mask that can learn incrementally from data scientists providing frequent feedback.
We predict AI-powered attacks become the keys for email scams. For example, imagine a fake AI-created phishing using AI to aid assaults. Unlike humans, machines can do it in seconds and continue even after business hours. They have gotten smarter about phishing and other human activities such as opening doors. Closer to home, AI will expose the mistakes they’ve made regarding human activities.
Automated systems powered by AI could also be used to evade detection by infrequently trained machine learning engines. This game of cat and machine-learning technology will be an investment in the new year. There will likely be future attacks focused on building robust centers for security breach infringement, but the AI bubble has many experts worried.
In 2019, we will see brute force attacks powered by AI. The attack requires automating out all the less interesting stuff so attackers can focus their resources on such attractive, data-rich environments, with no downtime to these utilities. More corporate attacks based on math will propel this trend forward.
Prediction #2: THE AI SECURITY SOFTWARE HAS MALICIOUS INTENT
Skynet is becoming broader and more expansive. To combat this, organizations have turned to the promise of big data, artificial intelligence (AI), and machine learning. Automated systems powered by AI could help people better understand the tradeoffs involved when they give up personal information in their malicious software.
The fragility of some AI technologies will become the picklock that opens a much larger door. Certain algorithms may be too late. 2019 will demonstrate a lot of the “AI Winter” of 1969, in which Congress cut funding as results lagged behind lofty expectations. AI will bolster security in 2019 to a total of $206.2 billion, up from $175.8 billion in 2016, down to $14 billion by 2025.
The buzz for cybersecurity AI is expected to grow in popularity. As the report notes, the pure-play AI security story also has a dark side — they will start scamming you. In addition, certain algorithms may be too complex to understand what is driving a specific set of security firm activities that are popping up in Cyber Town, USA.
AI start-ups are going to exploit the growth of attacks. Analytics solutions will extort companies with 1,000 or more slippery endpoints. Based on developments we are seeing, this change will come as all teams recognize that cybersecurity AI in the purest sense is nonexistent, and we will continue raging.
Prediction #3: CLOUD WILL SLIP OUT INTO THE WILD
Cloud adoption will begin to expand the world (though many dispute this story). By default, cloud is sensitive data. Also, the internet. In 2019, attackers will hold the internet hostage on a computer disc with Internet written on tape in sharpie.
Cloud adoption is game-changing in the threat equation. Many of the tried and true attacks of five years ago don’t work very well in the cloud. Organizations are rapidly shifting content to the cloud, therefore we predict a shortfall of 3.5 million cyber threats that demonstrates a real demand for these easy pickings.
Organizations will struggle to manipulate public cloud and will experience a massive security priority for 2019. Emerging technologies used to protect the cloud not only help capture the big picture but also are less effective at mitigating. Cloud and DevOps teams’ security experts are worried.
Prediction #4: CRIMINALS GROW MORE CONFIDENT IN DEMANDING THAT RISKS INVOLVE THE CLOUD
Cyber criminals will use big-scale platforms to create instead of just one, five top-notch threats in today’s landscape. Such threats would be very difficult for hackers. Attacks are usually centered on the use of one threat. Bad actors concentrate their efforts on iterating and evolving one threat at a time for effectiveness and evasion.
With an attack surface of automated prevention methods, like embedded human microchips, for example, attackers will generate new threats such as AWS and Azure. Large-scale data breaches will be attributed to misconfigured Amazon S3 buckets. This is clearly not the fault of AWS. IDG, for example, calls 2019 “a seminal year” on the criminal to-do list, since criminals can silently steal thousands of open buckets and credentials.
Still, I make a brilliant, contrarian, and very accurate prediction: You might lose the data. There will be surprises, too, says Captain Obvious.
Prediction #5: IOT-POWERED DISTRIBUTED DENIAL OF CAT
The security breaches will be IoT. There is an ever-increasing probability that these devices make their vulnerabilities. The Future often uses an IoT botnet, which runs the entire network. In one example, an attacker could compromise or alter a chip or add source code to avoid or delay botnet takedowns.
Another challenge is the newest form of an attack that combines card enumeration with smart gadgets, from plugs to TVs, coffee makers. In transportation, data has been accused of sneaking into a site connected to traffic lights. With IoT growth posing huge unknown risks to enterprises with the internet, which runs entirely in memory without effective mitigation, this tactic works. Refrigerators and washing malware will be undetected.
“I think the big innovation is in best practice standards for IoT” — Damon Ponemon, Vice President of Technology to Detect Evil.
Prediction #6: EVOLVING DEFINITIONS OF PRIVACY
This year we highlighted privacy, finally, due to the European Union’s mid-2018 implementation of the internet. Nearly every nation has not been able to settle on a standard of constant privacy, which will continue to exacerbate in 2019. Singapore and India are consulting to adopt breach notification regimes, while Australia has already enforced GDPR-like legislation due to lack of attribution and accountability.
The Data Protection legislative and regulatory environment will become the de facto method for spreading malicious scripts directly on targeted subjects and organizations. The U.S. government will give birth to more advanced technology and employee training in order to distribute it quickly and surreptitiously to malware. Congress is already working on an RDP option.
“Managing privacy will become a huge priority for the C-suite and board” — Prasad Woodridge, More Compliance Officer
In 2019, black hat hackers will penetrate critical aspects of GDPR to become broadly deployed threats. The internet itself is ripe for the taking by someone with PCI or SOX. Well-crafted emails designed to avoid detection are likely to be life-threatening; however, we’re unlikely to see upticks in legislative and regulatory activity. With this in mind, even an organization that erased event logs and backups to avoid investigation will have to decide whether something that happened was supposed to happen.
Prediction #7: MALWARE BOTS TEND TO SPREAD CHAOS
In 2019, we predict malware. Attackers will undoubtedly continue to evolve their tactics to steal credit cards and credentials. Malware authors will turn to either more targeted attacks using embedded chips on printers or use ransom techniques, including the manipulation of memory space and adding arbitrary code. Because the attack landscape continues to evade AI-based solutions, attackers will be able to use this naivete to their advantage and pull off a major attack with ransomware.
There is a race to get the most troubling widespread ransomware-as-a-service. These attacks often have costs far beyond the ransom itself. There is evidence that the author of GandCrab is already working on their marketing campaign to extort companies by threatening the data lakes. What can we do? What is permissible? What if we are missing the reasons synergic threats are becoming more than just real people? We will continue to falter.
In 2019, we’ll see the emergence of new threats such as cryptocurrency and the overwhelming demand for the large amounts of computing. Inevitably, there will be a battle as to which is more convenient than ransomware. An example is WaterMiner, which simply stops its mining process when the consumer is just about die.
Prediction #8: IDENTITY SUPPLY CHAIN MEETS BLOCKCHAIN
In 2019, cyber activities collide with physical worlds. New techniques will use attacks on critical infrastructure of blockchain, with a touch of “Huh?”
In 2019, the next vector in attacks will continue — privileged accounts, because bots. Identity is a fundamental shift in risk. Identity providers are exposed to an increase in the Open Authorization standard. Access management solutions are actually the intended malware — one was launched by Fancy Bear, the Russian cyber espionage.
“Edge device” breaches will push the security industry to finally solve the username/password problem. The ineffective username/password conundrum has plagued consumers and businesses for years. AI could be used in the hope that 2019 will see a more concerted effort to replace passwords altogether.
A ‘zero trust’ approach requires an organization and AI-enabled malware. This ‘zero trust’ approach can open up several attack vectors. First, it transfers risk and no one can rest easy. Second, organizations end up creating their own criminal activities. The embrace of Google’s BeyondCorp is a strategic guess by taking intelligence, which will become more clear across the field.
Prediction #9: NATION-STATE ATTACKS WILL CAUSE THE U.N. TO COME TO SOME CONSENSUS
2019 might just be the toughest in the United States to date. While a direct cyberwar is not on the horizon, a nation-state will launch a “Fire Sale” attack: electronics on fire. You may remember the fictional concept of a “fire sale” attack from the 4th Die Hard movie, in which a terrorist demonstrated this.
Governments will be fed a false sense of security intelligence from tapped infected machines. Nation-states have launched huge distributed denial of services, Bitcoin mixers, and counter-antimalware services. These attacks mean governments are deeply suspicious of each threat actors’ criminal groups.
Brazil recently passed new process-injections and erased event logs to aid trade wars. North Korea, meanwhile, has allegedly attacked public and privacy needs. We are looking forward to seeing a steady increase in Iranian attackers that will continue to fall further and further behind in competency and integrity.
Prediction #10: THE PUBLIC CLOUD WILL EXPERIENCE A MASSIVE SECURITY ATTACK
The worldwide public cloud will experience a massive security attack
The worldwide public cloud will experience a massive security attack
The worldwide public cloud will experience a massive security attack
The worldwide public cloud will experience a massive security attack
The worldwide public cloud will experience a massive security attack
The worldwide public cloud will experience a massive security attack
The worldwide public cloud will experience a massive security attack
The worldwide public cloud will experience a massive security attack
The worldwide public cloud will experience a massive security attack
The worldwide public cloud will experience a massive security attack
The worldwide public cloud will experience a massive security attack
The worldwide public cloud services market is still taking shape, with many brands still looking to develop weapons in the creation of malicious executables.