What is Cyber Security?
While rapid technological developments have provided vast areas of new opportunity and potential sources of efficiency for organizations of all sizes, these new technologies have also brought unprecedented threats with them. Cyber security defined as the protection of systems, networks and data in cyberspace is a critical issue for all businesses. Cyber security will only become more important as more devices, ‘the internet of things’, become connected to the internet.
What is Cyber Criminals?
Cyberspace is unregulated and cyber crime is increasingly simple and cheap to commit: the Fortinet 2013 Cybercrime Report found that an effective bonnet a network of private computers infected with malicious software and controlled without the owners’ knowledge can be established for as little as $700 (about £420), or can be rented for just $535 (about £320) per week. Cyber criminals can now even buy off the shelf hacking software, complete with support services.
Congruent with the rapid pace of technological change, the world of cyber crime never stops innovating either. Every month, Microsoft publishes a bulletin of the vulnerabilities of its systems, an ever-growing list of known threats, bugs and viruses. For a more complete overview of cyber security threats, mailing lists such as Bugtraq can provide up-to-date resources listing all new bugs.
Gartner’s Top 10 Security Predictions 2016
Today’s security professionals battle threats from outside the organization as well as those from their own employees. But what about threats that they already know exist? The next few years will see a variety of attacks as well as progress in the technologies and processes that prevent them. At the 2016 Gartner Security & Risk Summit, Earl Perkins, research vice president at Gartner, presented the top Strategic Planning Assumptions (SPAs) for security in the next two to four years.
- Through 2020, 99% of vulnerabilities exploited will continue to be ones known by security and IT professionals for at least one year.
Recommended Action: Companies should focus on fixing the vulnerabilities they know exist. While these vulnerabilities are easy to ignore, they’re also easier and more inexpensive to fix than to mitigate.
- By 2020, a third of successful attacks experienced by enterprises will be on their shadow IT resources.
Recommended Action: Business units deal with the reality of the enterprise and will engage with any tool that helps them do the job. Companies should find a way to track shadow IT, and create a culture of acceptance and protection versus detection and punishment.
- By 2018, the need to prevent data breaches from public clouds will drive 20% of organizations to develop data security governance programs.
Recommended Action: Develop an enterprise-wide data security governance (DSG) program. Identify data security policy gaps, develop a roadmap to address the issues and seek cyberinsurance when appropriate.
- By 2020, 40% of enterprises engaged in DevOps will secure developed applications by adopting application security self-testing, self-diagnosing and self-protection technologies.
Recommended Action: Adopt Runtime application self protection (RASP) for DevOps. Evaluate less mature vendors and providers for potential security options.
- By 2020, 80% of new deals for cloud-based CASB will be packaged with network firewall, secure web gateway (SWG) and web application firewall (WAF) platforms.
Recommended Action: While concerns exist about customer migration to the cloud and bundling purchases, companies should assess the application deployment roadmap and decide whether investment is justified.
- By 2018, enterprises that leverage native mobile containment rather than third-party options will rise from 20% to 60%.
Recommended Action: Experiment and become familiar with native containment solutions. Keep in mind that enterprises with average security requirements should plan to move gradually to
- By 2019, 40% of IDaaS implementations will replace on-premises IAM implementations, up from 10% today.
Recommended Action: Enough limitations have disappeared on Identity as a Service (IDaaS) that companies should start experimenting on small-scale projects. While a clash of regulations could derail the increased implementation, companies should work to recognize the current limitations and benefits.
- By 2019, use of passwords and tokens in medium-risk use cases will drop 55%, due to the introduction of recognition technologies.
Recommended Action: Passwords are too entrenched in business practices to disappear completely, but companies should look for products that focus on development of an environment of continuous trust with good user experience. Begin by identifying use cases, and press vendors for biometric and analytic capabilities.
- Through 2018, over 50% of IoT device manufacturers will not be able to address threats from weak authentication practices.
Recommended Action: By changing the enterprise architecture, IoT introduces new threats. Early IoT security failures might force the industry towards authentication standards, but companies should identify authentication risks, establish identity assurance requirements, and employ metrics.
- By 2020, more than 25% of identified enterprise attacks will involve IoT, though IoT will account for only 10% of IT security budgets.
Recommended Action: As IoT continues to grow, vendors will favor usability over security and IT security practitioners remain unsure of the correct amount of acceptable risk. Companies should assign business ownership of IoT security, focus on vulnerable or unpatchable IoT devices, and increase IoT-focused budget.
Posted By: Delicana, Maria Fe BSIT-III