Top 5 Cybersecurity and Cybercrime Predictions for 2020

Compliance fatigue will spread among security
professionals

Being a source of ongoing controversy and debate, the California
Consumer Privacy Act (CCPA) was finalized on 11th January 1, 2019.

Driven by laudable objectives to protect Californians’ personal
data, prevent its misuse or unconsented usage by unscrupulous
entities, the law imposes formidable monetary penalties of up to
$7,500 per intentional violation and $2,500 per unintentional
violation.

The Act is enforceable against organizations that process or
handle personal data of California residents, regardless of the
geographical location of the former. Akin to the EU GDPR, data
subjects are empowered with a bundle of rights to control their
personal data and its eventual usage.

The pitfall is that if every US state introduces its own state
privacy law, one will have to comply with over 50 overlappings and
sometimes incompatibly contradictive regulations only on the US
territory or otherwise face harsh financial penalties or even
criminal prosecution.

Exacerbated by the mushrooming regional, national, and
transnational regulations, 2020 may become a year when
cybersecurity compliance will erode and start its rapid downfall.
In light of the slow judicial system on one side, and insufficient
cybersecurity skills and scanty budgets on another, cybersecurity
professionals may start flatly disregarding the wide spectrum of
superfluous regulations.

Third-party data breaches will dominate the threat landscape

Supply chain attacks are up 78% in 2019, says Symantec. Competitive
and successful businesses are usually distinguished by a high level
of proficiency and specialization, concentrating all available
resources to attain excellence in a particular market to outpace
competitors.

Hence, they outsource most of their secondary business processes
to skilled suppliers and experienced third-parties, thereby
reducing costs, increasing quality, and accelerating delivery.

Sadly, suppliers also operate in turbulent and
highly-competitive global markets and thus can rarely afford a
decent level of cybersecurity and data protection for their
clients.

IBM says the average time to identify a breach in 2019 was as
high as 206 days. Still, even worse, such attacks are infrequently
detected both due to their sophistication and lack of skills amid
the victims, eventually being suddenly reported by security
researchers or journalists and flabbergasting the data owners.

Cybercriminals are well aware of this low-hanging fruit and will
continue to purposely target this weakest link to get your data,
trade secrets, and intellectual property.

External attack surface will continue to expand without
control

61% of organizations have experienced an IoT security incident in
2019, according to CSO Online by IDG. The global proliferation of
IoT and connected devices, usage of public cloud, PaaS, and IaaS
greatly facilitates business and enables rapid growth. Concomitant,
and often unnoticed, is the increase in an organization’s external attack
surface.

Put it simply; an external attack surface is composed of all
your digital assets (aka IT assets) that attackers can access from
the Internet and attribute to your organization.

Traditional digital assets, such as network or web servers, are
usually well inventoried, but RESTful API and web services, hybrid
cloud applications, and business-critical data hosted on external
platforms – are just a few examples of mushrooming digital assets
of a modern-day attack surface that remain unattended.

As you cannot protect what you don’t know, the vast proportion
of these digital assets are not properly maintained, monitored, or
protected in any manner.

The situation is exacerbated by rogue mobile apps, fraudulent,
phishing, and squatting websites, detectable by properly
implemented domain security^[2]
monitoring that now starts paving its road to popularity among
cybersecurity professionals.

In summary, as organizations upgrade their IT and leave behind a
trail of obscure digital unknowns, whether in-house or external,
the easier and faster it is to break in.

Cloud misconfigurations will expose billions of records

Forbes says that 83% of enterprise workloads will move to the cloud
by 2020. Unfortunately, the steady growth of the cloud for data
storage and processing widely outruns requisite security skills and
adequate training among IT personnel in charge of cloud
infrastructure.

Gartner reports that around 95% of cloud security failures
result as a fault of the customer, not vendors of public cloud
infrastructure.

Unsurprisingly, a substantial part of significant data leaks in
2019 stems from misconfigured cloud storage, exposing the crown
Jewels of the largest tech companies and financial
institutions.

In July 2019, the world media reported a breach of Capital One,
being presumably the largest data breach within the US financial
sector and affecting approximately 100 million individuals in the
United States and 6 million in Canada.

Reportedly, the attacker exploited a misconfigured AWS S3 bucket
to download extremely sensitive data left unattended. While Capital
One estimated only its direct losses stemming from the breach to
attain $150 million, the FBI later disclosed that as many as 30
other organizations could have been compromised using the same AWS
misconfiguration.

Foreseeably, in 2020, cloud security incidents will stay atop of
data breach root causes.

Password re-use and phishing attacks will skyrocket

Just for the world’s largest companies from the Fortune 500 list,
one may ferret out over 21 million of valid
credentials exposed in the Dark Web in 2019, says ImmuniWeb.

Cybercriminals prefer rapid and riskless raids to time-consuming
APT attacks, costly 0days, or chained exploitation of sophisticated
vulnerabilities in SAP.

Even if many organizations finally managed to implement a
consumable Identity and Access Management (IAM) systems, with
strong password policies, MFA, and continuous monitoring for
anomalies, few external systems are included in the safeguarded
scope.

Such grey-zone systems range from SaaS CRM and ERP to elastic
public cloud platforms. Even if the passwords found or purchased by
the attackers on the Dark Web are invalid, they provide a great
wealth of ideas for ingenious social engineering campaigns,
facilitate phishing and smart brute-forcing attacks.

Frequently, these attacks, being at first sight quite primitive
from a technical standpoint, demonstrate astonishing efficiency and
relentlessly undermine and decollate the organization’s
cybersecurity resilience efforts.

The solution of the week

To offer our readers a robust and cost-effective solution to
address the five emerging challenges above, we went through
solutions highlighted by Gartner, Forrester, and IDC in 2019. We
considered simplicity, available integrations, and value for money
among the top differentiators.

Today, our preference deservingly goes to ImmuniWeb
Discovery^[4] for three specific
reasons: it consolidates Attack Surface
Management^[5] and Dark Web
Monitoring^[6] in a single offering,
has a fixed price for an unlimited number of monitored digital
assets, and importantly – the vendor actively develops its
community offering now running over 50,000 free security tests a
day, helping cybersecurity professionals.

^[1][3]