Hardly a week went by in 2018 without news of a major data leak or security breach. Ransomware and phishing were invasive, state-run hackers were working around the clock, passwords were leaking, new sophisticated malware attacks were spreading, data was breached and governments around the world once again spurned privacy rules—not to mention the concerted nation-state misinformation campaigns designed to influence U.S. voters through social networks in the 2018 midterm elections.
To the surprise of no one, knowledgeable professionals, such as NordVPN’s Digital Privacy Expert Daniel Markuson, warn that 2019 will keep getting worse.
“The year 2018 not only (yet again) shocked the world by highlighting systemic cybersecurity issues,” Markuson wrote in a media advisory to eWEEK. “Multiple governments adopted new rules and laws, which are making a global impact now and will echo for years to come. Still, 2019 can bring some hope for the future—but only if governments and corporations understand the importance of digital privacy and security.”
Here is a list of security predictions for 2019. The first five are significant trends Markuson sees that will shape cyber-security and digital privacy during the next 12 months.
Identity theft, phishing scams and personal data loss will hit a new high: “From Facebook and Google to Quora and Marriott, this year’s data breaches have affected more than 1 billion people around the globe. Add that to the existing pool of leaked data, and hackers will have an invaluable resource for tailoring a phishing scam or taking over your Facebook or Netflix account. Without a doubt, it will be used in 2019.”
Some governments will lean toward higher data-security standards: “The GDPR [General Data Protection Regulation] in the EU established a new set of game rules by regulating the way corporations protect the data of their customers. It is still early to tell whether the new regulations have made a positive impact, but they have brought a shift towards more responsible use of private data. In 2019, some non-EU countries will likely follow the example and introduce a similar set of laws for data protection as well. This year, all eyes will be on the U.S., where California has set a high bar by passing the Consumer Privacy Act. However, it is still unclear if other states will follow. Hopefully, they will.”
Use of encrypted communications will face new challenges: “In December, Australia passed the Assistance and Access (A&A) bill, also known as anti-encryption law—all despite an uproar within the society. The bill requires tech companies to create backdoor access to the encrypted communications of their users. It would be used by law enforcement agencies to intercept and read the content of the private messages. Despite the opposition to the law, similar ideas have been floated in multiple countries including the U.S. Having in mind the everlasting itch to spy on their citizens, it wouldn’t be a shocking surprise if other members of the ‘14 Eyes’ countries would follow this example in 2019.”
[Editor’s note: VPN services are located in 14 “Eyes” countries and territories. Definition: Five Eyes (United States, United Kingdom, Australia, Canada and New Zealand); Nine Eyes (Five Eyes + Denmark, France, Netherlands and Norway); and Fourteen Eyes (Nine Eyes + Germany, Belgium, Italy, Sweden and Spain).]
Tech companies will look for new ways to win the trust of their potential customers: “A lot of data has been stolen this year. This is all despite the companies’ size and significance, despite the self-proclaimed ‘best security practices,’ despite the risk of being fined under the GDPR. It’s no surprise that ensuring customers’ trust will become more critical than ever. Companies will learn (although slowly) from their mistakes and invest in penetration testing, security audits, AI [artificial intelligence] and implementing zero-trust policies to prove that they are making an effort to protect their clients.”
Cloud security will become a bigger issue: “As people change locations and devices, cloud computing becomes inevitable both for private users and corporations. At the same time, it becomes a bigger security problem. GoDaddy, Los Angeles 211 center, Viacom and recently the United Nations had data records harvested from cloud storage. The biggest issue is still simple configuration errors and user neglect. Nevertheless, as we can expect more leaks and breaches here, new cloud security measures and services will come out in 2019.”
————————————
Chester Wisniewski, Principal Research Scientist, Sophos:
Opportunistic ransomware isn’t going away; Matrix and Ryuk are frontrunners to watch: “The authors of opportunistic ransomware operate similar to a penetration tester in the way they scope out the network, looking for vulnerabilities and weak entry points. However, unlike penetration testers, cybercriminals then act on their findings in a methodical way to inflict maximum damage. They stake out victims, move laterally throughout the network, manipulate internal controls, and more. This human-centered approach has proved successful, with the authors of SamSam ransomware collecting $6.7 million over the course of almost three years. Other cybercriminals have taken note, and in 2019 we will see more and more copycat attacks. In particular, Matrix, which appears to be constantly approved upon with new versions, and Ryuk, which is geared toward enterprises and large organizations that have the funds to pay up, will be strains to avoid.
“Next year, organizations will need to implement security technology that prevents threats from happening in the first place, and also provides lateral movement protection to isolate and stop the spread of stealthy ransomware that could be moving throughout the network.”
To keep up with mobile malware, two-factor authentication will look different: “Mobile malware has remained steady over the last few years and will continue to be a problem in 2019 as cybercriminals find new ways to target the high-powered computers we carry around with us every day. For example, delivering six-digit secrets via SMS text message is a common method for two-factor authentication, yet we see this being compromised by criminals using malware and even SIM swapping attacks. In 2019, we hope to see the industry make a more concerted effort toward push notifications for two-factor authentication, which are much harder for cybercriminals to intercept or redirect.”
Cybercriminals looking for an easy buck will follow the path of least resistance—servers: “Cybercriminals prefer to inflict the kind of damage that offers the best chances for success, and with the smallest effort and chance of detection. It’s a balancing act of risk and reward. In 2019, this means we’ll see an increase in cybercrime relegated to servers. In recent years, companies have invested in next-generation technology to protect endpoints, but server security has fallen to the wayside despite the high-value data often stored there.”
————————————
Kyle York, Vice President of Product Strategy, Oracle Cloud Infrastructure:
Good bots, bad bots: “There are good bots and bad bots on today’s Internet. I predict that 2019 will be the year that the market becomes painfully aware of just how damaging the bad ones can be to enterprise brands. As more and more applications and workloads move to run on hyper-scale cloud providers, it is imperative that these vendors decipher the difference, allow only clean traffic, protect your assets, secure your data, and keep a positive end-user experience for all your constituents. Reputations are at stake everywhere, and we all must be vigilant.
“In 2019, more sensitive workloads will move to the cloud. Enterprises will come to the understanding that the only way to achieve the economies of scale necessary to secure these workloads will be to consolidate them with a cloud provider that has the resources to support them.”
Laurent Gil, Security Product Strategy Architect, Oracle Cloud Infrastructure:
Botnets will behave like humans: “As security technologies and practices improve, hackers will increasingly use botnets that behave like humans, making it harder to identify bad actors. Such malicious traffic will hide within the mass of regular, legitimate human-based traffic—just a few hundred bad requests among millions of good, human requests. This approach will require much more sophisticated behavior-based analysis, powered by artificial intelligence.
“Enterprise multi-cloud strategies are going to have some unintended consequences. As enterprises accelerate their move to the cloud over the next two to three years, their security operations centers (SOCs) will have to become fluent in powerful data analytics systems. These systems must be able to ingest and reconcile incompatible and apparently uncorrelated security events, using massive compute capacity, and organize relevant security events for human analysts.
“Preying on server exploits that may be harder to patch or monitor, cybercriminals can get deep within a company’s network to inflict serious damage, while cryptominers can hang out unnoticed for months stealing a company’s resources, just to name a few dangers. As a result, in 2019, companies will need to rethink their server security with a layered approach that includes server-specific protection.”
————————————
John Heath, Directing Attorney at Lexington Law, a provider of combined identity theft protection and credit repair services:
The spread of the digital footprint: “Seemingly arbitrary choices that you make on social media and online could soon be used to determine your entire financial future. Questions we will need to ask include: What will that will look like for the average consumer? How will it impact privacy and freedom of speech laws? What should consumers do now to prepare and protect their financial futures?”
Security breaches’ continued impact on credit scores: “With hackers stealing so much personal data from consumers, it could easily be used for credit card fraud and identity theft, putting their credit scores in jeopardy. Questions: What steps can consumers take to protect themselves and their credit scores from potential threats? What should they do if they are hacked in the future?”