Year: 2016

This post is part of an ongoing blog series examining “Sure Things” (predictions that are almost guaranteed to happen) and “Long Shots” (predictions that are less likely to happen) in cybersecurity in 2017. 

Based on the trends we are seeing within the mobile industry, here are some predictions for 2017:

Sure Thing: Cyberattackers will target service providers by tapping into wide network of IoT devices
We have seen how IoT and wearable technology can be used by cyberattackers to launch unprecedented levels of volumetric attacks aimed at taking down specific websites and applications. These attacks will now increasingly be aimed at taking down critical service-provider network infrastructure that cause wide-scale disruptions of mobile and other connected services. Service providers will have significant pressure to shift their security posture and leverage advanced network-based mechanisms to prevent these types of malware infections from reaching IoT devices that are connected to their networks.

Sure Thing: Cyberattackers will increase their emphasis on exploiting mobile device users, and mobile device infections will exponentially increase
Consumers continue to increase their reliance on smart devices and mobile applications to manage their digital lives, making themselves easy targets for cyber criminals and creating a ripe environment for the spread of many different types of mobile malware. This trend will degrade overall trust that consumers have in their mobile services and create a new challenge for service providers, which will spur providers’ increased focus on protecting end user services and preventing potential negative impacts on their brands. “Is it the service provider’s fault” will be a common debate.

Long Shot: Cyberattacks on mobile users will become the leading cause for churn

Research has shown that consumers would rather lose their wallets than their mobile phones (and now some are using their phone as their wallet). A recent Accenture survey of smartphone users revealed 62 percent are concerned about the security of their financial transactions; 60 percent are dissatisfied with their connectivity and experience; and 47 percent are concerned about privacy and security. Altogether, a majority of them are ready to switch providers, partly because they feel their current ones don’t help safeguard their critical properties. Mobile operators will shift focus to develop new strategies that ensure the security of customer devices and prevent an erosion of customer trust that leads to lost business.

Long Shot: Service Providers will market IoT security as a competitive advantage

Over the years, service providers have tended to define network security pretty narrowly, with a prime objective of maintaining network availability and no real need or obligation to secure end user devices. This may have been sufficient for operating successfully in the past, but the landscape is now changed, with an expanding mobile attack surface and growing occurrences of infected IoT devices launching malicious attacks. The implications to service providers are significant, especially considering that IoT is being counted on to help fuel the next wave of mobile-service revenue growth; providers have no choice but to now embrace IoT security as a means of enabling future business. Who wants to be the operator that allowed a hacker to take over thousands of cars or the operator that is labeled as “less secure” than its competitor?   Service providers will begin to adopt advanced network-based IoT threat prevention mechanisms, and they will begin marketing to potential IoT customers with security as a competitive advantage.

What are your cybersecurity predictions for service providers? Share your thoughts in the comments and be sure to stay tuned for the next post in this series where we’ll share predictions for Japan.

Peter Margaris

[Palo Alto Networks Research Center]

2016 was a challenging year for organisations particularly as cyber adversaries achieved high-profile success, mainly with ransomware. Organisations in Asia-Pacific are no exception. The year also taught a valuable lesson that no industry vertical is safe; if there is a hole in your security, a determined adversary will find it.

2017 should be an opportunity for organisations to instigate a regular program of security risk assessments to stay ahead in cybersecurity. New technologies and ever-increasing levels of connectivity are transforming businesses and unlocking business development opportunities across the region.

Being aware of security concerns doesn’t mean avoiding new technology altogether. It’s about being sensible and trying to stay ahead of cybercriminals by understanding current and potential threats and what can be done to mitigate the risk.

What are my predictions for Asia-Pacific in 2017?

1. Industrial control systems may turn against you

Industrial control systems (ICS) are an integral part of any business, especially in Asia-Pacific. These include building management systems, heating ventilation and air conditioning (HVAC), and security doors, just to name a few.

Most businesses outsource their building management requirements so they don’t necessarily know whether the third-party provider has adequate security in place. It’s not impossible for a malicious actor to execute an attack that could cause significant damage.

For example, an attacker could turn the heating up in a company’s server room or data centre to 50°C and then disable all the building access points so no one can get in to physically remove hardware to a safer location. The hardware would eventually overheat, causing significant disruption to a business, its customers and its partners.

What you need to consider:

• When you think about it, nearly all businesses could be at risk of an attack like this. Business leaders have to consider security beyond the basic steps of protection. Organisations need to gain an overarching view of their potential weak spots through third parties as well as their own network. Additionally, they need to put a plan in place that would help counter any potential attacks.
• Have you checked what non-IT equipment your business depends on and what security they have enabled? Are they connected to the internet, managed by a third party?
• When outsourcing to a third party, what level of security assurance do they have in place? Are they able to provide information to you on how they secure themselves and, ultimately, how they secure and manage your network and systems?

2. The Internet of Things (IoT) devices will be a target for cybercrime

Market research firm Gartner predicts that the number of connected ‘things’ will rise from 6.5 billion in 2015 to almost 21 billion by 2020. This will result in better customer experiences, with connected devices providing information on everything from when the brakes on a bus need to be replaced to whether all the machines on a mine site are running within acceptable parameters.

However, connected devices will also be a target for cybercrime, even more so because people place enormous trust in third-party vendors being safe. These endpoint devices provide thousands of potential entry points to an organisation’s network. They need to be secured. In 2016, we saw the first real challenges appear where compromised devices were connected together in a botnet to launch attacks against banks and key parts of the internet infrastructure.

Anything that you connect into your computer or network is a potential risk. The types of devices range from CCTV cameras to tiny sensors attached to complex machinery, and they may not always be top of mind for security professionals. But if they are connected to the internet or managed by a third party, then they could put the business at risk.

Committed cybercriminals will use every trick in the book and be creative in trying to access the information they want, and look at what ways they can gain entry.

What you need to consider:

• It is important to understand that the IoT is not a possibility or a project of the future – it is a current reality. Make a point to ask suppliers involved in security assurance how they can assure the security of the devices they provide. As we have seen many times, there may be no security, or the devices could be using some default username or password. These should be changed from the moment they are on your network.
• Any devices using factory settings for security are simply asking to be compromised. IT managers must change those standard administrator passwords to avoid being targeted.
• These devices should also be regularly checked to see if they adhere to the company’s security policy.

3. We may see a ransomware vortex with a nasty surprise

Ransomware involves attackers locking up a business’s data and demanding a ransom for its release. If you thought 2016 was bad for ransomware – where attackers access data and ransom it back to the victim – then 2017 will be worse. We can expect to see a higher attack volume, using more sophisticated technologies. If the discovery of Locky ransomware was anything to go by, financial malware will continue on an upward trajectory in 2017.

The kicker will be that, because enterprises and individuals have previously paid, more than likely the prices will increase. There have been cases where the ransom was paid, the data was unlocked, and then the victim was hit again. Paying to unlock one or more machines in your organisation doesn’t provide immunity from a threat that could be spreading in your environment. Our advice has always been: don’t pay.

What you need to consider:

• If you have fewer than 72 hours to respond, do you have a comprehensive backup strategy and response ready to counter these attacks?
• When was the last time you tested and verified the backup?
• Have you applied basic file blocking to prevent threats from entering your organisation? Certain file types can be a risk to your organisation. Ask yourself, “Should we allow all files or should we manage the risk by not allowing malicious files types that may cause an issue?”

4. We will have serious data trust issues

People will continue to be too trusting or fooled into thinking something is safe when it really isn’t. For example, confidential data can be exposed, or made available, that looks like it comes from an organisation, when it was actually planted by a malicious party. Either way, there’s a business reputational risk and a monetary price to pay.

For years, information security professionals have been focused on a model known as the CIA triad, which looks at Confidentiality, Integrity and Availability and is designed to guide policies for information security within an organisation. Many organisations have long looked at confidentiality as a means to protect their data from theft or availability as a means to ensure they can access their data or systems, but how much time has been spent focusing on the integrity of the data or systems?

Imagine a data project, years in the making, where the data an organisation has been collecting and analysing is corrupted. For example, a resource company that has invested heavily in research and development is prospecting for the next drill site where they collect petabytes of data, but an attacker manipulates the information, rendering it worthless. If the integrity of the data is manipulated, where a few bits of information are changed, the company might drill in the wrong spot, wasting time and money and potentially creating an environmental disaster. This could cause companies to make incorrect decisions with significant ramifications. The same could be said about cases where systems have been wiped after an attack, removing all traces that it happened.

Another frightening example is personalised medicine, where the genetic makeup of a person is known and so well-understood that, rather than doing trial and error on which medication works, doctors can tailor exactly the right mix and dosage. If an attacker changed the data on a program such as this, it not only has an impact on the effectiveness of the drug but also could have a lasting negative impact on patient, or even threaten their life, so the stakes are incredibly high.

So What Can Be Done?

Firstly, any business should welcome these changes as they are a way to further digitise services and enhance our way of life. But with any move to further digitising services that we offer or are offered to us, we need to ensure that the data is protected. Verification should be at the centre of all platforms, at every stage of development, and at the core of every provider-customer relationship. Its integrity must be protected from being modified by unauthorised parties. Data must only be made available to authorised parties to access the information when needed.

What you need to consider:

• Businesses need to look at two key things: where their sensitive data resides and what data is critical to the business to operate. Somewhat surprisingly, many organisations struggle to answer this question. This can lead to misappropriation of resources in the form of security controls being used broadly across the entire organisation, rather than being targeted to where they’re needed most. This then results in increased cost to acquire and use security measures.
• Who amongst our employees has access to our sensitive data? Simply knowing who has access to documents or big data stores stops short of understanding to what they have access.
• A key way to reduce risk to sensitive information is to also understand how the data is protected. Is there protection in place, and does it meet the right level to mitigate risk for something that could be mission-critical to a business?

What are your cybersecurity predictions for 2017? Share your thoughts in the comments.

Sean Duca

[Palo Alto Networks Research Center]