Cyber Security: End of Year, 2021 Predictions, and What Have You

Just like an employee performance review, its tradition that we sit and review the year; we take note of the ups and downs, the lessons learnt, make predictions for the next year, and make a plan. However, unlike an employee that really wants to keep their job or bonus, a year is unpredictable. Sometimes we are right, and sometimes we get blindsided like the sudden death of beloved Grant Imahara (I spent that week watching Myth Busters).

Moving on from the trauma, we are here to talk about Cyber Security in 2021! Entering 2021, don’t be surprised to see last year’s slew of cyber attacks still being a thing:

• Ransomware as a Service (RaaS) against world and state organizations, governments, and institutions, such as California University and Tillamook County;
• Data Breaches against Fortune 500 companies such as the Experian Breach and Mitsubishi Electric, and world organizations such as WHO;
• and, Application exploitations such as Zoom.

So What’s Beyond the 2020 Horizon?

That’s a good question.

We already know what to expect in 2021 based on the current events: More ransomware, more data breaches, more zero days, etc. However things might get a bit busier for Cyber Security teams as the rate of ransomware attacks is predicted to increase to every 11 seconds.

But you came here to talk about the new things, right? Well, think big — bigger than a company, a state, a country. Think galaxy.

CS in Space

If you haven’t watched Netflix Original series Space Force starring Steve Carell, you should. Just like in the show, the United States introduced a new military operations branch called Space Force, and most recently VP Mike Pence announced members of Space Force are called Guardians — which is quite fitting.

This operations team is focused on orbital warfare, space battle management, space access and sustainment, military intel, and cyber ops. It sounds a little extravagant right now, however space cyber warfare is already at risk. We have increased our reliance on space systems for entertainment, weather, and national and international security, and the simultaneous emergence of counter-space capabilities is making the space domain more competitive and contested than before.

So what would happen if one of these systems were compromised by state actors?

We don’t have systems in space that can replicate what happened in the movie Geostorm where satellites are hacked and are used to manipulate Earth’s weather causing extreme damage, but we do have enough to cause wide spread panic with misinformation and disinformation, resource and communication outages, that could have catastrophic results and maybe a war.

Back to Earth and Onto Our Roads

As of now, there are 4 cities that are competition to implement autonomous vehicles, and many companies are racing to create a fully autonomous car. The idea of a self-driving vehicles is both a luxury for consumers, and a nightmare for cyber security.

In 2017, the Guardian predicted that by the end of 2020 there would be ~10 million autonomous cars on the road, but we aren’t even close to that.

With the advancement of technology, we will see a spike of autonomous cars on the road, and with that, a spike of cyber security incidents; companies will need to ensure the public’s safety against system failures that can cause harm to either the driver or pedestrians. Such as the deadly incident with Tesla’s Autopilot system steered the vehicles into a concrete divider, or Uber’s self-driving vehicle colliding with a walking pedestrian. Companies that are within the autonomous race will need to create a comprehensive security program that sets high standards for the industry in terms of testing and compliance to combat not only system failures, but also the exploitation of vulnerabilities.

Payed Educational Platforms Aren’t Safe

In 2020, COVID-19 brought on-premise learning at most educational institutions to a halt, and we adapted to remote learning via several web applications such as Zoom, Google Meets, Microsoft Teams, etc.

The most obvious prediction will be when the school doors reopen for on-premise learning after the majority of the population receives their vaccines, that these institutions will be big targets for cyber attacks. This will result in lost revenue for the schools, data breaches, data loss due to encryption, and outages.

The one type of educational platform that hasn’t been hit as hard yet are the payed training platforms such as SANS, Proofpoint, Hoxhunt, and others. There was a minor breach with SANS in August 2020, but that was small potatoes compared to the type of information, training material and content, and tool access these platforms have access to.

Getting a hold of the tools these platforms and other cyber security industries use is no small feat, and once they are held by bad actors, they become available to any/all script kiddies that are willing to pay for them. Hopefully the tools don’t come with a user manual that would allow anyone without technical savviness to use them to their full potential.

However, there are numerous payed training platforms that simply require an email address and a credit card to access their material, tools and user manuals, and some fear that it’s not enough to safeguard cyber security tactics against the fast paced world of hackers.

Those Pesky Humans

While we are very much focused on outsider threat, we should also take some time to look within — within our company that is, for insider threats. An insider remains to be one of the key threats to cyber security, and they are only increasing in frequency, difficulty in detecting, and more damaging.

2020 was a tough year for companies battling insider threats, and 2021 isn’t looking too promising either with Forrester predicting the number of insider data breaches to increase by 8%.

The Bright Side

Industry practitioners always state that bad actors are one step ahead of us, but we are getting better at reacting and continuously improve our application security and perimeter. With companies such as FireEye handling their breach so humbly by alerting the public and setting out counter-measures quickly, it can lead to revolutionizing cyber warfare responses and the harmony between cyber security companies.

In 2021, I hope to see more companies put the public first, and be more transparent during incidents. We all need to work together within the cyber security chain; we are only as strong as our weakest link.