Five cybersecurity predictions for 2017

To call 2016 ‘eventful’ in the IT and cybersecurity space would be an understatement. From Mirai to ransomware and NSA shadow brokers to Yahoo!, this year introduced new threats birthed from age-old challenges. Given the unique turbulence of 2016, and the industry’s overall failure to manage and protect networks any better than the years prior, the year ahead will be an important opportunity for changing how the world understands and approaches defending our most precious information. To that end, read on for five predictions for a year that will certainly prove to be a lot more than eventful.

1. Criminals and threat actors will increasingly leverage vulnerabilities in IoT devices to conduct DDoS and other attacks

The attack against the Internet infrastructure company Dyn in October signaled a long-expected evolution of the underlying technologies that can be exploited and leveraged to launch Distributed Denial of Service (DDoS) attacks that benefit from economies of scale. Connected, Internet of Things (IoT) devices that are insecure by design are coming online en masse — in both homes and businesses — while available bandwidth likewise continues to grow. The Dyn attack demonstrated that bringing down a carefully selected set of targets can yield highly-visible and impactful outages.

2. Machine learning won’t be the security silver bullet many expect it to be

Approaches for machine learning are evolving at a fast pace and, when used effectively, can provide organizations with powerful tools to help automate attack detection and response at scale. Unfortunately, machine learning is also often misunderstood — and increasingly, mislabeled to generate hype for a product’s claimed capabilities.

Machine learning is not a general-purpose solution to all shapes and sizes of security-relevant data — nor is it always superior to other forms of data analytics. Certain specific use-cases provide ample opportunity for unsupervised and minimally supervised learning that can be critical to an effective solution that makes the “right” decisions on its own. Others may appear effective in controlled lab scenarios and test cases but fail amidst the chaos and noise of most large enterprise networks. The latter is particularly challenging to prove out during a typical vendor evaluation process.

3. Nation states will expand their use of hacking as a mechanism for influencing the media, public opinion and public policy.

2016 was the year of misinformation on the Internet. The hacks on the World Anti-Doping Agency, Democratic National Committee and prominent political figures focused on obtaining and selectively disclosing information, not disrupting systems. The attacks, perpetrated by what is believed to be Russian state-sponsored hackers, demonstrated Russia’s willingness to use cyber espionage to influence world events, gain crucial information and sow distrust and discord in the democratic process. Fake news sites and use of groups like WikiLeaks, DC Leaks and Cyber Hunta to wage an information war aimed at discrediting sovereign governments proved to be a powerful and effective weapon.

We will see an increase in nation-state hacks aimed at influencing world events and politics. This includes increasing use of the Internet to spread both damaging facts and misinformation.

4. Healthcare attacks will continue, but increased HIPAA oversight won’t jolt the industry

Data-rich healthcare records are becoming one of the hottest commodities on the dark web, and it shows. After the rampant ransomware attacks throughout 2016, healthcare is now the number one industry target for threat actors. New compliance mandates are coming in 2017: the U.S. Department of Health and Human Services Office for Civil Rights (OCR) is increasing funding for HIPAA audits in 2017 by as much as 50%. But increased HIPAA fines this year did little to curb attacks, and audits won’t move the needle. In the field, we see organizations with limited budgets, layers of antiquated legacy software and hardware that can’t be immediately replaced and a priority to consider whether each dollar spent on technology is worth taking away from saving lives. Put simply, hospitals first need to get the basics right and make healthcare systems more resilient as upgrades occur. The vast majority of breaches—even those involving advanced threats — could be prevented with basic security hygiene.

5. Companies will wake up to overspending and pare down IT Security tools, creating industry consolidation

In 2017, we’ll see the number of cybersecurity players begin to contract. During the past decade, the incumbent monolithic Managed Security Service Providers (MSSP) largely failed to adequately detect or protect against the first wave of targeted attacks, which gave rise to specialty firms focused on so-called Advanced Persistent Threats (APT). Today, as companies review their security and IT operating budgets for 2017, they may find that they’ve committed to a laundry list of security services: threat intelligence feeds, vulnerability management feeds, managed security operations, cloud security solutions, managed attack defense and incident response, specialized “attack simulation” and penetration testing and a bevy of EDR and network security applications that follow a service-driven delivery model. As companies wake up to this overspending, we’ll see them reduce the number of vendors — creating industry consolidation.

Interested in seeing Tanium in action? Schedule a one-to-one demo or attend our weekly webinar. Talk to our Tanium experts at our upcoming events.