Email will continue to be the tool of choice for attackers and, as the primary infection vector, an important attack surface to secure. 

As browsers become more secure, plugins decline and Internet Explorer loses market share to Chrome – and now perhaps Firefox Quantum – cyber criminals are moving away from the web channel as a means to infiltrate businesses. So the carefully crafted phishing email will continue to be the biggest threat to consider in any 2018 cybersecurity strategies. 

Having said that, businesses should not take their eyes off the web channel – it remains the second most important attack surface for the majority of organisations. 

Cyberspace has emerged as a new battlefield where bits, bytes, and botnets are the weapons of choice. This is creating the Internet of Botnets, which are global networks of compromised devices that hackers can deploy or rent out to criminal organisations. This is particularly unsettling given the fact that there is currently a botnet out there (dubbed the IoT Reaper) that is powerful enough to take down the entire Internet.

Firewalls and other traditional security measures do not cut it anymore. As the battlefield moves into cyberspace, new tools will be needed to address the changing nature of conflict. AI, quantum computing, and quantum cryptography are particularly promising countermeasures against cyberattacks.

AI (in the form of machine learning) is being used to monitor networks and any associated devices for anomalies and report deviations in real time. Quantum computing can sift through 150,000+ daily threats in an organisation’s network to identify which events are the riskiest. And quantum cryptography can ensure secure communications. These emerging technologies are redefining cybersecurity as we know it. Moving forward, they will be our best line of defense against sophisticated cyberattacks.

The high levels of business damage due to cyberattacks has greatly increased the interest of Boards of Directors in managing this risk.

This has driven an increase in procurement of cyber insurance policies, as capping liability via insurance is well known to Directors. However, for a variety of reasons cyber insurance does not bound liability in any way, and the payback very often doesn’t even  cover the costs of the premiums and the deductibles if an incident does occur.

Spear phishing will continue to grow as long as it continues to be successful for cybercriminals. Spear phishing, highly targeted attacks that leverage impersonation of an employee or a popular web service, have been on the rise, and according to the FBI, these attacks have proven to be extremely lucrative for cybercriminals.

These attacks will continue to grow in number as well as become more sophisticated in terms of how they research and target their victims. In 2018, there will be a large increase of multi-stage spear phishing attacks that involve multiple steps, research and reconnaissance on behalf of the attacker targeting a small number of targets for very large pay outs. Cybercriminals are now taking an ‘enterprise’ approach. 

Similar to B2B enterprise sales, they go after a smaller number of targets, with the goal of extracting a much greater payload with highly personalized attacks. The latest iteration in social engineering involves multiple steps. The sophisticated cybercriminals don’t try to target company executives with a fake wire fraud out of the blue. Instead, they first infiltrate the organization, and then use reconnaissance and wait for the opportune time to trick their targets by launching an attack from a compromised mailbox.

 Organisations will have to invest in cutting edge tools and tactics in order to thwart spear phishing attackers. AI for real-time spear phishing defense offers some of the best hope in stopping these cybercriminals in their tracks.

Up to now, most industrial organisations have perceived artificial intelligence (AI) as a buzzword, and have not been familiar with the role it can play in ICS cybersecurity. However, the word-of-mouth around how AI empowered cybersecurity solutions are making a difference for faster threat detection and troubleshooting is out.

Organisations grappling with ICS cybersecurity staffing and skills shortages are turning to AI solutions to achieve security and productivity goals. We see this happening both at the level of large multinational customers with mature cybersecurity programs and processes, and at the level of smaller organisations who realize they have no other choice.

For example, a recent US-CERT advisory on Dragonfly 2, (Alert TA17-293A), recommended checking 17 different logs and repositories for indications of the malware. That could take a lot of scarce staff time, versus using an automated threat detection solution that can do the same check very rapidly.

In 2018, industrial organisations will adopt AI powered ICS cybersecurity solutions to radically automate threat detection and mitigation.  The outcome will be better reliability and security and more effective use of staff resources.

In a world of cloud computing, the notion of a firewall is all but irrelevant. And with the proliferation of zero-day virus signatures, virus protection is completely ineffective.

Today, all an attacker needs are the stolen credentials of your user.  To protect your organisation, traditional ‘defense in depth’ – firewalls, encryption, application barriers and the like – will no longer cut it.

In 2018, we’ll see more and more organisations turn to an ‘identity in depth”’approach to security, whereby they’ll augment traditional forms of cybersecurity with modern, intelligent and adaptive identity-centric solutions.

Connected vehicles are likely to face new threats as a result of growing supply chain complexity leading to a scenario where no one player has visibility of, let alone control over, all of a vehicle’s source code. This could make it easier for attackers to break in and bypass detection.

In healthcare, attacks breaching private networks to target medical equipment and data with the aim of extortion, malicious disruption or worse, could rise as the volume of specialist medical equipment connected to computer networks grows.

In financial services, the increased security of online payments means that fraudsters will turn their attention to account takeover attacks. Industry estimates suggest fraud of this type will run into billions of dollars.

Industrial security systems are likely to be at increased risk of targeted ransomware attacks. Operational technology systems are more vulnerable than corporate IT networks, and are often exposed to the Internet.

Last year, companies integrated machine learning to ascertain the risk level of individual transactions and decide in real-time whether or not to allow them. While behaviour analytics aren’t new, until now few solutions had the ability to actually stop a transaction in real time.

This pivots identity security away from detect-and-respond alerts and towards more automated preventative controls. For example, risk-based authentication (RBA) improves user experience by using machine learning algorithms to assess risk, and can require a second factor of authentication only when risk is high.

The benefits are substantial, and we expect to see rapid integration of these technologies into cybersecurity solutions in 2018.

The skills gap will make organisations more vulnerable than ever. The resources needed to deal with security incidents will continue to be difficult to acquire.

In 2018, we will see large security incidents occurring simply because the affected company does not have the resources to deal with incidents as they arise, regardless of whether security staff have the means to detect them or not.

The web is moving to encrypted-by-default.  Seventy of the Top 100 non-Google websites, accounting for 25% of all website traffic worldwide, are using HTTPS by default.  Major search engines, social media networks and shopping sites are investing in the technology to make the web a safer place for everyone.

Meanwhile, to protect personal data and intellectual property, organizations are trying to keep visibility of their web and app traffic by using SSL/TLS decryption and inspection technologies, simply to understand the data which is moving from machine to machine. Such technologies use man-in-the-middle (MITM) techniques in a legitimate manner. 

It’s therefore no surprise that cybercriminals and nation state actors will adapt their tactics, techniques and procedures accordingly. Malware creators, or those controlling botnets, will continue to take advantage of any environments that are not using SSL/TLS decryption and inspection to hide communications using encrypted communication channels. We will also see other malware attempting to detect or thwart MiTM security techniques by using non-standard cryptography, certificate pinning and other techniques.

The only effective way to monitor the traffic for Network DLP and CASB analysis is to MiTM the streams, so we see this becoming more common. This will raise privacy challenges, and we also expect to see malware taking this MiTM into account when determining how to act by ceasing execution once it realises it is under analysis. 

Elon Musk recently made headlines for suggesting we should be more worried about AI than North Korea, reinforcing fears that the human brain simply can’t outperform or keep pace with certain kinds of automation. No one yet knows exactly what AI can do for humankind nor what happens if AI falls into the wrong hands.

But there is evidence that 2018 could be the year that it happens in earnest as the black market for off-the-shelf attacks is starting to mature.

The only hope will be to fight AI with AI. Already most cybersecurity applications use some form of AI to detect attack patterns and other anomalies.

White and black hats are continually hunting for vulnerabilities and zero-day attack concepts. Both can use machine learning/deep learning to collect information and either fix the problem or, in the case of unethical hackers, create one.

Other hackers are more ambitious. For them, research is paramount. Consider that Vladimir Putin is on record stating that World War III will be fought over global AI dominance.

Will AI be used to jam communication links, plunge cities into darkness, set oil rigs on fire or destroy emergency services? Those may be worst-case scenarios, but they point to the need for every enterprise to consider how AI could both damage and protect it.

2018 must be the year that the UN sets up a hacker group to test the cybersecurity of nations, businesses and Non-Governmental Organisations to ensure they are doing the things they are meant to do. At present, we are relying on talented hackers who are doing us all a favour by exposing poor cybersecurity practices in business and government.

Thankfully, many of the major 2017 hacks have resulted in relatively minimal damage to businesses and organisations. The majority of people orchestrating these attacks have been non-malicious and are either doing it for fun or to prove a point.

We must not rely on “ethical” hackers lurking in the shadows of the internet to warn businesses and governments. This must become official and regulated by organisations such as the UN in 2018.

Organisations will need to tighten up their disaster recovery strategies in the face of increasing cyberattacks, in particular the threat posed by ransomware. Cybersecurity Ventures has predicted that ransomware attacks on businesses will increase in frequency from every 40 seconds in 2017, to every 14 seconds by the end of 2019. 

As organisations prepare to proactively combat cyberattacks, they’re finding that no single cyber security product today has a ransomware feature. To assist organisations, we predict that more information-sharing partnerships such as Ransomware Watch will start to form between data security and data protection providers, as well as potential formal partnerships or merger and acquisition activity in this space.

Because of increasing cyberattacks, organisations will also invest more in ensuring that they have an off-site backup of their critical data and place much heavier demands on managed service providers, with expectations of being able to recover their data more quickly and more completely. 

Based on this trend, Arcserve anticipates that managed service providers will be driven to develop data recovery solutions that can enable near-zero recovery time objectives (RTOs) and recovery point objectives (RPOs), at costs that are affordable to enterprises and SMEs. MarketsandMarkets has forecast the disaster recovery as a service (DRaaS) market will reach $12.54bn by 2022, compared to $2.19bn in 2017: representing a compound annual growth rate (CAGR) of 41.8%.

We believe that 2018 will be the year of zero-tolerance when it comes to recovering data, largely driven by the 64% of data and applications that fall into mission and business-critical tiers. Organisations will continue to have high expectations around how long it takes to recover their data (RTOs), but to ensure operational, compliance and consistent customer experience, there will be a greater awareness that the relevance of their data recovered (RPOs) is as important as how quickly they can retrieve it.

The vulnerability in British schools’ heating systems is the latest in a number of worrying stories where connected devices have been easily manipulated by hackers.

The accelerating standardisation of these technologies is creating new attack vectors for not only the education sector but others including healthcare. Previously, heating systems for schools weren’t as widely connected to the internet, meaning they would never have been considered as critical infrastructure.

However now, as many schools increasingly use the same technology because it’s more efficient, unfortunately the devices also have the same vulnerabilities. This makes it easier than ever before for an attacker to gain control of a large number of schools’ heating systems simultaneously.

As you can imagine, turning off Britain’s schools’ heating systems in the dead of winter would have significant impact on the UK economy. We need to act now if we are going to plug the huge IoT security vulnerabilities that exist across our infrastructure.

In 2018, I believe that we will see the first real evidence of a new, widespread insider threat: Generation Z, the generation currently graduating from university and entering their employment years.

The GenZ Insider brings a new set of risks due to their knowledge and comfort with IT. Not least because they don’t know or acknowledge boundaries in the same way as older generations do.

They are used to 'sharing' and this will present major problems around data sharing, both unintentional and also motivated by social justice.

Added to this, GenZ are ‘always-on’ and this is unlikely to stay confined to personal lives. As employees, they will demand access to what they need, from wherever they want to work. Combined with the sharing psyche, this poses a big data security risk, even from shoulder surfing and shadow IT.

Because these employees are digital natives and surrounded by tech references in pop culture, they also have the curiosity and capability to successfully find and use resources on the Internet to learn to hack.

With easily-obtainable information, a GenZ Malicious Insider is armed with the capability to access other employee's accounts and passwords, as well as spy on their colleagues if they wished to. Depending on their motivations, this could be used against a co-worker, the employer or even for financial gain by selling IP to competitors.

As observed during 2017, social media platforms are regularly being used for the spread of fake news or the manipulation of public opinion. But social media can also be used for sophisticated social engineering and reconnaissance activities which form the basis of many attacks on the enterprise. Criminals and hackers are known to use these platforms to distribute malware, push rogue antivirus scams and phishing campaigns to lure their victims.

Social media provides the medium for connecting people globally, in the rapid exchange of ideas, discussions and debates in our digital world. However, from an attacker’s perspective, social media have become an easy target because of the number of non-cyber security savvy users, and the fact that these platforms are easy and cost effective to use.

To protect themselves against social media attacks, organisations need to implement enterprise-wide social media security policies. This includes designing training programs for employees about social media usage, and creating incident response plans that coordinate the activities of the legal, HR, marketing and IT departments in the event of a security breach.

While the increasing number of publicly disclosed breaches and successful ransomware incidents are driving growth in cyber insurance, there is a risk that this will encourage criminals to target companies with extortion insurance to demand increased payments.

If insurers pay ransoms to recover data, it is possible that this will encourage this criminal business model and increase the number of incidents insurers have to handle or the cost of ransoms. It is likely that insurance providers will start to implement guidelines that require companies to have strong security controls in place as a prerequisite.

Security and politics will become an even thornier morass than they have been since 2016. Security is important, but fear, uncertainty and doubt (FUD) is bad. Lately, there is too much FUD in politics, and much of it happens in the name of security. Computer security still sells with FUD. We need to change that. FUD is corrosive.

Facebook and Twitter will have to take responsibility for the abuse of their platforms. The election of 2016 showed how vulnerable our democracy is. Technology providers can no longer pretend that the tools they made are “just tools” without any moral or ethical implications. As we learn more about information warfare, propaganda and modern social networks, we’ll need to make some adjustments.

Crypto will be painted as the enemy of security instead of as its saviour. Public figures who have no business even saying the word ‘crypto’ will attempt to thwart math and engineering with empty political words. We will need to defend strong crypto again in Crypto War III. Coming soon to a three-letter agency near you.

One type of attack that we will see gain more traction in 2018 is the website attack. With the growing use of online services (checking accounts, merchant accounts and Point-of-Sale (POS) systems, etc. now going through the web) the risk of attacks is large and has the potential to affect any institution using these services, as it opens access to institutions’ backend databases, document stores and applications all within easy reach.

This type of attack is very hard to find, but it is incredibly easy for attackers to undertake. Because an attacker can gain access to the website via high jacking a user’s request, and then by simply making a small change to the code to redirect payment information their way while not stopping the correct path of the request, it makes it easy for attackers to get access to critical data without alerting any red flags.

Critically, the website is no longer just a marketing tool. It has become a business tool, and as such, it now needs to be properly protected from attacks and placed inside a firewall, and preferably completely encrypted, so that attackers are unable to change, manipulate and delete code to their advantage.

Experience has shown us that your network or data can be breached via a trusted partner, and this is a big security blindspot as IT teams simply don’t have the same level of insight into their partners’ or suppliers’ security processes. To this end, and as part of their risk assessment, organisations should ensure that they’ve done due diligence and have policies and contractual obligations covering security for third parties, including those that are much larger than their own organisation.

Despite the build-up, lots of companies will be unprepared for compliance when the GDPR kicks in this May. It will be more important than ever to ensure that employees are educated as per Article 37 & 43 on their role in the protection of data, as human error is a significant contributory factor in security incidents. Any measures which help to raise awareness of how employees can minimise this risk should be incorporated into cyber security planning.

We have seen a stark increase in email attacks that impersonate secure messages from financial institutions. These fake “secure messages” carry malicious content and malware for download.

Impersonation is one of the most common tactics used in email attacks because it works very well. These impersonation threats leverage the relationship a victim has with his bank and the associated trust the victim may have in his bank’s online communication.  A victim who engages in online communication with the bank is usually of high value to these criminals.  

These impersonation threats carry malicious word documents that often appear harmless, but include an embedded script that can be updated by attackers at a later date.  This script can be modified to deploy a variety of threats including ransomware or advanced persistent threats. These attacks are very difficult to spot by end users as the email domains used in this attack are designed to look like real emails that customers might receive from an actual bank.

The volume of these attacks is rapidly increasing, so plan to see more of these fake secure messages in the coming year.

As governments battle it out in cyberspace, the question of cyber balkanisation rears its head. In 2018, we will see an escalation of the drama around Kaspersky and the US government. The long-term implication of this could be game-changing.

As governments globally take America’s lead and start rejecting security software, and then sensitive apps and entire operating systems on the grounds of National Security, we will inevitably see cyber balkanisation levels not seen since the Cold War.

Smaller countries that don’t have their own security vendors, or can’t afford to build their own OS stacks will be forced to align with one major power or another, creating new blocs that will spell out the state of play sooner than we realise. How this will impact enterprise security is unknown, but we won’t be able to rule it out as an area for concern.