Cybersecurity trends and challenges in a post-pandemic world

EXECUTIVE BRIEF: Cybersecurity is critical to organizations with distributed workforces. Read our in-depth guide to working securely from home how organizations are identifying and mitigating new security vulnerabilities, improving systems, implementing security controls, and ensuring proper monitoring and documentation.

Cybersecurity is a fast-moving sector, with both hackers and security vendors trying to outdo one another.

New threats – and innovative ways to combat them – are constantly emerging. In this overview, we explore the latest trends in cybersecurity.

The Covid 19 pandemic forced most companies to convert their workforces to telecommuting, and often quite quickly. Many surveys indicate that even after the pandemic, a large portion of the workforce will work from home. Working from home poses new cybersecurity risks and is one of the most discussed new trends in cybersecurity. Home offices are often less protected than central offices, which typically has more secure firewalls, routers and access management operated by IT security teams. In the rush to keep operations running, traditional security reviews may not have been as rigorous as usual – and cybercriminals have adapted their tactics to take advantage.

AUTHORS

Andres Castaneda
Senior QA Functional Leader

Many employees use their personal devices for two-factor authentication and may also have mobile versions of instant messaging clients like Microsoft Teams and Zoom. These blurring lines between personal and professional life increases the risk of sensitive information falling into the wrong hands.

Positive young mixed race woman using a laptop and smartphone at home.Cozy home interior with indoor plants.Remote work, business,freelance,online shopping,e-learning,urban jungle concept - MAS Global Consulting

The growing Internet of Things (IoT) is creating more opportunities for cybercrime.

The Internet of Things refers to physical devices other than computers, phones and servers that are connected to the Internet and exchange data. Examples of IoT devices include wearable fitness trackers, smart refrigerators, smartwatches, and voice assistants such as Amazon Echo and Google Home. It is estimated that 64 billion IoT devices will be installed worldwide by 2026. The trend toward telecommuting is helping to drive this increase.

So many additional devices are changing the dynamics and size of what is sometimes called the cyberattack surface – that is, the number of potential entry points for malicious hackers.

Compared to laptops and smartphones, most IoT devices have less processing and storage capacity. This can make it difficult to use firewalls, antivirus programs and other security applications to protect them. As a result, IoT attacks are among the discussed trends in cyberattacks. You can read more about IoT security threats here.

Portrait of a handsome happy blogger using his laptop during breakfast"n - MAS Global Consulting

Ransomware is not a new threat – it has been around for about two decades – but it is on the rise.

It’s estimated that there are now more than 120 different ransomware families, and hackers have become very adapt at hiding malicious code. Ransomware is a relatively easy way for hackers to get rich financially, which is part of the reason for its rise. Another factor was the Covid 19 pandemic. The accelerated digitization of many businesses combined with telecommuting has created new targets for ransomware. Both the volume of attacks and the amount of claims increased as a result.

In ransomware attacks, criminals steal a company’s data and then encrypt it so they can not access it. The cybercriminals then blackmail the company and threaten to release the private data unless a ransom is paid. The toll of this cyberthreat is significant given the sensitive data at stake and the economic impact of paying a ransom.

Did you know…

Ransomware made history in 2020 when it contributed to the first reported cyberattack-related fatality. In that incident, a hospital in Germany was locked out of its systems, preventing it from treating patients. A woman who needed urgent treatment was taken to a neighboring hospital 20 miles away, but did not survive. Ransomware attackers are becoming more sophisticated in their phishing methods through machine learning and coordinated exchanges on the dark web. The hackers usually demand payments in cryptocurrencies that are difficult to trace. We can expect to see more ransomware attacks on companies that are not cyber-secure in the near future. Read about the top ransomware attacks of 2020 here and the different types of ransomware here.

Professional woman working from home - MAS Global Consulting

Cloud vulnerability continues to be one of the biggest trends in the cybersecurity industry.

Again, the rapid and widespread adoption of post-pandemic telecommuting has dramatically increased the need for cloud-based services and infrastructure, impacting enterprise security.

Cloud services offer a number of benefits – scalability, efficiency and cost savings. But they are also a prime target for attackers. Misconfigured cloud settings are a major cause of data breaches and unauthorized access, insecure interfaces and account hijacking. The average cost of a data breach is $3.86 million, so organizations need to take steps to minimize cloud threats.

More About Our Cloud Offerings Cloud Case Study

Social engineering attacks such as phishing are not a new threat, but have become more threatening in light of the widespread remote workforce.

Attackers are targeting individuals who dial into their employer’s network from home because they are an easier target. In addition to traditional phishing attacks against employees, there has also been an increase in whaling attacks that target a company’s senior leadership.

SMS phishing – sometimes referred to as “smishing” – is also gaining traction thanks to the popularity of messaging apps like WhatsApp, Slack, Skype, Signal, WeChat and others. Attackers use these platforms to trick users into downloading malware onto their phones.

Another variant is voice phishing – also called “vishing” – which was made famous by a Twitter hack in 2020. Hackers posing as IT employees called customer service representatives and tricked them into granting access to an important internal tool. Vishing has been used to attack numerous companies, including financial institutions and large corporations.

There is also SIM jacking, in which fraudsters contact a particular customer’s mobile carrier representatives and convince them that their SIM card has been hacked. This makes it necessary to transfer the phone number to another card. If the deception is successful, the cybercriminal gains access to the digital content of the target’s phone.

Companies are stepping up their protection against phishing, but criminals are always looking for new ways to stay ahead. These include sophisticated phishing kits that have different targets depending on the victim’s location.

One of the most important trends in data security is the rise of data protection as a discipline in its own right. Numerous high-profile cyberattacks have resulted in millions of personally identifiable information (PII) being exposed. Coupled with the introduction of stricter data laws around the world, such as the EU’s General Data Protection Regulation (GDPR), this means that data protection is becoming an increasing priority.

Companies that fail to comply with regulations and consumer expectations run the risk of fines, bad publicity and loss of consumer trust. Data privacy affects almost every aspect of a business. As a result, companies are placing more emphasis on hiring data protection officers and ensuring role-based access control, multi-factor authentication, encryption in transit and at rest, network segmentation and external assessments to identify areas for improvement.

Multi-factor authentication (MFA) is considered the gold standard of authentication. However, malicious actors are finding new ways to circumvent it – especially authentication via SMS or phone call. As a result, Microsoft in 2020 advised users to stop using phone-based MFA and instead use app-based authenticators and security keys.

SMS provides some security, but the messages sent – even for authentication – are not encrypted. This means that malicious actors can conduct automated man-in-the-middle attacks to obtain one-time passcodes in clear text. This presents a vulnerability for activities such as online banking, where authentication is often done via SMS. Banks and other organizations will increasingly turn to application-based MFA solutions such as Google Authenticator, Authy and others to address this issue.

In Conclusion

The sheer volume of cybersecurity threats is too great for humans to handle alone. As a result, organizations are increasingly turning to AI and machine learning to improve their security infrastructure. This comes with cost savings: companies that suffered a data breach but fully deployed AI technology saved an average of $3.58 million in 2020.

AI has played a critical role in building automated security systems, natural language processing, facial recognition, and automated threat detection. AI also makes it possible to analyze massive amounts of risk data much faster. This is beneficial for both large enterprises dealing with massive amounts of data and small or mid-sized companies whose security teams that may be under-resourced.

While AI represents a huge opportunity for more robust threat detection in enterprises, criminals are also using the technology to automate their attacks by poisoning data and stealing models.