There are still plenty of unknowns regarding the recently discovered hacking of federal systems. Who is responsible and how extensive the damage is are among the questions regarding the activity in which bad actors were able to insert malicious code into what appeared to be routine software updates.
One thing is certain: This hack was not the first and certainly won't be the last. Additional hacks using novel and previously unseen approaches are sure to follow. Recently, leaders of IT and cybersecurity companies reflected on how the data security landscape is changing and what's ahead in 2021.
Securing and governing multi-cloud environments will be the top it challenge facing enterprises. As digital transformation accelerates, the complex and self-service nature of cloud infrastructure makes it easy for mistakes to me made (e.g., access granted to users or machines that should never have been granted) and lack of visibility into the cloud makes these mistakes difficult to spot and correct. In fact, Gartner predicts through 2025, 99% of cloud security failures will be the customer’s fault, and 90% of organizations that fail to control public cloud use will inappropriately share sensitive data. Because of this, identity and access management (IAM) for individual and machine users will be a top challenge in 2021. To make IAM digestible and manageable by humans and therefore avoid data exposure, organizations will increasingly implement cloud ownership guidelines and governance policies to visualize who—or what—has access to specific resources in the cloud. —Keith Neilson, Technical Evangelist for CloudSphere
Cloud misconfigurations will be one of the top causes of data breaches.A lack of clear understanding of the shared responsibility model due to the rapid transition to the cloud will backfire in 2021. The speed of transition coupled with prioritizing productivity over security has made misconfigurations inevitable, resulting in overexposed data. In addition, hackers will increasingly target service providers. The shortage of cybersecurity experts will lead more organizations to turn to managed service providers (MSPs). In response, hackers will conduct targeted attacks on MSPs in order to get access to not just one organization but all of the MSP’s customers. — Ilia Sotnikov, Cybersecurity Expert and Netwrix Vice President of Product Management
Financial institutions will be the most at-risk industry for cloud-jacking. As companies across industries continue to move towards hybrid IT environments, the threat of cloud security breaches is at an all-time high. Financial institutions, which have traditionally been slower to adopt cloud technologies due to heavy regulations and security concerns, accelerated their digital transformations in 2020 as COVID-19 brought about new challenges. These businesses are now faced with a customer base seeking digital-first services, and they are leveraging cloud-based infrastructure to maintain customer satisfaction. As a result of this rapid transition to a hybrid cloud environment, we could see the cloud-jacking of a major financial institution that results in bad actors gaining control of highly sensitive customer information. —Mike Riemer, Chief Security Architect at Pulse Secure
We’ll see the consequences of employees letting their guards down as work-from-home extends. Many employees will continue to work remotely in 2021 to slow the spread of COVID-19 until a vaccine can be reliably distributed. Consequently, bad actors are no longer following these employees “through the door” when looking to steal data. Instead, they will seek to take advantage of workers who have been remote since the start of the pandemic, as they may be more likely to be letting down their guard when it comes to following security protocols. This relaxation on security protocol—combined with threats that already exist in a rushed remote work environment—will result in data loss rates exceeding what we saw in 2020. —James Carder, Chief Security Officer for LogRhythm
Legacy security architecture like VPNs will be the weak link for many organizations, and use of zero trust network access is likely to accelerate in 2021. To quickly ramp up remote operations and comply with stay-at-home orders, many organizations looked to legacy security architectures like VPNs as a silver bullet solution for remote work. However, this is not a sufficient long-term solution as VPNs introduce latency, hamper productivity, can be difficult to scale, and can grant employees excessive access to internal resources. VPNs also represent significant liabilities as cybercriminals can easily exploit unpatched VPNs with ransomware. Even a “perfect” VPN setup and deployment is vulnerable to attack. Fortunately, there is hope for the future. A recent survey found that 34% of IT security teams across the globe have shared that they are in the process of implementing a zero-trust security model which can ease many of the challenges presented by a traditional network approach. Additionally, 60% of enterprises will be phased out of VPNs in favor of zero trust network access by 2023. With a zero-trust implementation, users only have access to the smallest set of permissions necessary to perform their work duties. This trend toward zero trust network access is likely to accelerate in 2021 as organizations realize the gaps that legacy architectures like VPNs pose to their security postures.” —Anurag Kahol, CTO and Co-Founder of Bitglass
WFH will continue to change and challenge how companies work in 2021. The top three cybersecurity lessons I learned this year are that, one, although not entirely dead, the perimeter is certainly dying and with employees working from home networks, more organizational activities are happening outside of the perimeter than within it; two, cybersecurity teams can be just as productive (if not more so) working remotely than when they are in the office and, with the right collaboration tools, cyber security teams can be more connected to one another from home than they are in cubicle farms; and three, a “talent anywhere” strategy is no longer a luxury for cyber security teams. If you are not flexible in where you source cyber security talent and/or the flexibility you provide your team, you are at a distinct disadvantage in an already tight cyber security talent market.—Bradley Schaufenbuel, Vice President and Chief Information Security Officer at Paychex, inaugural member of the AttackIQ Informed Defenders Council