An overview of cybersecurity in 2020 and beyond
Strong cybersecurity is a non negotiable in today’s world. With our businesses, national institutions and private lives becoming increasingly digitised, there are a lot of important assets for us to protect. But it’s not easy.
In business, nothing can undermine a company’s reputation quite like a major cybersecurity breach. Yet several high profile attacks have characterised the global business landscape over the past few years. Unfortunately, this can often be attributed to the fact that the rapid pace of digital transformation has outstripped the implementation of appropriate cyber protection.
From state sponsored hacking programmes to the activity of smaller scale cyber criminals, cybersecurity threats are complex, broad, without borders – and difficult for companies to counter.
Comprehensive cybersecurity strategies are therefore a sign that businesses take their long term survival seriously. They are an acknowledgement that without the trust of their customers, organisations won’t be around for long. They are also a response to increasing regulation, which is now requiring businesses to take a more thorough and responsible approach to protecting their systems.
However, in the field of cybersecurity, it’s often a case of when a breach will happen – not if. Events such as data hacks, the theft of funds, and even the ransoming of computer networks are an inevitable part of business. Why? Well, it’s an unfortunate truth in the cybersecurity world that malicious actors only need to be successful once to wreak havoc. In spite of their best efforts to defend themselves, companies should always be prepared for a breach to happen.
Back to basics
For companies with a low profile, effective cybersecurity measures can be as simple as not leaving important documents lying around, using secure internet connections, and instigating strong password hygiene on business accounts and devices.
The larger a business becomes, however, the greater the appeal it holds for hackers. Popular forms of attack include phishing, where criminals direct users to fake sites in an effort to obtain sensitive personal information or financial details; ransomware, which is used to damage or block access to a network unless a ransom is paid; and denial-of-service (DoS) attacks, where hackers overwhelm a system so that it cannot respond to service requests – often for no other reason than to see it fail.
Unsurprisingly, according to the Department for Digital, Culture, Media and Sport’s Cyber Security Breaches Survey 2019, larger businesses are more likely than average to say that cybersecurity is extremely important to them. When questioned, 95 per cent of senior managers in large businesses considered cybersecurity a high priority, compared to 78 per cent of managers in businesses as a whole.
The European Union’s General Data Protection Regulation (GDPR), which came into effect in May 2018, has also been a big driver in raising awareness of the importance of cybersecurity as well as putting in place appropriate legislative controls to protect consumers. In fact, the Cyber Security Breaches Survey found that 30 per cent of businesses and 36 per cent of charities had made changes to their cyber security policies or processes as a result of GDPR.
The regulation was also seen to have heavily influenced how organisations understood cybersecurity, with many focusing on strategies around data protection as a consequence. In spite of this prioritisation, companies do require a holistic conception of cybersecurity as a field. Policies around financial fraud and the reputational effects of cyber breaches are needed, as well as the implications of data protection and GDPR.
The IoT – a new set of risks
The growth of the Internet Of Things has provided businesses with better connectivity, new monitoring capabilities, and data-driven insights into their operations. Connected devices, such as remote assets and machinery, are now commonplace in industrial settings, whilst in the B2C sphere we see the likes of digital assistants, fitness trackers, and connected consumer goods providing feedback into use patterns and aftercare requirements.
An explosion in the number of connected devices worldwide – estimated to reach 75 billion by 2025 – does come with a significant risk to businesses, however. This is largely due to the fact that the expansion of digital connectivity and the IoT has not developed in line with security measures in internet infrastructure, hardware or software design.
Manufacturers often add security to IoT devices as an afterthought, and sometimes devices are repurposed with internet connectivity when they were never initially intended to have it. IoT devices therefore give criminals a weak point of entry into companies’ computer systems.
BYOD – Bring Your Own Device
One of the main challenges for businesses to counter is employees bringing their own devices into work. A personal device, such as a mobile phone, laptop or tablet, when connected to a company’s network, is a serious security vulnerability. Yet the practice is more prevalent than you might think.
Research by IT automation and security company Infoblox showed three quarters of organisations to have over 1,000 business devices connected to their network at a given day. However, more than a third of organisations were also found to have in excess of 5,000 non-business devices connected to the network too. The poor security levels of these consumer devices translate into a much broader attack surface for the entire business which cannot be underestimated.
It might sound dystopian, but if we fail to properly secure our growing IoT ecosystem, then the devices which are intended to make our lives easier may end up putting them at risk. Consider the impact of a cyber attack on an IoT enabled pacemaker, a smart home security system which could lock you out of your house, or an industrial manufacturing system which refuses to run unless you pay a ransom. These are all very real possibilities in a world peppered with connected machines.
Developing IoT security protocols and codes of practice is therefore essential in achieving a robust IoT infrastructure. With the advent of 5G mobile networks just around the corner – which will bring unparalleled capacity to wireless networks – this has never been more important.
Machine learning to the rescue
If there’s one constant in the world of cybersecurity it is change. Hackers are always searching for new vulnerabilities to exploit, moving the goalposts for individuals and organisations trying to counter these threats.
Ethical hackers, as well as dedicated research teams of security analysts such as at Google’s Project Zero, make it their mission to seek out security flaws in software before they can be exploited by malicious actors. However, a significant skills gap in the cybersecurity industry is hampering these efforts. With technology – and the skills of hackers – evolving all the time, the cybersecurity industry is struggling to keep up with the pace of change due to a lack of available talent.
One of the most promising tactics in countering this issue is machine learning. Companies such as Darktrace have developed automated responses to cybersecurity threats with AI. Rather than rely on historical data to predict future threats, such AIs learn usual patterns of behaviour for users and devices on a network. If usage deviates from the normal as a result of an attack, the AI can autonomously identify and neutralise this in a matter of seconds.
This not only protects business networks from external threats but also blocks attempts from insiders to steal sensitive information. The ability of AI to identify activity that is permissioned but nevertheless still a breach of security is a remarkable additional benefit for companies, and beyond the capabilities of traditional firewalls. Cyber AI therefore offers a flexible, adaptive cybersecurity strategy appropriate for large corporates and SMEs alike.
Collaboration, technology and data sharing
Cyber crime is becoming ever more varied in its scope, both in the kinds of acts that are committed and the ways all parties involved are forced to respond. As has already been noted, the rise of technology has led to an increase in new kinds of digital attacks, but it has also contributed to emerging risks in more traditional criminal fields such as fraud.
The blurring of the boundaries between specifically digital security breaches, and more generalised criminal activity, demands a unified response from members of an ecosystem who have not always worked together. The first step in this journey is to raise the profile of cybersecurity, and ensure that businesses, governments and institutions are taking it seriously.
In 2016, the UK government unveiled a five year National Cyber Security Strategy, with a £1.9bn investment to develop the country’s cyber defence capabilities, deter cyber criminals, and develop talent pipelines for cyber skills. This saw the establishment of a dedicated institute for research and public engagement in cybersecurity issues – the National Cyber Security Centre (NCSC) – as well as outreach programmes to encourage young people into the field.
Improving the gender balance of cybersecurity professionals is an important aim of the strategy, with initiatives such as the CyberFirst Girls competition hoping to encourage future generations of female computer scientists. The indications are that it is working: an impressive 12,000 schoolgirls took part in the 2018/19 competition, up from 4,000 the previous year.
This kind of government strategy highlights the need for large scale commitment to cybersecurity. But government is only one piece of the puzzle. Public sector organisations, large corporates, banks, legislators, and SMEs all need to work together to share data, insights and ideas. Cyber crime is so complex that no one affected party can ever have a full grasp of what’s going on. The development of a collaborative and connected cybersecurity ecosystem is therefore a crucial step in creating a robust, industry-wide response to threats that are becoming more and more sophisticated.
A clash of interests
Cybersecurity is a broad and complicated issue which affects us all. If you’ve ever used a digital form of communication, entered personal details online, or installed a computer network for your business operations, then you have an inviolable interest in upholding cybersecurity standards.
Unfortunately, the size and scope of the subject has traditionally made it difficult to put forward a comprehensive, unified strategy. Clashes between entities with conflicting aims in the cybersecurity space complicate matters even further.
An ethical minefield, arising most notably because of communication channels with end-to-end encryption such as Whatsapp, has seen governments demand security backdoors into private messaging apps for surveillance purposes. Private companies have so far resisted pressure from authorities to reveal their users’ classified information, but it is unclear whether they will be able to hold out indefinitely.
What’s more, advances in quantum computing look likely to destabilise cybersecurity strategies even further. While we may not be quite there yet, the arrival of functioning quantum computers – with their greatly improved processing power and speed – is likely to make traditional encryption methods redundant. Post-quantum cryptography is therefore a growing field and an important area for interested parties to keep an eye on over the next few years.
Digital transformation with security built in
If one thing’s for certain, it is that cybersecurity considerations should be much more highly prioritised in all future kinds of digital transformation. The age of neglecting cybersecurity in the development of new technology, or of applying temporary patches to flaws when they are spotted, must end if we want to effectively defend our digital space.
As more areas of our lives – and our critical national infrastructure – come to depend upon the internet, we are setting ourselves up for catastrophic consequences unless we begin to take cybersecurity more seriously. From ransomware attacks on the NHS, fraudulent government websites, and GDPR infringing data breaches, cybersecurity concerns are as varied as they are destructive.
As with so many other issues arising from digital disruption, collaboration is key. So is a willingness to tackle the situation head on.
Research and Insights Manager
Sarah is renowned for her ability to communicate complex concepts with clarity. She plays a central role in managing the insights programme at Foundry4.