If the events of 2020 taught us anything, it’s that we should expect the unexpected.

After a whirlwind year that brought a significant spike in cybercrime, social justice movements that played out in the digital space, and a shift to remote work across industries, what does the ‘new normal’ mean for information security?

Join me as we look back at the security trends of 2020.

The rise of the Chief Information Security Officer (CISO) - The ideal CSIO has to keep up with the pace of technology change. Cyber-attacks are not slowing down any time soon. With remote work becoming a global trend for the workplace, cyberattacks are only going to increase. Due to the increase in volume and sophistication of cyberattacks, the role of a Chief Information Security Officer (CISO) will be critical. CISOs play an important role as businesses move towards the heightened efficiency of digital transformation.

The CISO has affected the security space where they are now playing a larger role in companies’ strategic decision-making. Companies are now moving to the digital space and increasing the adoption and use of cloud technologies. This rapid change has resulted in huge demand for cloud-based services. In the first few weeks of March 2020, Microsoft saw a 775% rise in its Team Services usage, while Zoom registered a 354% increase in business use compared to the same period last year.

There has also been an increased security risk from remote learning and work. For example, ‘zoom bombing’ has become popular where uninvited attendees can view and listen in on your business meetings.

High demand for cybersecurity professionals - If you browse through the latest news stories, you'll probably find a report about another business struggling with a big data breach. Since data breaches rise every year, it’s no surprise that the demand for cybersecurity professionals is at an all-time high. There is a shortage of the skills and competencies necessary to meet the increased need for security services associated with cloud computing, threat intelligence, and compliance requirements. The US currently has less than half of the cybersecurity candidates it needs to keep up with ever-intensifying demand. For every 100 active postings, there are a mere 48 qualified candidates.

An Increase in Phishing Attacks - Persons are being hooked and deceived with emails that are disguised as being legitimate, but in truth are from unscrupulous sources. Since early 2020, there has been a steady increase in the number of phishing attacks and ransomware attacks carried out through phishing emails containing malicious attachments. According to Google’s transparency report, the tech giant detected an average of 46,000 new phishing websites every week in 2020.

An Increase in Ransomware Attacks - At the beginning of the 7th century, several walls were constructed in China and were later joined together to build The Great Wall of China. The Great Wall stretches more than 13,000 miles. Like the Great Wall of China, many companies have developed and implemented defences to protect their valuable data assets. However, one way to penetrate this protection is to deceive someone and get them to open the door. Ransomware attacks can be conducted through phishing emails containing malicious attachments or links. As a result, the victim is unable to access their systems or files until a ransom is paid. The health industry in the US saw a 71% increase in ransomware attacks in October 2020. Furthermore, the ever-evolving variants and tactics, techniques, and procedures (TTPs) make it challenging for security experts to keep up and the increasing instances of ransomware as a service (RaaS) makes it easy for anyone with little to no technical skill to conduct ransomware attacks against victims of their choosing.

Now, let’s take a look at the new trends that will have an impact on the ways information security is managed in 2021

1) Artificial Intelligence used for both attacks and defence

Advances in Artificial intelligence have made the technology more sophisticated and better suited for both carrying out cyber-attacks and defending against cybercriminals. The sheer quantity of security notices, of imminent risks, is too much for individuals to shift through and respond to in a timely manner. Automation and machine learning are now allowing human security researchers to identify the most crucial alerts from a vast amount of data and take effective corrective measures.

2) Automation of Security Processes

Humans are more prone to make mistakes than machines. We get tired, frustrated, and our emotions play a huge part in the decisions we make. Security automation is important for maintaining oversight of the large volume of data involved in a robust cybersecurity programme. Security automation is the machine-based application of security policies to track, investigate and remedy cyber-attacks programmatically with or without human involvement. Security automation helps to detect incoming threats and prioritise warnings as they appear, and then respond to them in a timely manner. Automation will become increasingly necessary, fuelling the rise of organisations working with microservices and containers at scale.

3) Zero Trust network access technology begins to replace Virtual Private Networks (VPN)

The Zero Trust paradigm is exactly as it sounds, never trust and always verify. The Zero Trust model assumes that breaches have already happened and verifies any request, regardless of where it originates, instead of believing that anything that happens behind the corporate firewall is safe and stable. Zero Trust differs from the standard security VPN paradigm in the sense that it constantly authenticates all users or computers attempting to reach the network, while VPN uses a one-time authentication mechanism that believes that once the user is inside the network, they are authorized. With rising security threats, Zero Trust network access is the trend that companies will increasingly adapt.

How will your business respond?

Organisations are advised to have the requisite plans and competencies to reduce the risks associated with cyberattacks. There will be an increase in cybercrime, given that more companies are going digital. Companies will now have to rethink their approach.

Security can no longer be an afterthought. Security needs should be considered on day one.

Today, Security Awareness training is essential for your company’s workforce. Symptai Consulting Limited and its security experts are willing to help companies concentrate on these and other risk factors, as well as the importance of a layered security approach within any organisation to lower their risks of cyberattacks.

So, is your organisation up to date with the security trends of 2021? Visit our Information Security services or Training & Education pages to learn how we can help today.