Boards of directors will finally appreciate that information security risk management should be treated as an enterprise risk equivalent to financial, reputational, and legal risk. Too often board members see the light only after a data breach. Having understood how security risk impacts the business, in 2016 they will make sure to change corporate culture in the direction of a good security risk management program. Next year will be a very important year for cyberinsurance, boards are going to ask for this. PwC predicts that the cyber insurance market will triple in the next five years and this will force boards to take a long, hard look at the cost of their continued insecurity.
BUDGET SURVIVAL TIPS
The things that will get approval are projects designed to cut the cost of doing business. Smaller-scale IT security initiatives that have a quick ROI, e.g. new school security awareness training which combines training with simulated phishing attacks, will be popular with management and boards.
CEO FRAUD aka BUSINESS EMAIL COMPROMISE
Looking at the rapid uptrend of CEO Fraud over the past year, this will be the new scourge in 2016 following ransomware, hitting consumers, small and medium enterprise and large enterprise with competing cyber mafias specializing in verticals like financial institutions, healthcare and manufacturing.
INTEGRITY ATTACKS
Think Stuxnet for the Financial Industry. The data breach attacks we have seen by the hundreds are loud and obvious. They expose data which causes embarrassment, inconvenience, and financial losses.
Integrity attacks are stealthy, selective, and can be much more devastating. Instead of doing damage or making off with vast amounts of sensitive data, they instead focus on carefully changing particular elements within transactions, communications, or data to gain a significant benefit.
In 2016, you will see an integrity attack in the financial sector in which millions of dollars will be stolen by cyber thieves who will modify selected data in the transaction stream, resulting in a significant redirection of payment to anonymized accounts. How they'll get in? Spear phishing.
INTERNET INFRASTRUCTURE
2016 is the year that passwords will start to disappear. Biometrics like voice and face recognition go mainstream and 2-factor tech like authentication code generators on mobile phones will spread exponentially. For your own infrastructure, look at containers that host similar 2FA micro-services that you can integrate in your own apps. Nation-states will continue battling for the domination of Internet backbone and infrastructure components.
INTERNET OF THINGS
6.4 billion connected “things" will be in use globally by the end of 2016, but IoT standards related to security are a hodge-podge. There are literally hundreds of standards that potentially touch IoT and precious few that directly accommodate IoT. It's the early days and there is no consensus.
As long as vendors' #1 concern is "time to market" and not "security by design" you will see a flurry of attacks on IoT devices like Talking Barbie and others. Cutting edge criminal hackers will create the very first BoT - Botnet of Things. Don't leave any kind of Wi-Fi enabled devices or toys in the master bedroom!
MALICIOUS E-COMMERCE GOES SOCIAL
Many traditional social networking sites such as Pinterest, Facebook and Twitter will add “buy” buttons to their platforms in an effort to increase stickiness with their users and help monetize their user base. It's going to be heaven for cyber criminals who will social engineer themselves into millions.
MOBILE MALWARE
Mobile malware, specifically mobile banking Trojans, are on a trajectory to become much more prevalent for banks and financial institutions in 2016. There will be an increase in malware families that are gaining root access rights on users' devices. These attacks will pose a significant problem for many financial institutions, who have thus far mostly ignored the threats mobile devices pose. Commercial malware authors will continue to reinvest at ever greater rates, bringing them toward the "spending power" of nation-state activity. This includes purchasing zero days. The bad guys have lots of cash and they are smart investors.
RANSOMWARE
A ransomware crime wave will surge across America.
The use of Cryptowall 4.0 will explode, and Cryptowall V5.0 will add an actual working "feature" that TeslaCrypt only threatened with: extortion by potentially publishing private personal or business files on the Internet.
Cyber mafias will focus on professional services firms and local government using Cryptowall as their tool and extort tens of thousands of dollars from organizations that don't want their business disrupted or their intellectual property compromised.
Cryptowall will be the first strain of ransomware to hit the billion dollars in damages.
Ransomware is the new APT: "Annoying Persistent Threat", as it will be increasingly used in double payload attacks combined with other scams.
Ransomware attacks doubled in 2015 and will double again in 2016. The U.K. is to some extent a bell-weather for the U.S. as they function as a beta test site for Eastern European cyber mafias who can test malicious code in their own time zone. Well, over half (54%) of all malware targeting UK users in 2015 contained some form of ransomware. Buckle up.
Ransomware-as-a-service hosted on the TOR network and using Bitcoin for ransom payment enables a new generation of cybercrime newbies to make their mark.
A new sleeper ransomware variant will start to stealthily encrypt data, pull your critical files onto a C&C Server, and wait until a backup has been made. At that point they will yank the encryption key and demand a much larger amount of ransom than the current 500 bucks.
SOCIAL ENGINEERING
IDG asked hundreds of high-level InfoSec pros the following question: "What will be the single biggest security threat of 2016?" The number one answer was: "people". With events like the presidential election drumming up a frenzy of social media activity in 2016, you can expect attackers to use the attention given to political campaigns, platforms and candidates as an opportunity to tailor social engineering lures.
To quote Corey Nachreiner, CTO of WatchGuard: "The single biggest threat you’ll face in 2016 is your own people." Check out their video and recommendation. Could not have said it any better myself: https://www.youtube.com/watch?v=4rJdYBcvxqs
