The global pandemic turned 2020 into the most disruptive year that most of us can remember, impacting nearly everyone in every country. As the seasonal surge continues, it’s important to keep in mind that we are still experiencing the short-term effects of this disruption and that just about everything in 2021 will be shaped by how the virus progresses and how we emerge, hopefully, in a post-pandemic world.
However, no matter how the next year plays out, two things are clear. Security threats have increased since the start of the pandemic, and enterprises are being forced to increase their focus on security because of it. According to Gartner, “2021 will bring increased exposure due to expansion of digital business ecosystems (digitalization), increased remote work, and even more widespread adoption of third-party services than in previous years. Security teams will need input from different organizational areas to help build a strong security roadmap.”[i]
With that in mind, here are five predictions for how we see security trends evolving in 2021:
Distributed Security – Digital Edge Playbook
Get the playbook that outlines how industry leaders are distributing security to solve scale and integration challenges. See how using interconnection and colocation enables industry leaders to deliver new command and control capabilities as part of their digital edge strategy.
Read More- Remote workforces will become bigger targets for cybercriminals
Because of the ongoing pandemic, for most of 2021, huge numbers of employees will continue to work remotely. Typically, it is my experience that remote workers are more relaxed operating in the comfort of their own home. Unfortunately, letting their guard down can leave them more vulnerable to attacks. This laxness in security could not come at a worse time as cybercriminals ramp up social engineering and ransomware attacks.
Home-based employees are also more likely to use personal devices and home networks that are not secured, or if they are, not to the same degree as enterprise devices and networks. In fact, many home systems have default configurations in use.
In 2021, I expect new attack vectors will target remote workers. Hackers will continue to engage in social engineering attacks and attempt to exploit vulnerable in-home devices that they can then use to compromise an individual and enable lateral movement into enterprise or business infrastructures. My expectation is that social engineering attacks will primarily involve various forms of phishing, including by email, voice, text, instant messaging, and even third-party applications. That being said, enterprises should also not dismiss the threat of frustrated employees who may feel they are not being observed from home.
- Zero trust will continue to gain momentum
As discussed above, remote working has challenged the way in which enterprises secure remote access to organizations tools and resources. The use of personal and corporate devices to access the network via public networks and third-party clouds is creating more opportunity for attackers.
Beyond expecting more attacks, we are starting to see enterprises use remote access as a justification to explore zero-trust security models to mitigate their risk. I expect organizations to begin building momentum and embracing these zero trust models in 2021. This should also result in an increase in managed services around active security monitoring such as threat detection and response and the increased adoption of authentication technologies.
- The pervasiveness of 5G and IoT will give attackers new targets
The promise of 5G is a totally interconnected world with the number of connected devices and the volume of data they create and share increasing significantly. This will give criminals more opportunities to launch attacks by targeting the connectivity itself, as well as the connected devices.[ii]
Securing 5G connectivity and the end-to-end IOT ecosystem will be a team effort, and this challenge will take on new urgency in 2021. OEMs and network service providers will start building holistic, end-to-end security into the underlying network infrastructure, while businesses will be compelled to start following best practices related to device security.
In fact, threat actors will focus much of their effort on unprotected IoT devices themselves with specially designed malware. This will increase the number and scale of new IoT botnets. This diffusion of IoT devices will attract ransomware that could develop specific malware variants to target these systems.
Attacks on consumer and industrial IoT devices, including smart homes, smart meters, e-health devices and connected cars are already taking place. Unlike a common ransomware attack, IoT attacks aim at gaining control of the connected system through the use of malicious code, forcing it to work incorrectly (i.e., manipulating the level of medicine in an insulin pump), and leaving the victim no choice but to pay the ransom in order to restore ordinary operations.
- AI/ML will be weaponized
Reliance on artificial intelligence (AI) and machine learning (ML) will soar in 2021. As AI and ML becomes widespread within enterprises for making automated decisions, hackers have a new vector to attack. After an attacker steals a copy of original training data, they can manipulate the learned models by injecting harmful data into a new model, creating a system that has learned something it shouldn’t.
This allows ML to determine patterns within security systems and identify vulnerabilities that have been found in similar systems/environments. Data from all subsequent attacks will be used to continue to train the cyberattack engine. This approach will allow attackers to zero in on entry points in environments far more quickly and stealthily as they will be targeting fewer vulnerabilities with each attack, evading tools that need a volume of activity to identify wrongdoing.
For example, on a business level, a criminal could sabotage a recommendation engine to damage a brand or even encourage more purchases of certain products. On a societal level, manipulating ML data could destabilize financial firms, undermine traffic systems and degrade healthcare outcomes.
Businesses, governments and especially solution providers must make the security of ML data a priority. They should also recognize that one of the most effective defenses against weaponized AI will be AI systems that are smart enough to detect and prevent such compromises.
- Cloud security will be shared between digital producers and consumers
In 2021, with cyberthreats rising, network, cloud and SaaS providers along with enterprises will begin coordinating their efforts to bridge the gaps between their security perimeters. Cloud access security brokers (CASB), secure-access service edge (SASE) and key management services (KMS) are increasingly popular ways to accomplish this. According to Gartner, “The market share of cloud-native solutions will continue to grow. Demand for cloud-based detection and response solutions, such as endpoint detection and response (EDR) and managed detection and response (MDR), will soar in coming years.”[iii]
Even with these cloud-native security technologies on the rise, we believe a lot of work still needs to be done in this area. By deploying IOA distributed security strategies on a neutral platform, such as Platform Equinix, you can develop an end-to-end plan for protecting your infrastructure from the core to the edge. In particular, Equinix SmartKey™, a global SaaS-based, secure key management and cryptography service, simplifies data protection across a hybrid multicloud architecture.
Defending a cyberattack surface at the edge
To meet the needs of at-home workers and provide access to new cloud services, digital transformations that used to take years must now be accomplished in months. This trend will continue in 2021 as businesses adapt to an ever-changing world and seek to increase competitiveness as the virus threat abates.
A key characteristic of a digitally transformed business is a highly distributed hybrid cloud infrastructure with more entry points at the edge. When businesses rapidly deploy these endpoints without proper security, they create a much larger attack surface, essentially providing more opportunities for criminals to attack individuals, enterprises and online businesses through these endpoints.
The good news here is that organizations that take a best-practice approach to implementing layered security at the edge via an Interconnection Oriented Architecture® (IOA®) and establish consistent security policies can build out their distributed infrastructure without increased risks. If an attacker manages to breach one security layer or area of the network, there is always another security layer to prevent further spread of the attack.
To learn more about best practices for dealing with the security threats that 2021 is certain to bring, download the Distributed Security – Digital Edge Playbook.
Related blogs:
Deconstructing Distributed Security: Zero Trust Security
How to Converse in Cloud: 3 Strategies for Cloud Security
A Practical Guide to Internet Vulnerabilities Threatening Enterprise Security
[i] Gartner, “2021 Planning Guide for Security and Risk Management,” By Analysts Ramon Krikken, Patrick Hevesi, Anna Belak , 9 October 2020 – ID G00729015.
[ii] Top 10 Cyber Threats to Private 5G/LTE Networks
[iii] Gartner, “Forecast Analysis: Information Security and Risk Management, Worldwide,” By Analysts Rustam Malik, Christian Canales, John A. Wheeler, Ruggero Contu, Mark Driver, Lawrence Pingree, Nat Smith, Elizabeth Kim, 9 July 2020 – ID G00727039.
Subscribe to the Equinix Blog