Cybersecurity Predictions for 2020

It’s that time of the year again! As we roll into 2020 we’re proud to present our 4^th edition of “STEALTHbits’ Experts Cybersecurity Predictions.”

We asked eight of our top industry voices here at STEALTHbits their thoughts on what’s to come in the world of cybersecurity in the next 365 days! Read on and come back at the start of 2021 to see how we did.

Ransomware Will Continue To Wreak Havoc Using the Same Old Tricks

Ransomware attacks will continue to impact organizations causing significant costs, downtime, data and reputation loss. Moreover, they will do so using the same techniques they have been using for years. As we’ve seen in recent variants, ransomware has been used very successfully in targeted campaigns without relying on zero-day exploits or security vulnerabilities. The initial compromises are commonly through email phishing. From there privilege escalation and lateral movement occur using unpatched vulnerabilities (e.g. EternalBlue) that have existed for years, and the compromise of overprovisioned administrator accounts with standing privileges. Endpoint protection is not enough, and until companies are able to reduce the attack surface significantly, these attacks will continue to succeed.

• Jeff Warren, General Manager, Products

Focus will Shift to Securing Privileged Access

In the 2020 election cycle, malicious actors will exploit administrative privilege in electronic voting systems to alter or destroy votes. Seeking to sow greater discord than their successful operations in the 2016 election cycle and emboldened by the limited repercussions, foreign actors will use techniques to compromise electronic election systems similar to those they use to attack corporations in the United States and around the world. Their favorite target? Privileged access. With unfettered access to voting machines or the counting system, they can bypass any other security control. We should all be asking how privilege is managed and who has access to it, just as we do within the corporate security domain today.

• Gerrit Lansing, Field CTO

Increases in Global Privacy Regulation

More countries/states will look to provide Consumers rights over their data. In the U.S., California continues to lead the other states in data privacy and protection regulation. These regulations provide consumers transparency and control over the data organizations collect about them and increase the fines for those companies that do not comply. In the U.S. in 2020, the government will begin to help organize regulation across all 50 states.

• Ralph Martino, VP, Product Strategy

Misconfigurations Make for More Mayhem

On-premises or in the cloud, misconfigurations mean open doors. It can be a big misconfiguration like a wide-open Amazon storage bucket containing a quarter-million documents or a seemingly small one like a random desktop that allows an attacker to scrape privileged credentials from memory that does it, but rest assured, configuration management will continue to be a topic we collectively agree is a problem, but likely won’t prioritize above many others as we enter this new decade. We’ve been dealing with this subject for at least 20 years, yet it continues to plague enterprises of all sizes. It’s not an issue of ignorance or laziness. Part of the problem is that even when configuration violations are identified, there may not be enough people or people with the proper skillsets to fix them in a timely fashion. The bottom line is that configuration management (or lack thereof) is still a significant contributor to data breach and we will not see that change in any significant way in 2020.

• Adam Laub, CMO

Data Security and Privacy will Collide in a Big Way

In 2020 data privacy laws like CCPA (California Consumer Privacy Act) will become a top priority for senior management. Several other states are drafting similar legislation so this privacy trend will quickly spread across the county. IT teams will have to figure out how to meet these new privacy requirements in an environment that is constantly under attack from cybercriminals. Consumer data requests will initially be done by hand, but large organizations will have to quickly figure out how to automate this data retrieval in order to keep up with demand.

• Darin Pendergraft, VP, Product Marketing

An Increasing Acceptance of Subscription over Perpetual

The security software market has been much the same for almost two decades but unfortunately, the problems of today are much different than the problems of twenty years ago. I am seeing a growing acceptance of organizations willing to evaluate new methodologies, whether it is transitioning workloads and access policy to the cloud, subscription licensing models or new, more efficient workflows that reduce complexity. In particular, I am seeing a wide-spread adoption of subscription licensing for on-prem PAM software, a market that has always lent itself to perpetual; vendors need to embrace these new models or get left behind.

• Martin Cannard, VP, Product Strategy

Security Budgets and Spending will Continue to Increase

We have seen spending on security budgets skyrocket over the last 5 years. Most of this has focused on improving the security of customer privacy and data. Consumers, justifiably so, have a general distrust for a company’s ability to protect their data and privacy. As such we can expect new roles to be established in more organizations with an outward focus on what a company is doing around data and privacy.

• Rod Simmons, VP, Product Strategy

Breaches will Increase Significantly in 2020

“Those who do not learn from history are doomed to repeat it.” This quote or similar means we’re likely to repeat mistakes if we do not learn from them. What has history taught us about data breaches and cyber-attacks? There are a lot of them, and no shortage of ways to compromise an organization’s cyber defenses. 2016 saw 1,093 reported data breaches and 2017 saw 1,579. Over a 30% annual increase. 2018 had an eye-popping 424% breach increase. 2019 has shown a 33.3% increase so far over 2018. Following this four year trend, 2020 will be worse. Simply stated, as an industry, we have NOT learned how to defend against these attacks and therefore they will continue to see more of them. Global average breach costs have remained somewhat static for the past four years, hovering around $3.5-$4M per breach with the US being the most expensive in 2019 at $8.2M per. Even the threat of significant costs doesn’t slow breaches down. Will 2020 be the year we turn things around and begin to see a breach decrease? Only time will tell.

• Damon Tepe, Director of Product Marketing

Want to see how we did with our 2019 predictions? Check out last year’s blog here!