Whether you call them cybersecurity forecasts, online risk trends or security predictions, here’s a roundup of what our top security companies, industry experts and tech magazines are saying about the year (and decade) ahead. How can you prepare for 2020?
“The main thing is to keep the main thing the main thing.” These wise words of world-renowned business author Stephen Covey challenge each of us as we stand on the precipice of a new decade.
But what’s the ‘main thing’ when navigating technology as we enter 2020?
The simple answer is… Cybersecurity.
As innovation explodes into every area of our lives, cybersecurity is providing the glue that can enable the good and disable the bad for implementing cutting-edge innovation as well as reducing risk from older vulnerabilities. We also see cybersecurity continue as the top priority for chief information officers (CIOs) in 2020, just as it has been for most of the past decade, with groups like the National Association of State CIOs (NASCIO).
But even as cybersecurity solutions offer a way forward to ensure privacy protections are workable and effective, most people see the data breaches, ransomware, identity theft, denial-of-service attacks and other cyberattacks as proof that cybersecurity has become the Achilles Heel, not the savior, for new innovation. Even as exciting advances occur in artificial intelligence (AI), autonomous vehicles, 5G networks cloud computing, mobile devices and the Internet of Things (IoT), these same developments seem to cause negative societal disruptions that make daily news headlines.
So what will happen next with cybersecurity? That’s what this annual security prediction roundup will cover, from the perspective of the top cybersecurity industry companies, thought leaders, executives and journalists. Every year we catalogue the evaluators to see who has made a New Year’s security prediction list and checked it twice.
And the best security industry prediction reports do much more than just make educated guesses at what might happen in the future. The top 20 security predictions for 2020 dig deep into global security incident databases, analyze what’s working and what’s not, examine new cyber solutions and use science and data to gaze into the future.
The best prediction research shows us the “who, what, when, where and how” about the cybersecurity statements made. Some forecasts even include the why — with the best offering detailed context and a wider story that crosses years and sometimes even decades and learning from history. These presentations offer their materials in professional ways to maximize end-user usefulness regarding potential answers and recommended actions for enterprises and individuals to take.
Some call them security predictions, while others refer to them as cybersecurity trends. Several researchers prefer to offer “cybersecurity forecasts,” while others refer to “growing trends” or “situational outcomes” — based upon connecting the incident dots or running various data breach scenarios. Regardless, the central questions are very similar and methodologies used are (generally) repeatable.
2020 — and the New Decade
What are the greatest threats for the coming year? What solutions will be most important? What data breaches or ransomware attacks or other threats will cause the most harm? And readers say: "The more detail the better — please."
Common prediction themes across vendors include the 2020 elections in the U.S., more targeted ransomware, more ways to attack the cloud, and an explosion of problems with deepfake technology.
There’s disagreement on the most important cyberthreats to focus on as we head into 2020, even though everyone agrees that cybersecurity is more important than ever before. Just as in 2019, we have the continuation of arguments for and against AI (i.e., how helpful is AI really and will our enemies use it or not?). Also, the continued disagreement on whether cloud versus mobile threats are more of a challenge.
For 2020, AI does show up again in a number of new ways — with several specific warnings for those who fail to use AI to counter bad actors who will be using it.
There are also many ways that you and your organization can benefit by studying these predictions and implementing recommendations, and we outline several of those career benefits here. As always, I encourage you to visit the full reports, blogs, articles, PDFs, videos, and other materials referenced (hyperlinked) to dig deeper into the details on each company prediction list.
Please note that the embedded videos are only a small part of the marketing of these wider prediction reports. I also encourage readers to review the award winners for 2020 predictions at the end of this post.
Quick Security Prediction Recap on the Teen Years within the 21st Century
I’ve been writing about security predictions for more than a decade, and this annual holiday season tradition is now exploding even faster than the overall cybersecurity industry — mainly because cyberprotections are showing up as a top priority in every other industry from finance to defense and from government elections to toys. And make no mistake, this topic carries much more weight now than in December 2009, when we were heading into the second decade of the 21st century.
As I wrote back in 2016, while some were predicting that the cybersecurity industry would diminish in importance and be automatically built into every technology product (and quietly protect us from behind the scenes), the opposite has happened. Cybersecurity predictions, and the information security market overall, continue to surge as we head into 2020. Here’s what I wrote four years ago:
“The more the security and technology industries grow, the more predictions we will have. From the Internet of Things, to new technologies to robots to self-driving cars, do you really think we will be talking about security and privacy less in 2020? I don’t.
Predictions are not new, and they are not going away. In fact, they are just getting started. Congratulations security industry, and welcome to center ring in this three-ring circus. Yes, it is a very big circus, but that’s where all the action is.”
This year has brought (by almost double) the largest and most diverse number of security predictions ever online — when measured by several metrics. I received literally hundreds of emails and thousands of individual predictions — and also went out to explore as much of “the rest” online as of mid-December 2019. If we missed you or you want to add a prediction, email me at the https://www.govtech.com/blogs/lohrmann-on-cybersecurity/ contact address listed, and you may get a mention near the end — with a link to your list of your 2020 cyber insights. Our goal is to be as comprehensive as possible with this forecast summary and be a one-stop shop for security prediction lists for 2020.
As a reminder, here are the prediction reports from the past three years for your review and to help keep score:
The Top 20 Security Predictions Reports by Security Industry Company
1) Trend Micro – We lead off with another WOW prediction-report from Trend Micro – which takes the top vendor prize for best prediction report for the third year in a row. (And it wasn’t a close call.)
Here’s the Trend Micro intro: “The year 2020 marks the transition to a new decade, and recent notable events and trends signify a similar changeover in the threat landscape. Cybersecurity in 2020 and beyond will have to be viewed through many lenses — from differing attacker motivations and cybercriminal arsenal to advancing technological developments and global threat intelligence — only so defenders can keep up with and anticipate cybercrime mainstays, game changers, and new players. …”
A visit to: The New Norm: Trend Micro Security Predictions for 2020 will quickly show you the thought-provoking, creative, expert research and packaging that sets this report apart. Trend Micro groups their detailed predictions into 4 sub-headings (with explanations under each prediction) about our cybersecurity future, including:
Complex (these are only small excerpts):
One great Trend Micro example on deepfakes: News of cybercriminals using an AI-generated voice in social engineering surfaced in 2019. An energy company was reportedly defrauded of US$243,000 by scammers who used AI to mimic the voice of the firm’s CEO. More attempts will exploit the technology, using deepfakes of decision-makers to deceive an employee into transferring funds or making critical decisions.
2) FireEye - FireEye once again provides an excellent special report (20-pages) with predictions and guidance from four of their top leaders.
For 2020 the FireEye Report is entitled, The Road Ahead: Cyber Security in 2020 and Beyond. They include some insightful video from their top leaders and offer interesting perspectives from different vantage points in their organization. (However, I missed the opening letter from CEO Kevin Mandia that we saw last year, along with solid overall company predictions. See Kevin's video interview below.) For example, here are insights from Sandra Joyce, Senior Vice President of Global Intelligence:
Steven Booth the FireEye CSO leads with: “Proof of Compliance”
In 2020 there will be a broadening push on providers to offer more proof of compliance to industry regulations and customer requirements, with clear ways for their customers to validate that vendors are doing what they say they are doing.
Overall, the FireEye's prediction report addresses these topics:
This interview with Jim Cramer and FireEye CEO Kevin Mandia on CNBC discusses 2020 election threats.
3) WatchGuard Technologies again released a top-notch set of new year predictions. These cover the most prominent attacks and infosec trends that the WatchGuard’s Threat Lab research team believes will emerge in 2020, including voter registration database attacks, state-level GDPR legislation, cloud-focused ransomware, and more.
WatchGuard’s named their report: “A Simplified Approach to staying secure in 2020,” which is in contrast to the Trend Micro approach regarding complexity. What sets them apart (again) is the helpful video content to support each prediction, which is very professionally delivered.
Here are WatchGuard’s main predictions:
4) Forcepoint offers this excellent report: 2020 Forcepoint Cybersecurity Predictions and Trends, which includes video commentary on each prediction. They cover similar election and ransomware issues as others, but I especially like their unique prediction for “Deepfakes-as-a-Service.”
Deepfakes was a term that was coined in 2017 and relates to fake videos being created by deep learning techniques. We expect deepfakes to make a notable impact across all aspects of our lives in 2020 as their realism and potential increases. Our prediction is fourfold:
Some other predictions from Forcepoint include (see the full report for the details):
5) McAfee - McAfee Labs 2020 Threats Predictions Report was once again a top-notch forecast report which shows their quality research and insightful approach offered. This report is a glorified blog post, but with helpful links to their tops predictions, including:
McAfee also offers these separate privacy predictions for the coming year:
6) Splunk – Splunk again offers another very good prediction report, with several similar predictions to others. I did like the thoughtful quote at the start of their report: “It does not do to leave a live dragon out of your calculations, if you live near him.” — J. R. R. Tolkien
Splunk broke their predictions down into categories like:
7) Kaspersky Labs – Kaspersky always produces a ton of great material regarding threats for the coming year, threat reports, detailed analysis of risks, and so much more from all over the world. The problem (and reason they are not higher on this list) is that it is hard to find and very segmented and targeted towards many different audiences. While this may be a deliberate marketing tool that works for them around the world (and they are much bigger outside the USA), it is tough to find one solid list of all their predictions.
The good news, is that I have pulled from several lists and provide links here.
To begin, visit Kaspersky’s report: “Advanced Persistent Threats in 2020: abuse of personal information and more sophisticated attacks are coming.” Here are their headline items (with details at the links, as always):
Also visit these excellent Kaspersky reports on the present and future:
8) Sophos really stepped up their game this year with this Sophos Labs 2020 Threat Report. Just a well-done, solid material with plenty to offer – and excellent lead-in exec summaries here. They even take a 10-year-out prediction with a bold: “Ten years out, machine learning targets our ‘wetware.’”
Top Sophos predictions (with detailed analysis on each item) include:
9) Checkpoint offers their: 2020 Vision: Check Point’s cyber-security predictions for the coming year. There are 5 global cybersecurity predictions and 10 technology cybersecurity predictions. Here are some highlights:
Global cyber-security predictions for 2020:
Technology cyber-security predictions for 2020:
10) RSA Security (A Division of Dell) - RSA offers this easy to find and very well done report (that is very easy to use and jump around) with 20 Predictions for 2020: Preparing for the Future of Digital Risk.
They cover Business Predictions, InfoSec Predictions, Technology Predictions, Cyber Predictions, Consumer Predictions and Regulatory Predictions. While we liked RSA’s graphics and great displays, the predictions seemed a more like trends than new happenings. Still, definitely worth reviewing this report.
Here are their top 5 Predictions:
This separate prediction article with RSA execs is also very good.
11) AT&T - AT&T ThreatTraq came out with This Video With Predictions and Thoughtful Commentary. What I like about this is the relaxed, expert commentary which explains these three predictions in detail in a comfortable setting via a conversation.
12) Beyond Trust has a solid list of security predictions, that also go deeper into the 2020s (to 2025) with this lead in quote: “The more CISOs and other IT staff understand the security implications of evolving technologies, the better prepared they are to make the right investments for their business,” said Morey Haber, CTO and CISO at BeyondTrust.
Here are a few highlights for 2020:
Here are a few Beyond Trust highlights through 2025:
13) Fortinet offers this solid list of industry trends and New Threat Predictions for 2020. This very good report also offers a complementary set of activities in their threat landscape report. According to Derek Manky, chief, security insights & global threat alliances at Fortinet, "Much of the success of cyber adversaries has been due to the ability to take advantage of the expanding attack surface and the resulting security gaps due to digital transformation. Most recently, their attack methodologies have become more sophisticated by integrating the precursors of AI and swarm technology. Luckily, this trajectory is about to shift, if more organizations use the same sorts of strategies to defend their networks that criminals are using to target them. This requires a unified approach that is broad, integrated, and automated to enable protection and visibility across network segments as well as various edges, from IoT to dynamic-clouds.”
Topping their list of Fortinet predictions for 2020 are these items:
The Fortinet report ends with a video with solutions and recommendations on a path forward.
14) Experian – Offers another good report entitled: Data Breach Industry Forecast 2020 – which is free, but requires registration. You can read some more details on their report at this NextGov article.
Experian’s main findings forecasts include (with detailed explanation in the report:
15) Gartner - Gartner Top Strategic Predictions for 2020 and Beyond – Garter always does an excellent job of offering predictions on technology risk and cybersecurity in detailed ways – the trouble is that most of their material must be purchased. This fact lowers their ranking each year; nevertheless, the offer very helpful, specific advice that is oftentimes unique. Three of Gartner’s free prediction lists that I found intriguing as we head into 2020 include:
Gartner Top Strategic Predictions for 2020 and Beyond – including these three excerpts:
Data Security Predictions By Gartner For The Year 2020 – including these excerpts:
16) Forrester – Like their rival Gartner, Forrester also offers lots of excellent predictions in many business areas – but generally these come at a cost as in the case of their cybersecurity report for 2020. (Side note: I don’t review prediction reports that cost you money, but I will review reports that require users to complete a form to download.)
Nevertheless, there are exceptions, such as this Forrester Predictions 2020: On The Precipice Of Far-Reaching Change, which available for download once you provide contact your details.
Here are two highlights from that guide:
Here’s an insightful excerpt from Forrester: “But three troublesome dynamics are converging in 2020 and will persist beyond: 1. The importance of data and the power of being an insights-driven enterprise are increasing the damage factor of data breaches. 2. The adoption of emerging technologies like the internet of things is creating a larger attack surface that’s often built with only a few security controls, exposing enterprises in never-before-seen ways. 3. The unfortunate reality will come to light that evil forces can adopt technologies such as AI and machine learning faster than security leaders can. Simply put, there are more attackers with more sophisticated tools aimed at a larger attack surface. And those attackers want enterprises to pay.”
17) Forbes – Gil Press always does a nice job compiling diverse cybersecurity predictions over at Forbes, and this year is no exception. Last year he had 60 predictions for 2019 from various sources, and this year he is up to a robust 141 security predictions that are all over the map – but worth reading.
Here are his first two with great sources throughout:
Of course, Forbes has many other contributors beyond Gil Press, and they also have many other prediction lists. Here are a few to consider:
Tech Trends 2020: Moving From Disruption To Transformation – Here’s one item from this list:
With more connected devices comes the possibility that those devices and the networks connecting them will be hacked. Cybersecurity will also become increasingly important with new regulations like the California Consumer Privacy Act going into effect January 2020. Data security solutions focused on compliance will continue to gain traction.
And here’s a late update. Gil Press just released another 42 more cybersecurity predictions from industry executives for 2020. This just reaffirms what I mentioned above and continue to see in December 2019 – namely that everyone wants to get into the security prediction business.
18) Imperva – Imperva Offers their Top 5 Cybersecurity Trends to Prepare for in 2020 This well-written blog starts with: “I don’t need a crystal ball to predict that in 2020 cybersecurity attacks will accelerate and the tactics will evolve. We’ll continue to be hounded by greater volumes of the attacks that have threatened us for years and, as businesses adopt new innovations, new vulnerabilities to threats will surface.”
Here are Imperva’s Top 4 Trends (with details at the link):
19) Bitdefender – Bitdefender once again offers their 2020 Cybersecurity Predictions via their company’s Business Insights Blog. Jumping right in, the list looks fairly familiar with a few new twists:
20) Thycotic – Rounding-out the top 20 industry cybersecurity prediction reports is an intriguing from my respected colleague Joseph Carson at Thycotic, who always brings new material and unique insights to online webinar panels and cyber conference speeches. Thycotic’s Cyber Security Predictions and Trends for 2020
Related Reading: Can PAM Coexist with the Zero Trust Security Model?
Honorable Mention Security Predictions for 2020:
So what about all of the other cybersecurity predictions out there, along with hundreds of small tech companies with predictions from their CEOs? Here are some of those, but I also encourage you to visit the Forbes lists above which has even more.
One Prediction: Compliance fatigue will spread among security professionals - Being a source of ongoing controversy and debate, the California Consumer Privacy Act (CCPA) was finalized on 11th January 1, 2019.
One Prediction: Misconfigurations of cloud databases will continue to plague enterprises around the world and will be a leading cause of data breaches in 2020.
One Prediction: Increased caution around M&A deals. Learning from the mistakes of Marriott, companies going through M&A deals in 2020 will prioritize comprehensive evaluations of cybersecurity and risk. Before Marriott acquired Starwood in 2016, it was reported that Starwood suffered a breach of North American customers' credit and debit card data after threat actors implanted malware on the company's point-of-sale registers. Eventually, Marriott became aware of its breach of about 383 million Starwood guests' data when a security tool flagged a database query from an unauthorized user who had admin privileges. Although Marriott later found out that the intrusion went undetected for four years before acquiring Starwood, they still had to pay more than $120 million to the U.K. Information Commissioner's Office for violating GDPR, and the hotel giant can even face additional punishments from other data privacy mandates, including the soon-to-be-enforced CCPA. While M&A is an important part of many companies' growth plans, organizations will become increasingly wary of suffering a similar fate as Marriott. In 2020, organizations will place cloud security at the forefront of the M&A process by including thorough audits of how the acquisition or merger target is operating cloud services. In a multi-cloud world, companies will need solutions that provide complete visibility across all clouds and cloud services and encompass an approach to bringing these into their security and compliance posture via automation.
Drones Open up New Pathway for Intelligence Gathering - To date, the security concern around drones has mostly been focused on the physical damage nefarious actors, including nation states, could perpetrate. In 2020, we could start seeing attackers focus more on what drones know and how that information can be exploited for intelligence gathering, corporate espionage and more.
One Prediction Excerpt:
Email security will prove to be the weakest link in election security. Email is implicated in more than 90 percent of all cybersecurity attacks, and election infrastructure is also vulnerable to email-based attacks. This means email security must be a priority for thwarting interference with the 2020 presidential election. But research shows the majority of U.S. states are overlooking this vulnerability. Only 5% of email domains associated with local election officials across the U.S. have implemented and enforced DMARC.
Excerpt: Unfortunately, we don’t see this cyber security skills gap lessening in 2020. Demand for skilled cyber security professionals keeps growing, yet we haven’t seen any recruiting and educational changes that will increase the supply. Whether it be from a lack of proper formal education courses on cyber security or an aversion to the often-thankless job of working on the front lines, we predict the cyber security skills gap to increase an additional 15% next year. Let’s hope this scarcity of expertise doesn’t result in an increase in successful attacks.
Excerpt From Part 2: “For the future, the lines among actors will become increasingly blurred, as was the case when North Korea started making currency grabs when embargoed in the world community. Attribution is already highly unreliable, but false flags are getting easier to run. This makes the assumption that an attacker is who we think they are a potentially dangerous one. Expect the degree of specialization in the dark ecosystem of nation state players, hacktivists and cyber criminals to increase and become more murky and complex in 2020. Be leery of pat answers and pundits without real, tangible evidence, which is something rare in the world of cyber attribution. The connected world makes for strange bedfellows indeed on the dark side of the Internet.”
Here’s an excerpt: Quantum Communication Will Start to Become Integrated into Security Policies
Quantum communication, the field of applied quantum physics for protecting information channels against eavesdropping, will become an important technology for organizations that trade in sensitive and highly valuable information. …
But as researchers get closer to quantum supremacy, the tension will grow among organizations that are handling sensitive and highly valuable information. This tension will push certain organizations across the line to take protect their communications against cryptographic attacks through quantum communication technology. I predict that we will see this trend begin in 2020.
Here’s one of the eight predictions on Device security. “Nation state attackers will be the greatest cybersecurity threat in 2020,” says Joe Lareau, a senior security engineer at Exabeam. He notes IoT and the security of voting machines and repositories of voter information will be front and center. “Entities such as states and the federal government will react to the threat of election tampering by building and using ‘defense in depth’—multiple layers of controls that involve staffing, procedures, technical and physical security for all aspects of the security program.” And, of course, analytics and machine learning. The same will be true for operational technology (such as plan monitoring and control systems) and IoT devices in use at enterprises and governments such as security cameras, HVAC systems, and a myriad of sensors. These systems continue to be vulnerable to state actors looking to disrupt operations, to corporate and government espionage and to attackers looking to benefit financially from theft and ransomware.
Excerpt: The ‘I’ in CISO will start to disappear for companies with big industrial footprints. As IT and OT begin to be viewed as one, enterprises need to govern and secure them accordingly. Unless you’re a bank, the idea of being a CISO is going to become a thing of the past. The CISO is gaining responsibility for OT and as a result the role will be more than taking responsibility for securing information, they will have all the OT security responsibility too. Wherever there’s technology, it needs to be secured.
Excerpt: Cybersecurity budgets - Cybersecurity is at the top of every corporate executive’s mind. Companies have already started increasing investments in data privacy. Research has found that cybersecurity budgets have increased by 141 per cent from 2010 to 2018.
As a result, global investments in information security are expected to total more than $124 billion in 2019.
What’s more - companies are currently spending between $1,300 to $3,000 per employee on cybersecurity. This averages to about $2,300 per employee for most businesses. This, however, is not nearly enough. That’s why corporations are expected to increase information security spending by 8.7 per cent per year.
Excerpt: The smallpox of cybersecurity - passwords - will be eradicated by 2025. Passwords are ingrained in our society because they've been around for over 60 years, but this doesn't mean it's the safest way to secure our digital lives. Passwords are not only a hassle - they're antiquated and open us up to even more cyber threats. Similar to how smallpox was eradicated, if we ban together, we can wipe out passwords and the onus is on the technology industry to drive security forward by eliminating them. Capabilities like zero sign-on, software and hardware tokens, behavioral analysis, and biometrics already exist that allow organizations to switch to passwordless authentication today.
Excerpt: The “unknown” is the biggest cyber threat businesses will face
When protecting against known elements, such as WannaCry or other pre-existing threats, organizations have a clear picture of what the enemy looks like and can thereby adopt successful defensive techniques against such known threats. However, the biggest threats today are the ones we won’t know about until tomorrow (or even later), which is why a proactive, hacker-minded approach is integral to catching these issues before they’re found and exploited in the wild.
The next big breach is already happening now, and we’ll only learn about it months down the road. From what we continue to see with leaks and breaches, it’s often the exposed but unknown attack surface is that’s much more likely to sink an organization than breaks in their core apps or architecture (an exposed file, key, server, that nobody knew about or thought was a risk). And while one fundamentally can’t expect the unexpected, organizations can take steps to ensure there are fewer unknowns. In doing so, reduce their available footprint for being surprised, as well as get ahead of potential back doors to the organization.
Excerpt: Building Security Concerns Grow
In 2020, the prospect of smart building security is bound to become more of a top-of-mind concern for facility managers. With buildings accounting for eight out of 10 connected things in 2020, according to Gartner, smart buildings could provide new avenues for adversaries to attack. Experts are divided, however, whether there will be a significant uptick in such attacks next year. Mirel Sehic, global director of cybersecurity for Honeywell Building Solutions, expects such an increase. Attackers could use building management systems as a pivot point to get to IT data as well as to manipulate building controls.
Excerpt: Securing building operational systems will become a priority for many businesses as increased threats related to connected building technologies will likely arise.
The need to secure both Operational Technology (OT) and traditional Information Technology (IT) is expected to create demand for a new skillset and new type of security professional.
Excerpt from BitDam: Breach and attack simulation vendors will expand their solutions to various channels and attack vectors
There’s going to be a greater need for adversarial machine learning to combat supply chain corruption in 2020. Sean Tierney predicts that “the need for adversarial machine learning to combat supply chain corruption is going to increase in 2020. Sean predicts that the big problem with remote coworking spaces is determining who has access to what data. As a result, AI will become more prevalent in traditional business processes and be used to identify if a supply chain has been corrupted.”
Excerpt: The BYOD and CYOD trend enterprises have adopted will be met with employee pushback as increased regulations and growing privacy concerns continue to raise awareness about inefficient device security:
“67% of employees report using a personal device at work to some degree. As enterprises continue to adopt a BYOD (bring your own device) or a CYOD (choose your own device) strategy for their employees, there will be continued push pack from employees who are required to relinquish control over their mobile devices and the private data stored on them. As the stakes for privacy management become higher and higher from endless breaches (54% higher in 2019 alone) and increased regulations, like GDPR and CCPA, we’ll see enterprises deploy more effective means of privacy control for its employee’s personal devices (like application-specific security, as opposed to only device-level). This will mitigate privacy invasion for employees and enable tighter vulnerability controls for the enterprise, all while still providing necessary corporate data and accessibility to the end-user via the mobile device of their choice.” - John Aisien, CEO of Blue Cedar
Excerpt: Revenue growth is not a simple equation.
CompTIA predicts that the global IT industry will grow by 3.7% this year, and IDC is projecting $5.2 trillion in global revenue. However, this growth is not consistent across all areas of IT. IDC expects that technology services and traditional hardware will each grow by 23%, software will grow by 50%, and emerging technologies will grow by a whopping 104%. This growth in emerging technology is the driver for all the hype, but there are two things to remember. First, solutions using emerging technology require significant investment in skills and product support. Second, emerging technology solutions don’t exist in a silo—they are part of overall architectures that include traditional components such as networking or storage. Those components often need to be upgraded to take advantage of new trends, so there are revenue opportunities across the board, but simply targeting emerging technology will not automatically lead to astronomical growth.
Also from CompTIA: The biggest customer needs are (and will be) around software development and cybersecurity.
Except: “REAL ID will cause real chaos: As the October 2020 deadline looms, REAL ID will catch several states off guard. Expect states to scramble to meet demand for new licenses. In the rush, security will be placed on the backburner. At least one state will be caught with exposed, sensitive data on drivers. And infrequent travelers who failed to update to the new licenses will be disappointed when they are turned away at airport security and must cancel their vacation to Disney”
Excerpt: Biometric-based identity proofing and authentication will continue to be adopted in highly regulated industries to assure a person’s digital identity matches their real identity.
The global market for mobile biometrics is forecast to grow at an impressive 31.14 percent CAGR, adding $28.45 billion per year in incremental growth between 2018 and 2023, despite the CAGR decelerating by 22 percent in the period. The growth forecasts in the latest set of market analyst reports that indicate widespread adoption of biometrics technology: 22 percent for mobile biometrics, 22 percent for 3D sensors, and 19 percent for healthcare biometrics.
Excerpt: The Radicalized Insider. We have only begun to see the impact insiders can have on organizations as well as national and global security. While Snowden and Manning exfiltrated data for the purposes of shining a light on what they perceived to be unethical conduct, even more dangerous insiders focus on exfiltrating data to foreign governments and terrorist organizations. Cyber theft leading to the exploitation of national security is one of the top threats in 2020.
Excerpt from Gaurav Banga, CEO and founder of Balbix’s:
“In light of the ever growing cybersecurity skills gap, and an exploding attack surface, infosec leaders will shift their focus from increasing headcount to increasing efficiency. By prioritizing tasks based on risk, solving the most impactful issues first, CISOs can ensure that even a small team can have maximum possible impact.”
Excerpt: New adaptions for RATs – Liz Rowley went on to state how attackers could go about adapting their tactics.
Although cyber security teams may well have familiar viruses scouted, it’s important to remember that these kinds of attacks, much like their biological namesakes, can mutate.
“Cybercriminals are constantly redesigning Remote Access Trojans, or RATs, so they get better at bypassing security protections,” said Rowley.
Excerpt on first item: Dmitry Galov, security researcher at Kaspersky, sees the risk from employee-owned devices increasing in 2020. He sees a greater willingness for companies to allow employees to use their own devices to cut costs, enable remote work, and increase employee satisfaction. As a result, attackers will target personal devices as a way to bypass corporate defenses. “By default, users’ personal devices tend to be less protected than corporate devices as the average users seldom apply additional measures to protect their phones and computers from potential threats,” he says.
Quote from Gopal – “In terms of sheer speed, Russian hackers are now able to complete a major system breach in less than 19 minutes, eight times faster than their nearest competitors in North Korea” My prediction for 2020 An increasing number of CISOs will start focusing on The importance of Speed in Cyber Risk."
Excerpt: We Will See DDoS Attacks via Privacy Requests
“Taking advantage of new privacy regulations such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), motivated activists and attackers will flood companies with individual rights requests either as punishment for controversial views or as a distraction as a prelude to an attack. These rights, built into the regulations to allow you to request all the information a company has related to you, are a potential unintended attack vector that will be difficult to manage without proper processes in place to handle such requests at scale.” — Cindy Compert, IBM Security
Excerpt: Mobile devices will increasingly be targeted as more business processes and payment options migrate to mobile
Mobile devices have taken center stage in the lives of just about everyone. We use them for shopping, banking, communication, and everything in between. This ever-increasing adoption of mobile devices has provided attackers with a large attack surface, something that could only be dreamed about ten years ago. The threat of mobile device targeting is only going to increase in 2020 and beyond as handheld devices continue to be prominent in our lives. Organizations should also be wary of the risk from Shadow IT, particularly as bring-your-own-device policies are becoming increasingly popular. Having comprehensive insight into devices connected to your corporate network can make all the difference in preventing inadvertent backdoors and data exposures. From cybercrime to nation-state cyber espionage, the threat of mobile device targeting is something that can affect anyone, from individual consumers up to Fortune 500 companies.
Excerpt: A massive cloud data breach
I believe there will be a data breach to end all data breaches, and it will happen in the cloud and affect billions of users. Chances are it will happen to a hybrid cloud that will lead the hackers down a rabbit hole that will gain them access to multiple cloud entities. This breach will cause a fundamental shift in how cloud providers handle security; look for serious changes to the authentication process of cloud providers by the end of the year.
Excerpt: The social media revolution will (continue to) be weaponized Fraudulent activity and computational propaganda will play a major role in the increasingly polarized political landscape across the globe and in the US presidential election. Election meddling attempts will lead to widespread abuse on social and communication platforms, leveraging sophisticated bots to disseminate misinformation at scale. This will also play out in at the business level.
Excerpt: Rise of Mid-tier MSSPs:
In 2020, we will see a rise of the mid-tier MSSPs, as they are more focused on identifying the best tools to address specific cybersecurity challenges. The big channel partners on the other hand, are too focused on chasing money associated the sale of large, legacy providers that claim to “do it all.” Enterprises are increasingly frustrated with this approach and prefer partners with expertise on the latest, most effective security practices and solutions.
Excerpt: Rogue Security Software Vendors Escalate Their Efforts
In 2020, expect to see the propagators of rogue security software scams take their efforts to the next level, even by hijacking users’ computers, rendering them useless and holding them for ransom. A less drastic next step, however, would be software that is not explicitly malicious, but dubious at best. In these cases, users are technically getting the software that they pay for, but the reality is that this same software can actually be downloaded for free elsewhere.
Excerpt: Endpoint Security Vendor Consolidation
The endpoint security space has gotten a little less crowded over the past year as broad technology vendors pursue endpoint protection, detection and response capabilities. BlackBerry kicked the acquisition spree off in February by scooping up Cylance for $1.4 billion. Then in June, open-source search technology company Elastic announced plans to purchase Endgame for $234 million.
Two months later, Symantec announced plans to sell its struggling Enterprise Security division to semiconductor manufacturer Broadcom for $10.7 billion. And later in August, virtualization giant VMware announced plans to acquire Carbon Black in a transaction with an enterprise value of $2.1 billion.
Late-stage endpoint security startups like Tanium, Cybereason and SentinelOne will likely approach the point in 2020 where they’ll either need to conduct an initial public offering (IPO) or get acquired by an private equity firm or larger technology company. And as McAfee’s private equity owners look to exit their investment, media reports have indicated that the company could carry out an IPO.
Excerpt: Cyber concerns become safety concerns
Human safety has become dependent on automated, connected, cyber-physical systems. Factory machinery, medical devices, autonomous vehicles or city energy distribution going down could be disastrous – impacting not just costs but human life. We have already seen cyber attacks disrupt access to basic resources with the BlackEnergy and Industroyer malware in 2015 and 2016 – it is only a matter of time until we see a cyber threat to human life.
If safety is compromised by an attributable state-sponsored cyber attack, this will draw the attention of governments and international law – the Secretary General of NATO Jens Stoltenberg has already made it clear that a cyber operation could trigger Article 5, and adversaries may choose 2020 to test that commitment. …
Excerpt: The road ahead for autonomous cars becomes longer and more limited
If you think vehicles that drive themselves sound like science fiction, you’re not alone. Many of us still think that autonomous cars sound pretty far out. And, in a sense, they are.
As we all know, autonomous vehicles exist in the real world today. However, that doesn’t mean we’ll see them out in force on Main Street any time soon. Instead, the majority of autonomous vehicles successfully coming to market will have a narrow scope and reach. ...
I really like Jason's #3 and #4. Excerpt:
Cloud Phishing Will Increase as a Primary Tactic for APTs.
Phishing attempts will primarily launch through cloud applications instead of emails. Users implicitly trust the many cloud applications used in the workplace, making them vulnerable to phishing tactics. Similarly, mobile devices are becoming the primary cloud access venue, which makes them attractive targets for phishing attacks that take advantage of the small screen form factor of mobile devices to lure users to open malicious content.
Accidental Exposure and Misconfiguration will Increase the Severity and Variety of Breaches
Cloud data breaches rooted in accidental exposure and misconfiguration of cloud applications will increase both in severity and in the number of different cloud apps that are affected. This aligns with Gartner’s prediction that by 2020, 95% of cloud security failures will be the customer’s fault. As cloud adoption continues to grow and more data is stored and shared in the cloud, exposure of that data is something that security teams will have to deal with.
2020 Security Prediction Awards
Top Security Industry Predictions Report - The New Norm: Trend Micro Security Predictions for 2020 - Trend Micro (for third year in a row.)
Individual Prediction that is Most Unique, Different and Insightful – “The unknown is the biggest cyber threat businesses will face.” Bugcrowd
Individual Prediction that is Most Creative — “Deepfakes-As-A-Service emerges.” ForcePoint
Individual Prediction that is Newest & Specific (2 Tie)— “False flag attacks reach a whole new level. Explanation: This will develop further, with threat actors seeking not only to avoid attribution but also to actively lay the blame on someone else. Commodity malware, scripts, publicly available security tools or administrator software, mixed with a couple of false flags, where security researchers are hungry for any small clue, might be enough to divert authorship to someone else.” Kaspersky
Also – “REAL ID will cause real chaos: As the October 2020 deadline looms, REAL ID will catch several states off guard.” Varonis
Individual Prediction that is Most Scary (yet practical) — “Hackers will find new low-hanging fruit in the cloud. The most advanced (and potentially devastating) cloud attacks will occur at machine speed in 2020.” Splunk
Individual Prediction that is Most Common and Likely — (3 Tie) – More Targeted Ransomware & Deepfakes cause (myriad) problems & various election hacks and misinformation campaigns will emerge (Numerous)
Topic of Most Disagreement Among Security Companies — Cloud –vs- mobile threats will take the lead – multiple companies on both sides. (Numerous – but more say cloud over mobile malware)
Best Overall Advice in Predictions Report — “We are all targets. If you work with a high value target, you are also a high-value target.” FireEye
Final Thoughts - What's Missing?
Just as I was preparing to release this report, Boris Johnson won a surprise landslide victory in the U.K. election – running on “Get Brexit Done.” (The polls predicted a small victory or hung Parliament.) This surprise result reminds us (again) that plenty of unknowns will emerge next year – making Bugcrowd’s quote about the unknown so relevant in cybersecurity.
Missing in the prediction lists again this year are specific predictions about hacks related to upcoming events (the U.S. election excluded from this comment which is covered by almost everyone.)
There is little about the 2020 Olympics or other major sporting events. Could Russia being banned from the Olympics and 2022 football World Cup lead to trouble? Or, could hacktivists disrupt world leaders meetings at the G8 or NATO or other various summits?
Finally, will cyber terrorism reemerge? Very few dire predictions (again) about Cyber 9/11s or Cyber Pearl Harbors or even people dying in hospitals from cyberattacks.
Could implanted chips become a big privacy debate and/or cause other security issues? I think so – but perhaps not in 2020. I do predict that this issue will be huge for the next decade and bring a new round of opposition from the privacy activists and others for religious and other reasons.
In closing, Boris Johnson pledged to unite the United Kingdom and heal its Brexit divisions in his speech after his victory.
2020, he said, would be 'a year of prosperity and growth and hope.'
That’s one prediction that I hope comes true for all of us around the globe, wherever you live, whether offline or online.