“Really? After we completely blew it last year?” said one chief strategist.
“Wow! We’re not even out of the woods yet with COVID-19,” said a marketing expert. “How can we talk about the post-pandemic world with credibility?”
“I doubt many cybersecurity companies will fully participate right now Dan. So many moving parts, industry disruptions, budget challenges, political issues, new tech unknowns and more. …”
The many “bah humbug” thoughts and opinions shared about even attempting to look at upcoming online cybertrends reminded me of this 2016 Computerworld editorial on the folly of cybersecurity predictions and my response in CSO Magazine explaining why we continue to have more security predictions and how you can benefit.
But despite some naysayer forecasts assuming a lack of interest in security predictions for the coming year, I can definitively announce another growth in new security industry predictions, forecasts and related trend reports (with new lists) for 2021.
In the past two months I have received a deluge of emails with interest from small, medium and large companies who want to get on board the prediction/forecast train now. Many others are back for more.
Some cybersecurity findings that will impact next year require digging and Google searching. Nevertheless, there are more companies participating, with more interest, more forecasts, and bolder statements about future cybersecurity directions and our coming online life after the pandemic recedes.
Yes, we are seeing some new twists, as we do every year. More companies are renaming these reports away from the traditional “predictions” or “forecast.” White papers and reports are using words like “trends,” “findings,” “cyberissues,” “recommended solutions,” “actions required,” “themes” or other words that still point to their desire to describe what happened, what is coming next and what needs to be done now to prepare for 2021 and beyond.
A few companies, like McAfee, decided to hold off and issue their prediction reports in January, so they are not included. But no matter which words are used, all of these organizations seek to be seen as “thought leaders” and/or trend-setters for new, global cybersolutions and even crisis imperatives.
Who’s right? Who should we listen to after 2020? Where are the “true thought leaders?” You will need to decide, but without a doubt, these lists can help. I urge you to follow the links and dig much deeper into key topics.
Last week, I released my roundup of 2020 cybersecurity trends, which describes how COVID-19 brought a global cyber pandemic. Shortly after that year-end report was released, we learned about the massive scale of the SolarWinds breach, which even impacted the U.S. nuclear weapons agency. Therefore, the cyber pandemic was even broader and deeper than previously revealed — while the headline topic remains the same.
Reviewing 2020 Predictions — Good, Bad and Ugly
Last December, in “The Top 20 Security Predictions for 2020,” we reported this about the new decade: “Common prediction themes across vendors include the 2020 elections in the U.S., more targeted ransomware, more ways to attack the cloud, and an explosion of problems with deepfake technology.
“There’s disagreement on the most important cyberthreats to focus on as we head into 2020, even though everyone agrees that cybersecurity is more important than ever before. Just as in 2019, we have the continuation of arguments for and against AI (i.e., how helpful is AI really and will our enemies use it or not?). Also, the continued disagreement on whether cloud versus mobile threats are more of a challenge. …”
Of course, there is no mention of a global pandemic and the impacts that it would have regarding an explosion of security issues from more staff working from home. I did write this: “Finally, will cyber terrorism reemerge? Very few dire predictions (again) about Cyber 9/11s or Cyber Pearl Harbors or even people dying in hospitals from cyberattacks.”
Little did we know that a cyber pandemic would be the top year-end summary story for 2020, which would include ransomware, data breaches, health-care attacks impacting patients and now the SolarWinds data breach. In June 2020, I published this mid-year set of blog predictions in a special coronavirus edition with select vendors.
2021 Security Industry Prediction Trends
Moving on to predicting 2021, here are some major trends that cut across a large number of cybersecurity industry prediction reports:
- There will be huge security impacts in the coming year from the move to work from home (WFH) fueled by COVID-19. More attacks will occur on home computers and networks, with bad actors even using home offices as criminal hubs by taking advantage of unpatched systems and architecture weaknesses.
- The rush to cloud-everything will cause many security holes, challenges, misconfigurations and outages.
- More growth in the security industry. Our numbers of new products and new year mergers and acquisitions will cause network complexity issues and integration problems and overwhelm cyber teams.
- Privacy will be a mess, with user revolts, new laws, confusion and self-regulation failing.
- Identity and multi-factor authentication (MFA) will take center stage as passwords (finally) start to go away in a tipping-point year.
- Tons of high-profile Internet of Thing (IoT) hacks, some which will make headline news.
- Ransomware will get worse and worse — with new twists, data stealing prior to encryption, malware packaging with other threats and very specific targeting of organizations.
- Lots of 5G vulnerabilities will become headline news as the technology grows.
- Advanced Persistent Threats (APT) attacks will be widely available from criminal networks. The dark web will allow criminals to buy access into more sensitive corporate networks.
- Mobile devices, including smartphones, will be attacked in new ways, including app stores.
- Cryptocurrencies will play new roles, with criminals switching often for hiding advantages.
- As digital transformation projects grow, many plans will implode as security challenges mount.
Important Note: I urge readers to visit these company portals, read their full prediction reports and see the details on each research item. Our goal is to point you in the right direction for more details and solution specifics.
1) Trend Micro takes the top prize (again) for another outstanding research report — with so much more packed into an easy-to-access document with references as well as great summaries and sub topics.
Turning the Tide: Trend Micro Security Predictions for 2021 starts with the summary: “In 2021, organizations will scramble to deal with the far-reaching effects while striving to stay secure as online dependency grows. We discuss the developments that are not only plausible but ones that should also be anticipated. We look into the drivers of cybersecurity’s near future and how organizations will have to adapt as threats and technologies exert their influence. Our report aims to empower organizations and decision-makers to frame a proper, strategic response that can withstand change and disruption.”
This year, Trend Micro offers details on:
- What At-Home Workers Need to Know (including their mid-year 2020 roundup)
- What Enterprises Need to Know
- What Governments Need to Know
- Future-Looking Cybersecurity Solutions
- Threat actors will turn home offices into their new criminal hubs
- Teleworking setups will force organizations to confront hybrid environments and unsustainable security architectures
- Attackers will quickly normalize newly disclosed vulnerabilities, leaving users with a narrow window for patching
- Exposed APIs will be the next favored attack vector for enterprise breaches
- Enterprise software and cloud applications used for remote work will be hounded by critical-class bugs
2) Watchguard once again issued a great report entitled 2021 Cybersecurity Predictions with videos and much more. “In 2021 and beyond, we predict that cyber criminals will find new and innovative ways to attack individuals, their homes and devices, in order to find a path to your trusted corporate network. The global pandemic has rapidly accelerated the existing shift toward remote work, where employees operate beyond the protection of the corporate firewall. In turn, hackers will exploit vulnerabilities found in the gaps between people, their devices, and the corporate network.”
Watchguard’s top eight predictions include:
- Automation Drives Tidal Wave of Spear Phishing Campaigns
- Cloud-Hosting Providers Finally Crack Down on Cyber Abuse
- Hackers Infest Home Networks With Worms
- Booby-Trapped Smart Chargers Lead to Smart Car Hacks
- Users Revolt Over Smart Device Privacy
- Attackers Swarm VPNs and RDPs as the Remote Workforce Swells
- Attackers Pinpoint Security Gaps in Legacy Endpoints
- Every Service Without MFA Will Suffer a Breach
3) FireEye — FireEye always offers an excellent set of helpful materials in their report. This year the report is called A Global Reset: Cyber Security Predictions 2021. The 12-page FireEye/Mandiant forecast addresses these topics:
- How remote work will evolve and affect organizations operationally
- Insights into how threat actors will take advantage of the pandemic
- The growing need for intelligence-led security validation
- The future state of cloud security
- Nation-state activity and changing TTPs
- How ransomware has pivoted from business risk to a national security risk
“Despite the urgency of their work, threat actors will continue to target healthcare providers and vaccine makers. In the near term, the coronavirus will likely continue to have a significant impact on normal business operations, with a focus on supporting remote work, virtual events and new productivity platforms. The pandemic forced almost every organization to become better at operating under significantly changed working conditions and in the wake of a changing environment, IT and IT security challenges will most likely persist throughout 2021 .In the longer term, technology solutions will step in to facilitate the return to work, school and other activities, potentially introducing new risks for privacy, personally identifiable information (PII) and protected health information (PHI). Similarly, the desire to reduce the risk of human exposure may further accelerate the shift to autonomous vehicle and robotic solutions in transportation, manufacturing and other fields.”
4) Splunk has again produced an impressive (21-page) pdf/ebook with some excellent analysis and their Data Security Predictions for 2021. Here are a few:
- Pandemic workforce disruption will drive a greater focus on endpoint security and the zero-trust model
- Supply chain attacks mean that the bad guys won’t just hack your organization — they’ll hack your stuff
- Faster-moving digital transformation will include more artificial intelligence in the SOC
- Capitalizing on pandemic disruption, attackers will find more openings in newly adopted technologies and through imperfect M&A
The good news is that I have pulled from different lists and provide links here.
First, start with these Kaspersky Advanced Threat predictions for 2021 (see report for more details under each item):
- APT threat actors will buy initial network access from cybercriminals
- More countries will use legal indictments as part of their cyberstrategy
- More Silicon Valley companies will take action against zero-day brokers
- Increased targeting of network appliances
- The emergence of 5G vulnerabilities
- Demanding money “with menaces”
- More disruptive attacks
- Attackers will continue to exploit the COVID-19 pandemic
- Random infections — “Infections will tend to be less random or have non-random follow-ups, as cybercriminals have spent the past several years profiling randomly infected computers that are connected to industrial networks or have periodic access to them. Access to such computers will be – and is perhaps already being – resold to more sophisticated groups with specific schemes for monetizing attacks on industrial facilities already in place.”
- Ransomware attacks — “Ransomware is becoming more technically advanced and sophisticated. Cybercriminals will continue to employ hacker and APT techniques, painstakingly exploring and probing the network of the target organization to locate the most valuable/vulnerable systems, hijack administrator accounts, and launch simultaneous blitz attacks using standard admin tools. …” And, “It is highly likely that we will see attacks disguised as ransomware but pursuing completely different goals – a repeat of the ExPetr technique.”
- Cyberespionage — “Cybercriminals will figure out (some already have) that inside the OT perimeter secrets are not guarded as well as in office networks and that OT networks may be even easier to break into, since they have their own perimeter and attack surface.”
- APT — “The number of APT groups will continue to grow – we will see more and more new actors, including ones that attack various industrial sectors.” And, “In addition to data theft and other piecemeal operations, some group is likely to get down to more serious business in 2021, perhaps in the vein of Stuxnet, Black Energy, Industroyer and Triton.”
- COVID-19 consequences — “Against the backdrop of economic decline, lockdowns, slower growth and ruin for small businesses, the ranks of cybercriminals are sure to swell as skilled people seek alternative employment, and groups associated with national governments will strengthen as well. And, “The online presence of municipal services and utilities and the increased digitization of government and public services will make them more vulnerable to attacks of cybercriminals and create more opportunities for cross-agency attacks and assaults on central and local government functions and the systems that support and implement them. For example, a threat actor could use a governmental or municipal web service as an entry point, compromise the victim’s internal infrastructure and use the communication channels and supply chain connecting various governmental, municipal and even private organizations to reach their final target (such as shutting down transportation systems).”
- Cracking down hard on the cybercrime world. In 2020, OFAC announced that they would supervise any payment to ransomware groups. Then U.S. Cyber Command took down Trickbot temporarily ahead of the elections. There should be an expansion of the “persistent engagement” strategy against financial crime. There is also a possibility of economic sanctions against institutions, territories or even countries which show a lack of resolve to combat cybercrime that originates within their territories.
- With the special technical capabilities of monitoring, deanonymization and seizing of cryptocurrency accounts now in place, we should expect cybercriminals to switch to transit cryptocurrencies for charging victims. There is a reason to believe they might switch to other privacy-enhanced currencies, such as Monero, to use these first as a transition currency and then convert the funds to any other cryptocurrency of choice, including bitcoin.
- Extortion on the rise. One way or another, cybercriminals targeting financial assets will rely on extortion. If not ransomware, then DDoS or possibly both….
Here’s their list with more details in the link:
Pandemic-Related Developments
- Securing the “next normal”: In 2021, COVID-19 will still be impacting our lives, businesses and societies, and those impacts will change as the year progresses. So we need to be ready for a series of “next normals” as we respond to those changes.
- No cure for COVID–related exploits: As COVID-19 will continue to dominate headlines, news of vaccine developments or new national restrictions will continue to be used in phishing campaigns, as they have been through 2020.
- School’s out — targeting remote learning: Attacks will continue to disrupt remote learning activities over the coming year.
- Double extortion increases the ransomware stakes
- The botnet army will continue to grow
- Nation shall attack nation: Cyberattacks by nation states will continue to grow, whether for espionage or to influence events in other countries
- Weaponizing deepfakes
- Privacy? What privacy?
- 5G benefits and challenges: The totally connected, high-speed world promised by 5G also gives criminals and hackers opportunities to launch attacks and cause disruption by targeting that connectivity. E-health devices will collect data about users’ wellbeing, connected car services will monitor users’ movements, and smart city applications will collect information about how users live their lives.
- Internet of Threats: As 5G networks roll out, the numbers of connected IoT devices will massively expand, drastically increasing networks’ vulnerability to large-scale, multi-vector cyberattacks.
For 2021, I was pleasantly surprised by Gartner’s security trends and other materials in report format that are available for free – if you know where to look. Although there are pointers to plenty of subscriber content and the items below are in non-typical formats; nevertheless, the material is excellent and very helpful for security analysis and planning for 2021.
First, we have Gartner’s cybersecurity research for the top 10 security project priorities for 2021. Here are the first seven of those with details in the link:
- Remote Workforce Security
- Risk-Based Vulnerability Management
- Extended Detection and Response (XDR)
- Cloud Security Posture Management
- Seamless Cloud Application Controls
- Domain-Based Message Authentication (DMARC)
- Passwordless Authentication
- Major changes in global business and workforce will have immediate and long-lasting impacts on security planning
- Security monitoring and response will continue to depend on automation and analytics delivered through internal skills and managed services
- Emerging cybersecurity platforms will cause organizations to reconsider security and solution architecture
- Containers, DevSecOps and distributed cloud will continue to transform infrastructure security architecture and management
- Expanded data, analytics and application service ecosystems will cement the need for data-centric security architecture and application security
- Endpoints, mobile devices and software as a service will continue to drive expansion of native security capabilities and add-on solutions
“With the move to mass remote working and accelerated digital transformation in 2020, cybersecurity has moved up the foodchain. Cybersecurity is now a business differentiator, and it needs a category disruptor. The need for a converged, digital, cloud-delivered platform means we’ll see the emergence of the ‘Zoom of Security’ – a high-tech system that ‘just works’ and is easily accessible for the everyday consumer.”
- “Inherent Bias in Machine Learning”
- “People Do People Things”
- “In 2021 and Beyond, Disinformation is Inevitable”
- “The Rise of Insider Threat-As-A-Service”
9) Fortinet — New Cybersecurity Threat Predictions for 2021 and the well-written and unique FortiGuard Labs Cyber Threat Predictions for 2021 offer the following predictions under three main headings (with many more details in the report links):
The Intelligent Edge Is a Target
- Trojans Evolve to Target the Edge
- 5G Can Enable Advanced Swarm-Attacks
- Advancements in Social Engineering Attacks
- New Ways to Leverage Ransomware in Critical Infrastructures
- Advances in Cryptomining
- Spreading Attacks from Space
- The Quantum Computing Threat
- AI Technology Needs to Keep Up
- Organizations Can’t Do It Alone
- Enabling Blue Teams
Their new 38-page report is entitled Crowdstrike Services Cyber Front Line Report: Incident Response and Proactive Services from 2020 and Insights that Matter for 2021. It offers an excellent forward by company President Shawn Henry (who is a former FBI lead on cyber.)
Some findings and trends:
- The volume and velocity of financially motivated attacks is staggering
- Intrusions are no longer a one-time event
- Shifting to a continuous monitoring and response approach changes the game
- Widespread remote work has broad-reaching effects on cybersecurity
- Cloud infrastructure requires special attention from defenders
- Outside counsel is playing a bigger role in the incident response process
- Theme 1 – Security in Sweatpants: How Widespread Remote Work Changes Security
- Theme 2 – Ransomware Actors Evolve Their Operations
- Theme 3 – Adversaries Have Their Heads in the Cloud
- Theme 4 – Watch For Weaknesses in Public Facing Applications and Services
- Theme 5 – State-Sponsored Adversaries Leave Smaller Footprints
- Theme 6 – After the Breach: Making Improvements to Stop the Next Breach
- CIOs lead the bold disruptors — 30 percent of firms will increase spend on cloud, security and risk, networks, and mobility.
- COVID-19 changes leadership and hiring practices forever — Remote work will rise to 300 percent of pre-COVID levels.
- With more employee data comes opportunity, but also legal risk — Regulatory and legal activity related to employee privacy infringements will double.
- Remote work drives uptick in insider threats — 33 percent of data breaches will be caused by insider incidents, up from 25 percent today.
- Workplace automation and AI are here to stay — 35 percent of companies will double down on workplace AI.
- Cloud takes center stage in pandemic recovery — The global public cloud infrastructure market will grow 35 percent to $120 billion in 2021.
- Edge is the new cloud — New edge vendors will shave five points off of public cloud growth.
- A CISO from a Global 500 firm will be fired for instilling a toxic security culture.
- Funding for non-U.S.-headquartered cybersecurity companies will increase by 20 percent.
- Audit findings and budget pressure will lead to an uptick of risk quantification tech.
- More privacy leaders will report to the CEO
- CCPA 2.0 will lead to the introduction of federal privacy legislation in the U.S.
- VC investment in non-U.S.-based cybersecurity firms will rise
- Retail and manufacturing will have more breaches due to direct-to-consumer shift
- Cybercrime is the new ATP
- Increased Extortion Attacks
- Ransomware Evolving – More Automated
- Pay Attention to 5G Interconnectivity
- Challenges With Multi-Factor Authentication
AT&T Cybersecurity also released an impressive report entitled 5G and the Journey to the Edge, which has some implied predictions for 2021 but is mostly a solutions guide to moving to 5G. It contained the following takeaways (with details in the report):
- Recognize that 5G is not an evolution but more of a revolutionary new technology; however, the transition will not occur overnight
- Implement 5G and edge in a manner unique to the organization
- Observe and be aware of what needs protection
- Establish baselines of normal behavior and activity for the network and users
- Reduce complexity and risk to enhance security
- We’ll see the consequences of employees letting their guards down as work-from-home extends
- Attackers will use the COVID-19 vaccine to conduct the largest phishing effort of the year
- We will see a rise in Internet policing as misinformation reaches new heights following the U.S. elections
- The board meeting of a major company conducted using video conferencing software will be exposed, resulting in a high-profile scandal
- Deepfakes will become a significant threat to business integrity
- There will be a reckoning within the growing API security market as API data breaches rise
- The new normal for the security architect(ure)
- Automation will help support a security-first approach to architecture
- Phishing and ransomware remain ubiquitous, and the home office will be under siege
- COVID-related threats will continue even when the pandemic has subdued
- Cloud misconfigurations remain a major problem
- Compliance requirements fuel cloud decision-making
- MITRE ATT&CK framework gains steam in the business world
- Ransomware will adapt to hit cloud repositories (not just OneDrive and SharePoint, but S3 and Azure, too)
- Malware will continue to rely on user interaction (not technical vulnerabilities) and living off the land
- BEC’s growth will slow, but it will still be the largest source of cybercrime losses
- More techniques will emerge to bypass MFA, which will abuse cloud permissions and trust mechanisms (i.e. OAuth, SAML, etc.)
- Automation will become part of more and more security tools, rather than being bolted on
- Security budgets will bounce back when COVID-19 comes under control in more places, but staffing will continue to be a challenge (even with more remote/flexible work options)
- We will see increased collaboration and interaction between cybercriminal groups, playing to their strengths
- Ransomware continues its march; policy complexities follow
- Synthetic media goes mainstream, and threat actors capitalize
- Hacking-for-hire becomes a boom industry and intrigue abounds into the “hirers”
- The implications of remote working become clearer
- Organizations go back to basics to shore up defenses
Symantec prediction reports are nothing like they were back in 2017 when they set the prediction standard, but they do offer a glorified blog on key topics this year. Here are their top three:
- Ransomware gangs will continue to develop new tactics to pressurize victims — “If 2019 was the year that targeted ransomware attacks began to proliferate, 2020 was the year that targeted ransomware groups began to develop their tactics and find new ways to pressurize their victims into paying.”
- Attackers will begin to find ways to further exploit working from home — “The COVID-19 pandemic has brought about a radical change in how many people work. Offices across the world have shut and, wherever it has been possible, employees have shifted to working from home.”
- Close co-operation of cybercrime gangs — “The cyber crime eco-system tends to be quite segmented and actors usually specialize in one malicious activity, rather than handle attacks from end-to-end. It’s a world where malware authors, malware distributors, exploit kit creators, money launderers, and many more actors frequently interact. ... However, what is new and potentially worrying news is that some of the biggest actors in cybercrime are coming closer and closer together. In particular, some of the biggest botnet operators and ransomware authors. …”
- Remote workers will be the focus of cybercriminals throughout 2021
- Legacy security architecture like VPNs will be the weak link for many organizations
- To cope with reduced budgets, CSOs and CISOs will seek convergence across security solutions
- The impact of breaches in the health-care sector may be deadly
- Financial organizations beware, more attacks are coming
- COVID-19 forced organizations to accelerate digital transformation efforts
- The adoption of new technologies and increase in Internet users means most of the world’s population is at great risk of data exposure
Here are their six cybersecurity items:
- CISOs will embrace DevSecOps methodologies. — Liz Rice, vice president, open-source engineering, Aqua Security
- Application security will no longer be an afterthought. — Jonathan Knudsen, senior security strategist, Synopsys
- More developers will move to application security's front lines. — Derek Weeks, vice president and DevOps advocate at Sonatype, and co-founder of the All Day DevOps conference
- DevOps teams will see the value of threat modeling through security partnerships. —Chris Romeo, CEO, principal consultant, and co-founder of Security Journey
- The acceleration of cloud adoption during the pandemic will shift the software security landscape dramatically. — Jason Schmitt, general manager of the Synopsys Software Integrity Group
- Cybersecurity will move out of the dark ages as intelligent cybersecurity emerges. — Lisa Azevedo, founder and CEO of Containn
Here are some of Thycotic’s security prediction highlights:
- Cloud security will become the first-choice security strategy
- Every user will become a privileged user
- Passwords will move into the background
- Ransomware will still be the biggest threat and financial risk
- Data privacy will, and already is, becoming a Digital Rights Management issue
Here are their top five security predictions:
- The new digital “normal” puts greater reliance on microservices
- Digital transformation projects implode into data security liabilities
- Serverless computing becomes a playground for cybercriminals
- The maturity of 5G and expansion of IoT fuels botnet armies
- The U.S. catches up with the world on data privacy
Bonus Items: Take a Close Look at These Four More Security Predictions Lists
- Bugcrowd offers an excellent infographic with their security prediction items from Casey Ellis:
- Bugcrowd leads with “Ethical Hackers will play a key role in securing and building confidence in future elections.”
Here are three of the ten:
- Ten percent of Fortune 1000 CISOs will be asked to take on networking teams because of SASE
- Zero-trust and SASE will converge
- AI/ML threats will arrive a lot faster than you think
- 2021 Will Reveal “The Great InfoSec Divide.” — Gaurav Banga, CEO, Balbix
- If it were measured as a country, then cybercrime — which is predicted to inflict damages totaling $6 trillion globally in 2021 — would be the world’s third-largest economy after the U.S. and China. — Steve Morgan, founder, Cybersecurity Ventures, and editor-in-chief at Cybercrime Magazine
- Security leaders will need to consolidate vendors. — Joe Pettit, director, Bora
- More Companies to Adopt Security Champions Programs
- Everyone Will Be Election Security “Experts”
- The Fall of the Managed SOC
- Synopsys — 2021 software security predictions:
- We’ll see a massive shift to cloud-native solutions in 2021
- AI will become a must-have
- The impact of breaches in the health-care sector may be deadly
- Unemployment fraud: With unemployment fraud at an all-time high, we will see an even larger increase in 2021, as pandemic-focused unemployment programs from governments have lowered the barriers to collecting benefits and security methods have not been able to keep up. Should we see additional stimulus funding from governments to provide relief for the effects of the pandemic, this will only make this a richer channel for fraudsters.
- COVID-19 will put job seekers at risk
- Individual security products will morph into comprehensive solutions
- AI Will Become More Embedded in Authentication Frameworks. By Torsten George, Cybersecurity Evangelist at Centrify
- Fifty-five percent of enterprise executives plan to increase their cybersecurity budgets in 2021 and 51 percent are adding full-time cyber staff in 2021. PwC found that most executives are planning to ramp up their cybersecurity spending in 2021 despite the majority of them, 64 percent, expecting business revenues to decline
- Organizations will evaluate multi-vendor and multi-cloud options to hedge against outages at their primary cloud providers
- Mondaq.com: (Australia predictions) — Our Top 10 Digital Law Predictions For 2021
- Directors' responsibility and liability for cybersecurity and increasing privacy fines
- SME10x — A Global Reset: Predicting Cybersecurity Trends in 2021
- Security Validation to Keep Defenses and Budgets in Check
- State, national data privacy laws take center stage
- Security will report to development, not the other way around.
- Security will be a priority on the road to digital transformation
- As the world races to share the COVID-19 vaccine, cybercriminals may attempt to target the rollout ecosystem.
-
Addressing bias in AI algorithms will be a top priority causing guidelines to be rolled out for machine learning support of ethnicity for facial recognition.
- MITRE ATT&CK will continue to increase in prominence as the backbone framework for cybersecurity planning and threat-informed defense
-
Securing the Supply Chain Will Finally Become a High Priority (After SolarWinds)
- Poisoning of Machine Learning Training Data - As machine learning becomes more widespread within enterprises for making automated decisions, attackers have a new vector to consider. After a threat actor steals a copy of the original training data, they will begin to manipulate the models generated by injecting poisoned data into the training pool, creating a system that has learned something it shouldn’t. This manipulation will have a multiplying effect due to the automatic processing by downstream applications, destroying the integrity of any legitimately processed data.
-
Governments Will Recognize the Need to Look Deeper Into Their Third-party Vendors
- Machine learning to mitigate insider risk
Note to vendors not on the 2021 prediction list: We do our best to include and reference all verified cybersecurity prediction reports submitted with a URL link to your wider forecast list online. If you are not mentioned and want to be included up until early January 2021, feel free to send your predictions to our blog contact email address, and please include your online reference link. However, the top 21 reports selected will not change.
Prediction Awards
- Most Comprehensive Vendor Report Overall – Trend Micro, Turning the Tide: Trend Micro Security Predictions for 2021
- Most creative: Trend Micro: “Threat actors will turn home offices into their new criminal hubs”
- Least Reported But Most Likely Prediction – DigiCert - Unemployment fraud: With unemployment fraud at an all-time high, we will see an even larger increase in 2021, as pandemic-focused unemployment programs from governments have lowered the barriers to collecting benefits and security methods have not been able to keep up. Should we see additional stimulus funding from governments to provide relief for the effects of the pandemic, this will only make this a richer channel for fraudsters.
- Technical (Geeky) Prediction To Watch – Yet Important Trend – Netskope: “Zero Trust and SASE will converge.”
- Scariest (tie) – Mondaq: Directors' responsibility and liability for cybersecurity and increasing privacy fines; and "If it were measured as a country, then cybercrime — which is predicted to inflict damages totaling $6 trillion USD globally in 2021 — would be the world’s third-largest economy after the U.S. and China." — Steve Morgan, founder, Cybersecurity Ventures, and editor-in-chief, Cybercrime Magazine
- Most Common (Tie): More movement to the cloud; and more trouble at home because of COVID-19 and work from home trends
What’s missing? Again, few, if any, “Cyber Pearl Harbor” or “Cyber 9/11” predictions. This follows a year when no one predicted the impact of a global health pandemic leading to a cyber pandemic. Also, last year we saw much more on AI and deepfakes, but there are far fewer deepfake and AI predictions for 2021.
Almost nothing on the impact of the new Biden Administration on cybersecurity nor what that means for global relations on technology. Nor are there Brexit cyber impacts or EU cybersecurity changes that may move the needle in major ways against cybercrime.
Also, the late-breaking news about the SolarWinds data breach and the global impacts means that most of these prediction lists did not factor in the wide-reaching impacts to the public and private sectors of such a huge event. Some are calling it comparable to, or even worse than, the OPM data breach in 2015.
Back in 2016, I made this prediction:
"Bottom line, the more the security and technology industries grow, the more predictions we will have. From the Internet of Things, to new technologies to robots to self-driving cars, do you really think we will be talking about security and privacy less in 2020? I don’t.
"Predictions are not new, and they are not going away. In fact, they are just getting started.
Congratulations security industry, and welcome to center ring in this three-ring circus. Yes, it is a very big circus, but that’s where all the action is."
It turned out that I was spot on with that prediction about security industry prediction growth. Even in the midst of a pandemic, people continue to think about tomorrow — a lot.
Happy New Year to all, and thanks for following "Lohrmann on Cybersecurity & Infrastructure."
