2020’s cyber trends offer a snapshot of an evolving threat landscape
Staying ahead of cybersecurity trends is, frankly, an overwhelming task. The speed with which the cyber landscape evolves and diversifies is challenging for even the savviest of cybersecurity experts. Since cybercrime touches so many facets of society, it’s important to know which threats are popular and which may have gone out of style. Here’s what we’ve seen so far in 2020:
Finance and FinTech face hybrid threats
Financial institutions have always been, and will likely remain a major target for cybercriminals. It must first be acknowledged that 2019 was a particularly difficult year for the financial industry in terms of cybercrime. For example, new Trojan viruses were designed to attack mobile banking platforms and online payment processing systems. And what was even more concerning was the discovery of Genesis, an underground marketplace selling digital fingerprints illegally obtained from online banking users. Remember, a digital fingerprint is more than just a unique password; it’s a combination of username, password, IP address and about 100 other user-specific attributes. If stolen, this information would allow criminals direct access to bank accounts and other private data.
The cyber threats we’ve seen so far in 2020 expand upon those of 2019. According to Secure Features Magazine, 2020 is experiencing an “increase of groups specializing in the criminal-to-criminal sale of network access to banks in Africa, Asia and Eastern Europe,” partly due to the illegal sale of digital fingerprints on Genesis. “Primarily, the target will be small banks, as well as organizations recently acquired by bigger banks. These banks may become victims of targeted ransomware attacks, as financial organizations are more likely to pay a ransom than accept a loss of data,” the magazine reports. In other words, the financial and FinTech sectors are faced with hybrid cyberthreats combining new tech such as Genesis with old tactics, such as ransomware attacks.
Another one of 2020’s concerning cyber trends involves cybercriminals circumventing multi-factor authentication. They’re learning to outsmart it using a combination of social engineering practices, SIM swapping and exploitation of software vulnerabilities.
Healthcare sector: old target, new attack vectors
The healthcare sector has always been a target for cybercrime, but the motivation behind the attacks is different in 2020. It should be noted that 2019 was a good year for the healthcare industry in regards to cyber crime: Affected computers and devices dropped from 30% in 2017 to to 19% at the end of 2019.
Yet 2020 has ushered in new threats of its own. There’s been increased demand for medical records and private patient information on the dark web. Acquiring this private data can be quite lucrative for cybercriminals and is encouraging them to find innovative ways to hack hospital systems.
Another major threat to the healthcare industry in 2020 involves the Internet of Medical Things (IoMT). Over the past decade, personal medical devices such as glucose and heart monitors, defibrillators, pacemakers and insulin pumps have become connected to the IoMT to enhance the devices’ monitoring capabilities. This poses a huge risk, as researchers have discovered an increasing number of software vulnerabilities that could lead to attacks on these devices via the IoMT. Cybercriminals could hypothetically launch attacks on not only individuals, but entire product classes. In other words, there could be a single point of entry for cybercriminals to attack all patients using a certain device.
When it rains, it pours: Corporations, welcome to the Cloud.
As cloud-based services become popular for corporations, malicious actors are sure to exploit the trend. However, the nature of this new vulnerability is not so straightforward. According to SecureList, “The transition to the cloud has blurred the boundaries of company infrastructures.” Consequently, attackers will have a harder time launching attacks that are precise enough to acquire an organization’s sensitive resources. On the other hand, because the infrastructural boundaries are blurred, it can be difficult to identify when an attack has actually occurred in the Cloud. Cloud migration is not a smooth process for companies, and cybercriminals are working quickly to simplify and amplify attacks against organizations who store sensitive data in the Cloud.
Another security concern that corporations are facing in 2020 comes from insider threats. With the general public increasing their cybersecurity knowledge, traditional attack vectors have become costly and no longer yield such high rewards for cybercriminals. Thus, recruiting people from the inside of organizations is becoming a popular tactic. Insiders can be recruited via forums offering large sums of money in exchange for information, blackmail, and various other manipulation tactics.
5G and AI: New tech, meet new threats
2020 has seen new technology such as AI and 5G spill into the mainstream. While there’s no way to accurately predict how cybercriminals will exploit these newly developed technologies, some glaring vulnerabilities are worth exploring.
5G’s network speed could prove itself problematic because the faster the network speed, the faster viruses and malware can infect devices attached to that network. Similarly, 5G’s ability to connect an unprecedented number of devices to the Internet of Things (IoT) will provide cybercriminals with billions of brand new breach points to take advantage of. How they will choose to do so is yet to be seen.
Meanwhile, AI is predicted to “change everything about cybersecurity, for better or for worse.” By early 2020, cybersecurity experts will be using AI to spot cyberattacks with more efficiency than ever before. But as anyone in cybersecurity knows, it’s a cat and mouse game . . . and we’re normally the ones playing catch up. We find ourselves wondering: For how long will the good guys maintain the upper hand?