Cyber Security Trends 2021 After The Perfect Storm Of 2020
2020 has been described by some as the ‘Cybercrime Peak’. While it is undeniable that cyber crime increased dramatically in 2020, based on current form, the cyber security trends for 2021 look to be heading the same way.
2020 saw some old cyber security trends increase in popularity (did anyone say ransomware?), and some new cyber security trends appeared due to the Covid-19 pandemic that closed offices around the world and released their workers to remote working from home. The SolarWinds attack as we know it, discovered in December, brought new methods and scopes to cyber attacks.
So, with all that the cyber security community went through in 2020, what cyber security trends does 2021 have in store? We’ve pulled together a few ideas.
Expect new methods of attack, sophistication, and severity. 2020 saw a combination of opportunistic and planned attacks, and that mix looks set to continue.
The Dark Halo attacks (a.k.a SolarWinds) revealed in December 2020 were extensively planned and carried out over the course of most of the year. As the mop up operation continues, these attacks are proving to be ever more extensive, with US Government agencies, cybersecurity companies, and small companies alike all impacted by one or more components of the attack. It threw up questions about vulnerability management and supply chain security, and left organisations worldwide scrambling to check their cyber defences.
The question is whether the success of these attacks will spur other attackers into imitating them in 2020. Someone is sure to try.
Covid-19 pushed more people to work from home than ever before, without time for organisations to prepare for remote working. Cyber attackers were quick to take advantage of the chaos and made use of the opportunities for data breaches and cyber attacks.
As 2021 continues, people are still working from home outside the secure environments created by network security teams. More attacks will occur on unsecure home computers and networks, taking advantage of unpatched systems, poor passwords, and weak architectures.
The return to offices may well make the situation worse. At that point, employees will plug the devices that have been exposed to insecure websites or software back into the office network, potentially risking the entire network.
2020 saw a 130% increase in ransomware attacks. Ransomware attackers became more confident, and the sums demanded increased. Health services were especially targeted as Covid-19 stretched hospitals to the limit as the numbers of critically ill patients reached capacity. Cybercriminals took advantage of the general chaos, launching one ransomware attack after another at hospitals who paid up because they couldn’t afford the downtime.
Attackers also targeted vaccine developers, stealing data and publishing it online, undermining their work and increasing uncertainty around the vaccine.
Having found such lucrative forms of attack, it is unlikely that cyber attackers will stop attacking hospitals and other health care settings as long as they continue to pay. In addition, ransomware attackers often piggyback on other malware attackers increasing the scope of their attacks to include stealing data, before they launch their final attack.
The Covid-19 pandemic has led to a tough economic landscape. Many businesses are suffering financially, and are faced with budget cuts. These budget cuts could include cuts to cyber security budgets. IT security teams will be challenged to ensure that what budget they do have is spent effectively, and find ways to deal with new risks using limited resources.
Less well known than cyber attacks are cyber attack failures. A rare example of a publicised success was when Manchester United announced in November 2020 that they were the victims of a cyber attack. However, their defences, plans, and responses were so well thought out that what could have been a major data breach became almost nothing at all, and the only reason it was newsworthy was because it was Manchester United.
As organisations it is important you do all you can to reduce the cyber risks.
Reduce the risk of human error
90% of all attacks still originate from human error, usually from email attacks. Effective, regular employee training that reminds employees of their cyber security responsibilities, and provides them with the skills to recognise social engineering attacks will improve the overall security posture of your organisation. This is even more important now as employees continue to work remotely, reducing their access to security teams.
As remote working continues, improve account security by supporting employees to create and use secure passwords, or even better, apply multi factor authentication to key accounts.
Improve network security
Use security budgets wisely to get the best value for money. Ensure that perimeter security defences are up to date with the latest security patches installed, and are set to alert for any unusual activity.
Establish strong cyber security risk management plans that set out what to do in the event of a breach, including isolating affected systems as soon as the breach is discovered and preventing attackers from accessing further systems.
And most of all, be prepared. 2020 showed that any organisation can be attacked, the important thing is to be ready for the attack, and have the plans in place to limit its impact.
Stay safe