It’s time for our Parabellyx Cybersecurity predictions for 2021

It may be foolish to make predictions for 2021 after experiencing a year like 2020, but our team at Parabellyx has looked into the future to see what this new year will bring for cybersecurity trends and challenges.

Here are some of our predictions that we believe will influence cybersecurity throughout 2021.

1. Governments will enact privacy regulations that will negatively affect security.

As the pandemic forced a dramatic transition to push corporate activities online, the result was a reprioritization for data privacy and resulting compliance requirements. The reality, though, is that this compliance has been difficult to execute in a year that has kept security officials on their heels as they’ve tried to simply adapt strategies to fit the new remote workforce. Naturally, this has led to an increase in security threats.

As the result, privacy concerns will become a national security issue in 2021 and governments will begin to enact new regulations to protect their citizens. This will mean that cybersecurity professionals and budgets will be stretched even further than they already are, creating more staff turn-over and straining budgets that won’t be able to meet corporate security needs.

2. Internet Borders will be constructed faster than ever before.

We’ve seen countries such as Turkey, Ethiopia, China and Russia building Internet borders at a fast and disconcerting pace. This has the net effect of creating a digital Iron curtain surrounding these Countries, and we think this will be happening even more in the coming year. As social networks increasingly come under public scrutiny, they are causing governments to re-evaluate how those networks should be used by their own citizens, if used at all. This move away from a free for all Internet toward autocratic government control is concerning.

Further, as governments limit the use of the Internet within their physical borders, they increase state-sponsored cyber-attacks outside of those borders. Control of data and information, as well as control of misinformation and escalating cyberwarfare, are becoming frequent, standard tools used by autocratic governments to control people internally and manipulate people internationally. We should expect to see this Internet fragmentation grow and more politically motivated cyber-attacks to de-stabilize foreign governments and economies.

3. Data Flow and Privacy will be governed regionally, increasing the fragmentation of compliance regulations and impacting global trade.

Internet borders will affect our freedom of data flow between different countries, and the increase in government surveillance will further impact privacy regulations for both consumer and national security issues. Even as people are beginning to tune out of social media, governments are establishing ever tighter regulations and control for privacy data and information.

Additionally, many companies are being forced to open up their internal systems to foreign governments in ways that are not acceptable to most nations, causing a re-evaluation of global trading opportunities. This increased compliance and regulatory stance, as well as the rise of Internet borders, is forcing companies to adjust their own business strategies, choosing to avoid doing business with certain regions and adjusting their internal cybersecurity strategies to be compliant with those Countries where they are still conducting business.

4. Software Development Security will become the top priority for technology companies.

The Sunburst attack has demonstrated once again that both software development security and the technology supply chain security require significant improvements to withstand modern attack techniques. The industry lacks in technologies, skills, and techniques to do so in a way that would not slow down or outright disrupt technology development.

Over the next year, we will see some regulations coming to address supply chain security, which will lead to the development of new tools and standard frameworks. While in the long run, the supply chain and software development security activities will converge with QA, for a moment, it will become one of the hottest areas of cybersecurity to be in.

5. Truth is harder to find, and our inability to spot what’s fake will lead to more cybersecurity breaches.

If everything is fake news, how do you know who or what to trust? The reality of the past ten years is that social media destroyed the traditional media industry. As traditional news outlets suffered, digital media began to replace old media with articles and ideas that didn’t need to be validated. But, as people from every side of the spectrum started using digital media as a tool to influence others, our ability to understand what is real and truthful began to diminish. That opened a lot of doors for people to exploit the situation. The result is more efficient phishing attempts and other social engineering attacks, with fewer people able to distinguish what is real and what is fake. These attacks will not only continue, but they will reach new heights next year.

6. Further Adoption of TLS 1.3 will contribute to the demise of the network inspection approach.

The focus on privacy and detection of man-in-the-middle inspection as part of TLS standard development has led to unexpected security implications. Many services have implemented mutual authentication as a part of a push for consumer privacy. These services cannot be fully incepted without some very invasive measures on user devices. As a result, many organizations opted to exclude these services from network inspection.

However, it did not take long for malicious actors to start using the same services for malicious communications, including malware distribution, command and control traffic and data exfiltration activities.

While the network inspection approach is still wildly utilized, we see the efficacy of these technologies in a continuous decline and a rise in the adoption of endpoint technologies making many common network inspections obsolete in 2021 and beyond.

7. Malware will get worse

The goal of obfuscation is to anonymize cyber attackers, reduce the risk of exposure, and hide malware by changing the overall signature and fingerprint of malicious code — despite the payload being a known threat. As new technologies emerge to prevent cyber-attacks, cyber attackers are reverse engineering those software applications to their advantage. This means we can expect a continued increase in malware attacks, and it will be even harder to determine who is engaging in those attacks in order to stop them.

New cryptographic-based obfuscation techniques becoming available to software developers will, without a doubt, be used by malicious actors to further complicate the detection of malware and attack tools.

When you add the increased attacks from foreign governments, who are generally protecting the identification of many of these cyber-attackers, you take a terrible situation and make it even worse for citizens and governments worldwide.

8. Automation and IoT will lead to major breaches

Forget about IoT enabling your toasters, refrigerators or dishwashers, the real threats are much bigger, and they involve our vehicles and basic city infrastructures. As we begin to see autonomous vehicles on our roads, we are also seeing how our infrastructure changes to adapt to these 21st-century models of transportation. That means systems to manage traffic, adapt speed zones and the creation of a smart grid.

This is fantastic, and it will improve our lives significantly, but street sensors, autonomous vehicles, and smart grids communicate over the network, which creates new security concerns. Unfortunately, there is no standard for security for these technologies, which can ultimately endanger lives and affect our economy. We’ve seen instances where people hacked into autonomous vehicles already, and this isn’t a low-level phishing scheme, it can become an issue of potential life and death.

In 2021 we should see a growing focus on vulnerability research, as well as attacks to focus on unexpected devices: our cars, building control and automation systems, parts of municipal infrastructure. These will too require frequent patching, where over the air (OTA) updates cannot be relied upon.

9. Our Health system and public infrastructures will be attacked

It’s hard to imagine anyone attacking our health care networks during a pandemic, but these people do exist. Hospitals are being increasingly run with networks that facilitate patient data and have equipment and systems running online. Prescriptions are tracked, treatments are monitored, and physical environments are monitored to ensure our safety. Now, it’s only a matter of time until cybercriminals will highjack the hospitals by encrypting the data and holding it hostage until they are paid.

But it won’t be just our health care at risk. Think about what can happen with a power generation company and our power grid. Entire regions can be held captive by individuals or governments who want to disassemble our infrastructures and cause chaos. Ransomware attacks will increase, and a large scale political cyber-attack is very likely in 2021.

10. Cyberstrategy will finally become a separate discipline

The approach, where the cybersecurity strategy is simply defined by linking the risks to the technologies that are supposed to reduce these, has proved ineffective over the span of twenty years or more. Yet, burdened with tactical and operational tasks, the leaders revert to it time and time again.

The increase in frequency, complexity, and scale of cyberattacks will force many organizations to rethink the approach to cyberstrategy and prioritize alignment with business objectives over a reduction of arbitrary rated risks. The approach to cyberstrategy execution will also shift towards a lean enterprise methodology with incremental continuous improvement.

The truth is that no one really knows what will happen next year, but we do believe that cybersecurity issues will increase. We are also convinced that cybersecurity professionals will rise to the challenge.

Have a very Happy New Year.

About Parabellyx

Parabellyx are security-matter-experts who take a focused and business aligned cybersecurity approach to developing strategies that accomplish your key business goals and objectives. We then train your entire organization in security, preparing you for any threat, until a security mindset is entrenched across your entire company, protecting and ‘future-proofing’ your information, your employees, your customers, your shareholders and your reputation. Contact us