How has 2021 revolutionised cybersecurity?

This year has seen some of the biggest changes to cybersecurity, which have been accelerated by the pandemic. As social distancing rules force us to work and socialise from our homes, technology has adapted to our needs rapidly, pushing us into a more digitally connected world. This has led to some exciting advancements, such as the adoption of sophisticated Artificial Intelligence (AI), enabling greater efficiency for businesses and consumers. 

On the other hand, these changes seem to have acted as new opportunities for malicious actors to take advantage of this growth in digitalization, as well as utilise the more sophisticated technology that we are more commonly seeing today.

Pandemic - remote working

The most apparent change to working life is the digitalization of the majority of work tasks, for which office conversations have converted into instant messaging or emails; meetings to zoom calls. This means that the increasing use of third-party apps is opening up more risk, and the scale of data that is stored online through these apps has substantially increased. As a result, the attack surface has become larger for the criminal to potentially exploit.

Although this is the most obvious reason for the increased risk, it isn’t the only one, and it may go as far as the psychological differences of employees who are working from home as opposed to in an office. Group Head of Cyber Governance at FWD Insurance in Singapore, Pritish Purohit, states that “in a traditional office setting, there’s a natural defence against phishing when workers can easily query adjoining co-workers.” Whereas at home, workers are away from the immediate advice of others and more likely to make their own (potentially weaker) judgement on an email that may seem a little out of the ordinary.

As a result, it is important that employees are security awareness trained to identify a scam when they see one. Security training company KnowBe4 claimed that 38% of untrained end users are susceptible to realistic phishing scams. The good news is that this average dropped 60% after 90 days of phishing training with real-world simulation exercises, the vendor claims.

IoT

The Internet of Things includes physical devices such as smart watches, smart refrigerators and voice assistants such as Amazon Echo. According to Business Insider Intelligence, it is estimated that there will be more than 64 billion IoT devices installed around the world by 2026.

The most frequent concerns surrounding IoT devices are privacy concerns, due to the nature of the device and how much data they can access. An example of a major IoT privacy issue is Cayla the doll (2014-2017), for which Germany’s Federal Network Agency classified the product as an “illegal espionage apparatus”, with Bluetooth access to the doll requiring no password protection.

This leaves the item open to attackers who could potentially eavesdrop by connecting to the doll’s bluetooth. This technique, also known as a sniffing attack, is where the criminal passively listens to or accesses data that is being transferred across a network.

Although there are some frightening examples of data breaches in the past, the sudden growth of IoT in 2021 has meant that manufacturers are including security by design. For example, business giants such as Apple and Google have made security features the marketing focus of their IoT devices for the past year, ensuring that consumers have trust in the devices that may become a close part of their day-to-day lives.

Additionally, this year the UK Government released an official statement on the 21st April, explaining that they are working to ensure that consumer “smart” devices are more secure. The statement continues that “the government advocates for strong security to be built into internet-connected products from the start."

Artificial Intelligence (AI)

According to a 2021 McKinsey survey, AI adoption is continuing to rise, with 56% of all respondents reporting AI adoption for at least one business function. This rise has also been reflected amongst more emerging economies (including China, The Middle East and North Africa), with 57% of these respondents reporting adoption, an increase of 12% since 2020.

As well as becoming more common, AI technology has also become more sophisticated. The types of AI include Software AI, such as virtual assistants, search engines and face recognition systems, as well as “embodied” AI, such as the Internet of Things, autonomous cars and robots.

For cybersecurity, AI is a double-edged sword; whilst it is great for automating both business processes and security, at the same time threat actors are both attacking AI systems and creating their own. Threat actors can weaponize Software AI to automate attacks and with the increased sophistication of AI technologies, this means that they are capable of more sophisticated attack methods.

Moving forward, businesses must find ways to monitor their own AI systems to prevent exploitation, whilst also protecting against the malicious bots that cyber criminals are utilising.

Ransomware

Ransomware attacks have increased alarmingly, with the head of the UK spy agency GCHQ disclosing that the number of ransomware attacks on British Institutions has doubled over the past year. In his statement he continues:

“I think that the reason [ransomware] is proliferating – we’ve seen twice as many attacks this year as last year in the UK – is because it works. It just pays. Criminals are making very good money from it and are often feeling that that’s largely uncontested.”

Although the exact number of attacks or total financial loss in the UK to ransomware attacks is undisclosed by GCHQ, a US Treasury Report found that ransomware attacks for the first half of this year in the US was worth around $590m, highlighting the scale of financial damage of these global attacks.

In addition to this, according to the Guardian, The NCSC says that they have tackled a record number of cyber incidents over the past year, with ransomware attacks originating from Russia dominating its activities.

To prevent a ransomware attack from occurring, malware prevention strategies should be in place and members who have access to the network and systems should be security trained, so that they can identify a malicious email when they see one.

Conclusion

2021 has been a year of sped up technological advancements to meet the increasing digitalization of tasks. As the year draws to a close, we begin to wonder what these changes will bring in 2022, and what the threat landscape will look like in comparison.

Join Vambrace's educational sessions, led by Head of Security Services Nathan Critchley, as we present our partner community's predictions for the future.