60 Cybersecurity Predictions For 2019

AI is a dual-use technology

“AI-driven chatbots will go rogue. In 2019, cyber criminals and black hat hackers will create malicious chatbots that try to socially engineer victims into clicking links, downloading files or sharing private information. A hijacked chatbot could misdirect victims to nefarious links rather than legitimate ones. Attackers could also leverage web application flaws in legitimate websites to insert a malicious chatbot into a site that doesn’t have one. In short, next year attackers will start to experiment with malicious chatbots to socially engineer victims. They will start with basic text-based bots, but in the future, they could use human speech bots to socially engineer victims over the phone or other voice connections”—Corey Nachreiner, CTO, WatchGuard Technologies

“While next-gen technology like Artificial Intelligence (AI) and Machine Learning (ML) are transforming many enterprises for the better, they’ve also given rise to a new breed of ‘smart’ attacks. The ability to scale and carry out attacks is extremely enticing to cybercriminals, including use of intelligent malware. The rise in next-gen threats means that security professionals must be extra vigilant with detection and training against these threats, while also adopting new methods of automated prevention methods”—John Samuel, Senior Vice President and Global Chief Information Officer, CGS

“Cyber defenders have been researching and working on their machine learning/AI/deep Learning for a long time. We expect over the next 5 years that these technologies will also empower adversaries to create more powerful and elusive attacks through a new generation of tools, tactics and procedures. While AI/ML-savvy offensive cybercriminals are in their infancy, this is like any other business. They will invest in whatever provides them the greatest return. Unlike defenders, those on the offense are willing to collaborate and share innovation freely, which could increase rapid development and innovation”—David Capuano, CMO and VP Sales, BluVector

“Automation is the name of the game in security and machine learning is here to help. AI is all about automating expert systems, and security is all about experts answering some form of the question: ‘Does this matter? Does this alert matter? Is this vulnerability risky?’ Machine learning will help filter out the noise, so that the limited number of practitioners out there can use their time most efficiently”—Michael Roytman, chief data scientist, Kenna Security

“Recent updates to exploit kits, specifically natural language and artificial intelligence capabilities, has made the automation of highly convincing and unique social engineering emails a very simple process. Meaning, an attacker can upload a file with one million email addresses and can automate the creation of effective and unique phishing messages to send out to victims”—Brian Hussey, VP of Cyber Threat Detection and Response, Trustwave SpiderLabs

“When it comes to using AI in cybersecurity, be wary. AI offers companies huge potential, but it is a largely untapped area. If you do plan to implement it, do a proof of concept to make sure that it integrates into your company’s environment, ensuring that you’re getting the maximum value”—Joan Pepin, CISO and VP of Operations, Auth0

“The focus on artificial intelligence in cybersecurity has led to an arms war, with vendors ratcheting up claims about the number of models or features to sensational levels. In 2019, the focus will shift from quantity to quality of features. Both vendors and their users will recognize that fewer, more precise features, can improve threat detection rates, while ensuring virtually zero false positives”—Adrien Gendre, North American CEO, Vade Secure

“As AI-enabled apps continue to proliferate, companies will face a rise in accidental vulnerabilities. Expect to hear about more breaches that aren’t a result of a hack, but can be mapped back to developers leaving large data pools (which power AI-enabled applications) accidentally unprotected. Companies need to be vigilant when working with large data pools, especially customer data, that feed AI in services like Amazon, Facebook and Google, and always double check their configurations”—Alex Smith, Director of Security Products, Intermedia

“With fraud attack rates expected to continue to increase in 2019, costing e-commerce retailers billions of dollars, AI is poised to play a huge role in stopping bad actors in real-time before they strike. Artificial intelligence and machine learning, enhanced by human research, have the ability to protect online merchants from abuse at both the account level and the point of transaction.  AI-driven solutions are becoming a necessity because they instantly prevent fraud, enabling retailers to scale and keep up with the e-commerce giants without sacrificing the consumer experience. Finally, fraud prevention models that use AI can be personalized based on a nuanced understanding of each merchant’s specific pain points and historical data”—Michael Reitblat, Co-Founder and CEO, Forter

The emerging global cyber war

“Terrorist-related groups will attack population centers with crimeware-as-a-service. While terrorist-related groups have been tormenting organizations and individuals for years, we anticipate more potentially destructive attacks in 2019. Instead of breaking systems with ransomware, adversaries will leverage new tools to conduct harmful assaults on targeted subjects and organizations. From attacks on data integrity that essentially kill computers to the point of mandatory hardware replacements, to leveraging new technology for physical assaults such as the recent drone attack in Venezuela, attack surfaces are growing and enemies will take advantage. To combat this, organizations must take inventory of their attack landscape to identify and mitigate potential threats before they are exploited. Malcolm Harkins, Chief Security and Trust Officer, Cylance

“We expect nation-state threats to increase significantly in 2019, particularly targeting critical infrastructure. Critical infrastructure systems are extremely vulnerable to both cybersecurity and physical security risks. State-sponsored threats and high-level hackers are constantly looking to gain access to the critical infrastructure of nations worldwide, with the intent of hitting some of our most valuable systems (national security, public health, emergency communications, and more)”—Mike McKee, CEO, ObserveIT

“The nature of cyberwarfare is changing. Russia has led the way in the use of targeted cyber actions as part of larger objectives, and now other nation states are looking to follow the same playbook. While a direct cyberwar is not on the horizon, there will continue to be smaller proxy cyber wars as part of regional conflicts where larger nation state actors provide material support to these smaller conflicts. These regional conflicts will be testing grounds for new tactics, techniques and procedures as larger nation states determine how cyber warfare integrates into their larger military objectives. Nation states will also start experimenting more this year in adding ‘disinformation’ campaigns as part of their cyber warfare efforts. These kinds of attacks will make true attribution more difficult”—Sean McNee, Senior Data Scientist, DomainTools

“As the cyber threat landscape intensifies, adversaries will continue to discover new avenues for attacks. Although satellites aren’t the most common attack surface, it is important for industry professionals to acknowledge the capabilities that threat actors hold over them. Security concerns continue to grow within the satellite industry, with execs even forming a government-backed clearinghouse to share information on cyber threats to space assets. From military satellites to GPS technology and even communication satellites, adversaries are able to conduct targeted attacks to gain access to these crucial systems—some of which are highly classified networks. As these threat actors refine their skills, we anticipate major attacks on satellite systems as a new form of nation-state warfare”—John Cassidy, CEO and Co-Founder, King & Union

The year of protected privacy, finally?

“Managing privacy will be the new normal, like securing data or paying taxes. Privacy will continue on a similar path as the evolution of cybersecurity. The number of breaches and privacy-related incidents will continue to rise, up and to the right. This rise will be comprised of peaks and valleys. Like with security, a standard of constant privacy will become the new normal. For example, while many organizations treated GDPR as a project, with a finite end, compliance is a continuous exercise that requires the same focus and vigilance as security or taxes”—Chris Babel, CEO, TrustArc

“Consumers will start to reclaim control and monetize their data. Ownership of customer data will transition away from businesses and back toward customers themselves, and new services will emerge that empower customers to even monetize their own personal data and rent it back to companies. Data is the fuel that powers AI, and customers will realize they have the power to drive their own AI-based experiences by reclaiming data control”—Dr. Rob Walker, vice president, decision management and analytics, Pegasystems

“GDPR was a great first step, but global regulation and governance still remain a complex web. The United States will continue to fall further and further behind in competency and international relations as our federal compliance efforts simply aren’t moving fast enough to meet worldwide requirements. Countries where privacy is prioritized and seamlessly integrated will see the most optimal growth”—Tomas Honzak, Chief Information Security Officer, GoodData

“Data protection legislation will continue to influence societal expectations on security, which will trickle down to companies and their supply chains.  Consumers have always felt protective of their data, but with new legislation redefining the data landscape, consumers have grown more confident in demanding their data be treated with respect, that its uses are kept visible and clear, and that it is used only as they agreed. The pressure these new societal expectations will exert cannot be overstated, both on public-facing companies and through them all the way down their supply chains. Make no mistake, security and data handling are seen now by all successful companies to be as critical to business and contracts as confidentiality and liability limits have always been”—Geoff Forsyth, CTO, PCI Pal

“There will be a lot more focus on privacy and security of connected cars. The information from the connected car is arguably more sensitive than our credit card information – where do we go, when do we go there, when are we home, where do we shop and work, where do our kids go to school and what locations do we go to at what time. There will be breaches of this personal information and bad things that happen as a result. There will be more of the takeover scenarios where an external (bad) actor can take over the technology. This too will result in backlash and involvement of political and legal entities to begin to make laws and precedents. What can law enforcement access and discover to use for investigation purposes?”—Todd Walter, chief technologist, Teradata

“As privacy concerns grow, there will be an increasing interest in privacy-preserving machine-learning techniques that are able train accurate models without compromising privacy”—Prasad Chalasani, Chief Scientist, MediaMath

“The global regulatory environment will become more challenging as regulators and governments worldwide continue to strive to implement better data privacy protection as was done with GDPR. While this is a great progress, we’re going to see these governments counter to gain more access to information”—Phil Dunkelberger, CEO, Nok Nok Labs

“As governments implement new data privacy regulations, enterprises will increasingly adopt a ‘Privacy First’ approach to data management. However, the challenges these enterprises will face as they seek to integrate data privacy best practices into their existing applications, as well as new mobile, IoT and other applications, will be significant. Enterprises will need AI-powered, automated, outcome-driven data management solutions to address these challenges if they hope to implement strong data privacy policies without sacrificing productivity or agility”—Don Foster, senior director of worldwide solutions marketing, Commvault

“In 2019, the US government will NOT adopt any new digital privacy policies despite the recent congressional hearings with Twitter, Facebook, Google, etc.”—Kevin Lee, Trust and Safety Architect, Sift Science

The Cloud changes everything and everything is connected… and vulnerable

“Your smart fridge will start scamming you. IoT-connected appliances such as refrigerators and washing machines already produce unattended payments that the user cannot personally verify. Fraudsters see this vulnerability now and will begin to take advantage of it”—Uri Rivner, Chief Cyber Officer, BioCatch

“In 2019, the two main targets for cyber-attackers will be the cloud and user devices. Operating systems on user devices provide more functionality than ever before, making them more vulnerable and an easy target for attackers. At the same time, users will expect more flexibility and the ability to work with any OS, any application, and on any device. As organizations look provide security, privacy, and productivity, they will have to shift to a new, ‘zero trust’ device architecture”—Tal Zamir, CEO, Hysolate

“IoT, in its current state, is not secure. There are secure devices out there, but they are the exception rather than the rule. Perhaps more concerning is that there are no revolutions in IoT security on the horizon. IoT will continue to be vulnerable in 2019”—Erez Yalon, Head of Security Research, Checkmarx

“A marked shift from network security towards identity-based application security will take place next year. The cloud causes traditional control planes to become obsolete. From firewalls and IPS’s to host-based security tools, current technologies cannot be implemented in an effective and constructive manner. Application identities, in a similar process that user identity underwent in the last couple of years, will conquer the main stage”—Ran Ilany, CEO, Portshift

“With Waymo, Cruise, Uber and other autonomous vehicle industry players rushing to the market and expanding previously limited pilots to wider scale public deployments, we predict that a self-driving car used ‘in production’ will be hacked. The immediate implications are unlikely to be life-threatening, however, they will only strengthen concerns about a potential nightmare scenario like car ransomware”—Nir Gaist, CTO and co-founder, Nyotron

“Teams will shift to prioritizing cloud-delivered security solutions over traditional appliance-based point products. In addition, teams will shift to simplifying security architectures by prioritizing solutions that provide consolidated feature sets that would have traditionally required numerous separate point products. This will be driven by a vastly expanded attack surface and necessary operational efficiency for understaffed teams”—Gene Stevens, CTO & Co-Founder, ProtectWise

“From Windows to IoTs, Apple and Microsoft have invested colossal amounts in information security to make it very difficult for attackers to enter. In addition, due the accelerated growth in the number of IoT vendors and a severe lack of regulation, significant investments are now being made in developing breakthrough attack capabilities in this field”—Eilon Lotem, CTO, SAM Seamless Network

“IoT-enabled device innovation will continue to outpace the security built into those devices and Federal government regulation will continue to inadequately define the laws and fines required to affect change. State-level regulations will be enacted to improve the situation, but will likely fall short in impact, and in many cases, only result in a false sense of consumer confidence with respect to the security of these devices”—Carolyn Crandall, Chief Deception Officer, Attivo Networks.

“Cyber breaches will have increased impacts on corporate stock prices, especially in the technology and cyber security sector. The rate at which we’re seeing attacks, and the breadth of the impact is alarming but as of yet haven’t had a large impact on stock prices. However, this will soon change as organizations complete their digital transformation and move to the cloud. Once this happens, a breach is going to have a larger impact on their revenue and as a result a detrimental effect on stock price. Another impact of companies moving operations and revenue to the cloud is we’re going to see more criminal and state organizations going after cybersecurity companies to infiltrate code in their distribution base or take them offline to get to the corporations themselves”—Stan Lowe, Global CISO, Zscaler

“Consumers and legislators alike are increasingly aware of the cyber risks facing the automotive industry as vehicles become increasingly connected.Due to the growing number of susceptible entry points in today’s connected cars, it is only a matter of time before the automotive industry experiences further significant cyber-related product recalls. Moving into 2019, it is imperative that OEM and Tier 1 suppliers ensure robust cyber security protections over the course of the vehicle lifespan. A multi-layered, end-to-end security solution that enables over the air system update capabilities will become the norm. Now is the time for automakers to be proactive and take the wheel in deploying effective solutions for automotive cyber security”—Yoni Heilbronn, CMO, Argus Cyber Security

“Cloud and DevOps transformations will rapidly gain pace in 2019, increasing the risk at the web application layer for enterprises. The reason for this increase is simple: the application layer used to be mostly static assets like marketing websites, but flash forward to today, it is now often the primary way an enterprise interacts with their customers (via full featured web applications or APIs that back mobile apps). This massive shift in functionality comes an equally massive shift in risk. The number one lesson for CISOs is that the transformation to cloud and DevOps will be successful if you can shift your security program from being a blocker to an enabler and focus on making your application and DevOps teams security self-sufficient”—Zane Lackey, Co-Founder and CSO, Signal Sciences

“Endpoint security will be redefined by detection and response features (EDR), plus managed detection and response (MDR) services. Endpoint prevention (EPP) has been king of the hill for years, now more than 80% of these solutions fall behind on requirements to provide a combined prevention, detection, investigation, response, system management, and security hygiene as a solution set via a single agent for Windows, macOS and Linux systems. Less than 20% of organizations have the resources and skills for mature EDR solutions which will drive the need for MDR services to the majority of companies, even more so for 24/7 coverage”—Tom Clare, Senior Product Manager, Fidelis Cybersecurity

“With IoT growth posing huge unknown risks to enterprises with the introduction of 5G, businesses will increasingly need to invest in both technology and employee training in order to prepare for the next generation threat landscape. What’s more is that 5G will not only give rise to new threats, but it will also provide cyber criminals with new opportunities to carry out attacks that we have seen grow in popularity over the years with greater force and impact. With this in mind, even an organization that ‘does everything right’ to combat threats posed by 5G could still be impacted just as easily as those that are less security savvy”—James Willett, Vice President of Technology, Neustar

“As IoT innovation continues to blossom, more and more IoT devices will continue to get involved in DDoS attacks in 2019. Routers and cameras are the major types of IoT devices involved in DDoS attacks, with routers making up 69.7% of IoT devices exploited to launch DDoS attacks, and 24.7% of cameras in 2017. This is because a great number of routers and web cameras have been introduced into production and living environments, with no sufficient security measures enforced. We have every reason to believe that attacks leveraging the IoT will become more diverse in the future”—Guy Rosefelt, Director of Product management for Threat Intelligence & Web Security, NSFOCUS

“With the number of IoT technologies in the workplace beginning to outnumber conventional IT assets, there is an ever-increasing probability that these devices will be used as entry point by malicious actors to further compromise corporations for data breaches. Expect in 2019 to see this come to reality and several breaches will be directly tied to installed IoT technology”—Deral Heiland, IoT Research Lead, Rapid7

“Industrial control systems are the wild-west of cybersecurity at the moment. These systems control factories, buildings, utilities, etc.  Most systems have little-to-no protection, and best practices are still being adopted very slowly. They also represent extremely high-value targets, especially from a strategic point of view.  A few new companies have entered the landscape, but it is still an extremely young industry”—Bryan Becker, application security researcher, WhiteHat Security

“At a time where nearly every device is connected to the internet, vendors should be taking security seri