Hindsight is Key to Success in 2020: Thoughts Heading to RSA

As the worldwide cyber security industry descends on San Francisco this weekend for RSA, I thought it wise to consider the major issues that attendees—from enterprise security professionals to vendors to journalists—ought to be thinking about throughout the week. With the benefit of hindsight of the events and experiences in 2019, I’m looking forward to broaching the following four subjects throughout the Moscone Center, as I’m confident that education around these subjects will be critical in 2020.

Third parties exposing data

Data breaches and their far-reaching impacts continue to be an unfortunate consequence of poor third-party data risk management. Enterprises sharing their data with third parties that maintain poor cybersecurity measures will continue to be exposed. And, while such breaches may be caused by third-party vendors or suppliers, it’s the larger enterprises with the recognizable brands that will bear the brunt of the fallout. This includes bad publicity, regulatory scrutiny, dipping stock prices, damaged consumer trust, and increased exposure to lawsuits. Companies dedicate most of their cybersecurity budget to their firewall, in order to defend their network, yet inadvertently share their most sensitive data outside of their network. Furthermore, companies rely on outdated solutions, such as DLP and open-source aggregators, to solve today’s advanced cyber risk challenges.

Increase in use of automation by bad actors

Cyber security companies aren’t the only ones using AI and machine learning. Bad actors are increasingly utilizing automated and smart tools to find vulnerabilities in systems, access to storage devices, and open data on the internet. The availability of Disney+ accounts for sale in late 2019 demonstrates that the bouncing of old credentials against new services to make money is a viable strategy, but only with automation is it a cost-effective attack. While many still discuss the power of AI in data mining and its surrounding ethical issues, bad actors and nation-states are developing and using these technologies to amass and profit from our information. As much as AI and machine learning have become buzzwords to poke fun at during cyber conferences, vendors and developers need to be challenged to create advanced technologies to protect information now and in the future.

Increased use of cloud storage and IoT devices

This year, companies’ mass migration to the cloud and consumers’ use of online storage “buckets” will continue to increase. IoT devices are expected to surpass 20 billion in 2020 as consumers demand more access across more platforms. However, this will undoubtedly lead to an increase in the risk of data exposure. This is due to these platforms’ built-in security – which is either insufficient against attacks, misconfigured by users, or lacking in the ability to be patched or updated. Unless companies take control of the cloud and data sharing platforms that they use, which is not always viable, or train employees on proper configuration, these platforms will continue to see an increase in targeted attacks.

Humans are still the weakest link in cyber security

Human interactions with machines are still the threat actor’s gateway to information. Ignorant users continue to assume that their technology will make decisions that will protect their data and information, where in actuality, users must make logical decisions on whether to click links, open emails, share data, or configure access. Education and training needs to be a part of organizations’ defensive posture, while at the same time internal technologies (access control, spam filters, encryption, data classification) must get better.