Cyber threats organisations will deal with in 2014
The threat landscape is constantly evolving, and it’s an enterprise’s job and duty to keep up with the changes and do the best it can to protect its data, employees and networks.
According to the recently published report by Georgia Tech Information Security Center on emerging cyber threats, in 2014 organisations can expect to deal with the issue of security vs. usability when it comes to the data they store in the cloud, insecure connected devices, the increasing attacks targeting mobile platforms and users, and the problems regarding the manipulation of information.
The problems with data stored in the cloud are multiple. For one, if the data is stored unencrypted, the organisations rely on the cloud storage firm to provide security – and that’s often not nearly enough. On the other hand, if they do privately encrypt the data, much of the cloud’s utility is nullified.
Also, there is the problem of employees trying to work more efficiently by using – often against official company policy – file sharing and cloud services with questionable security.
Finally, what if the employees’ computers get compromised with data-stealing malware? “Pairing the reliability of cloud storage with strong encryption can create a system that is both secure and reliable even when using the public Internet,” the researchers point out, adding that their colleagues at Georgia Tech have created “a system that can use the cloud for online storage, and by pairing it to a secure and separate virtual machine instance, can create a highly secure way of accessing data.”
This “CloudCapsule” project enables users to switch into secure mode to access encrypted files stored in the cloud, and to do this by using the same workstation they do the rest of their work on. According to them, the system can be used with any cloud storage, but one still cannot expect data to be accessible as it would be were it not encrypted. The researchers are currently working on making encryption searchable, but also secure (as much as it can be in those circumstances).
When it comes to the “Internet of Things” – the constantly expanding network of devices wirelessly connected to out home or business networks, and via that to the Internet – the main problem is that they are vulnerable to attacks. Security wasn’t the main concern when they (are) first developed, and later “bolted on” security upgrades are often not implemented because of the risk of “breaking” critical systems. Also, many of these devices are not complex enough to run security software, leaving it to network-level monitoring to detect compromises.
Lastly, there is the issue of devices getting infected with malware and back-doored during one of the stages in the supply chain.
Mobile security is clearly still and will continue to be a problem for businesses. With the advent of BYOD, new threats have emerged and become increasingly common, such as malware and MitM attacks. Gated app stores such as Google Play and Apple’s App Store have also proven not the be the perfect defence, and the possible negative ramifications of user tracking via their mobile devices are only just begun to be explored.
Security costs are higher than ever, are a likely to become higher still, as the multiple layers of static defences model, the chasing of technology, and the concentration on data protection (and usability) become the norm.
Finally, the issue of data and information manipulation – whether it’s the one needed to make operational decision, or the one affecting business reputation – is also coming to the fore, as Big Data analytics advances.