McAfee forecasts developments in adversarial machine learning, ransomware, serverless apps, connected home privacy and privacy of child-generated content.
McAfee Inc.’s most recent threat analyst report has identified five key cyber security trends to watch in 2018.
This year’s report focuses on the evolution of ransomware from traditional to new applications, the cyber security implications of serverless apps, the consumer privacy implications of corporations monitoring consumers in their own homes, long-term implications of corporations gathering children’s user-generated content, and the emergence of a machine learning innovation race between defenders and adversaries.
“The evolution of ransomware in 2017 should remind us of how aggressively a threat can reinvent itself as attackers dramatically innovate and adjust to the successful efforts of defenders,” said Steve Grobman, chief technology officer for McAfee, LLC.
“We must recognise that although technologies such as machine learning, deep learning, and artificial intelligence will be cornerstones of tomorrow’s cyber defences, our adversaries are working just as furiously to implement and innovate around them. As is so often the case in cybersecurity, human intelligence amplified by technology will be the winning factor in the ‘arms race’ between attackers and defenders.”
The changing face of cybercrime has corresponded with the IT evolution, and organisations must take advantage of the new technologies available to both advance business operations and provide better security protection.
1. An adversarial machine learning “arms race”
Machine learning can process massive quantities of data and perform operations at great scale to detect and correct known vulnerabilities, suspicious behavior, and zero-day attacks.
But adversaries will certainly employ machine learning themselves to support their attacks, learning from defensive responses, seeking to disrupt detection models, and exploiting newly discovered vulnerabilities faster than defenders can patch them.
To win this arms race, McAfee suggests that organisations must effectively augment machine judgment and the speed of orchestrated responses with human strategic intellect.
Only then will organisations be able to understand and anticipate the patterns of how attacks might play out, even if they have never been seen before, said the report.
2. Ransomware attackers: new targets, technologies and objectives
The profitability of traditional ransomware campaigns will continue to decline as vendor defences, user education, and industry strategies improve to counter them. Attackers will adjust to target less traditional, more profitable ransomware targets, including high net-worth individuals, connected devices, and businesses.
The pivot from the traditional will see ransomware technologies applied beyond the objective of extortion of individuals, to cyber sabotage and disruption of organisations. This drive among adversaries for greater damage, disruption, and the threat of greater financial impact will not only spawn new variations of cybercrime “business models,” but also begin to seriously drive the expansion of the cyber insurance market.
3. Serverless apps: reduce costs, while increasing attack surface areas
Serverless apps will enable greater granularity, such as faster billing for services. But they are vulnerable to attacks exploiting privilege escalation and application dependencies.
These apps will also be vulnerable to attacks on data in transit across a network, and potentially to brute-force denial of service attacks, in which the serverless architecture fails to scale and incurs expensive service disruptions.
Function development and deployment processes must include the necessary security processes, scalability capabilities must be made available, and traffic must be appropriately protected by VPNs or encryption.
4. The connected home
Connected home device manufacturers and service providers will seek to overcome thin profit margins by gathering more of our personal data — with or without our agreement —turning the home into a corporate store front, continued the report.
Corporate marketers will have powerful incentives to observe consumer behaviour in order to understand the buying needs and preferences of the device owners.
This is because, customers rarely read privacy agreements, corporations will be tempted to frequently change them after the devices and services are deployed to capture more information and revenue.
McAfee believes that there will be regulatory consequences for corporations that make the calculation to break existing laws, pay fines, and continue such practices, thinking they can do so profitably.
5. Corporations collecting children’s digital content will pose long-term reputation risks
In their pursuit of user app “stickiness,” corporations will become more aggressive in enabling and gathering user-generated content from younger users. In 2018, parents will become aware of notable corporate abuses of digital content generated by children, and consider the potential long-term implications of these practices for their own children.
McAfee believes many future adults will suffer from negative “digital baggage,” user content developed in a user-app environment where socially appropriate guidelines are not yet well defined or enforced, and where the user interface is so personally engaging that children and their parents do not consider the consequences of creating content that corporations could use and potentially abuse in the future.
In a competitive app environment where “stickiness” easily becomes “unstuck,” the most enterprising, forward-looking apps and services will recognize the brand-building value of making themselves a partner with parents in this education effort.
This article originally appeared on Information Age.