Cyber-attacks have become so common in todays times, that the only “news” is of its growth in frequency and variety. When dealing with the dayto-day, it can be difficult to tally the mounting toll associated with this awful stateof affairs—and even more challenging to predict what surprises lie ahead. Basedon industry trends, legal framework changes, expert insights and technologicalevolution, the following cyber security happenings have been predicted:
Prediction #1: APDoS as SOP
Advanced persistent DoS (APDoS) will become hacktivists’ preferred technique and the cause
of a significant portion of business outages. APDoS attacks involve massive DDoS attacks,from assaults on the network layer to focused application layer floods. Those attacks arefollowed by repeated SQLI and XSS attacks, which occur at varying intervals. Because APDoSis essentially a potpourri of attack types, they require diverse technology that protects both thenetwork and application level to effectively mitigate.
Perpetrators of APDoS attacks will simultaneously use two to five attack vectors, involving upto several tens of millions of requests per second. All the while, large SYN floods attack notonly the direct target but also the service provider as it implements managed DDoS mitigation.
APDoS attacks can persist for weeks at a time—challenging the resources of even the mostsophisticated security infrastructures.APDoS attacks have become standard operatingprocedure for many hacktivist groups.Attackers in this scenario often switch tactically between several targets to create a diversion toevade defensive DDoS countermeasures while eventually directing the main thrust of the attackon a single victim.
Prediction #2: PulseWave DDOS Attack
A pulse wave DDoS attack is characterized by short bursts of high volumes. Each burst lasts a very short time, usually several minutes. In addition,
such an attack can switch targets frequently during an assault, requiring quick adjustments by the mitigation platform.
Prediction #3:Continued Rise of RDoS
Ransomware and RansomDoS (RDoS) schemeswill affect everything from traditional enterprises tocloud companies. It is reminiscent of the old joke:Why do robbers burglarize banks? Because thatis where the money is! Cloud companies, beware;ISPs will experience significantRDoS attacks!
Prediction #4: Privacy as a Right (Not Just a Regulation)
Around the world, privacy’s legal comeuppance is upon us. Some countries already recognize privacy as a human right and provide for constitutional covenants to protect its citizens. It’s no longer a matter of whether data can be secured in pursuit of privacy, but rather if privacy is endemic to the human condition.
Ifprivacy is a human right, what must we do to protect it?In the meantime, securityprofessionals and businesses entrusted with data will bear the cost and responsibilityof safeguarding it. Around the world, early adopters will lead the way, with this trend picking up.
Prediction #5: More Laws Governing Sensitive Data
Many countries took notice when the US Government’s PRISM program was revealed to the public.
Contention exists regarding the handling and use of data and this has given rise throughout the world to special laws governing use, processing and domiciling of certain data. Some examples include the Canadian government’s decree on processing sensitive Canadian data within Canada following U.S passage of the Patriot Act. Other examples can be found in Brazil, Japan and China and more will follow, further complicating the privacy and security officer’s responsibility to technically secure data.
Prediction #6: Arrival of Permanent Denial-of-Service (PDoS) Attacks, Albeit Very Slowly
PDoS, also known loosely as phlashing, is an attack that damages a system so badly that replacement or reinstallation of hardware is required. By exploiting security flaws or misconfigurations, PDoS can destroy the firmware and/or basic functions of the system. It is a contrast to its well-known cousin, the DDoS attack, which overloads systems with requests meant to saturate resources through unintended usage.
PDoS can accomplish its damage via remote or physical administration on the management interfaces of the victim’s hardware, such as routers, printers or other networking hardware. The attacker uses vulnerabilities to replace a device’s basic software with a modified, corrupt or defective firmware image—a process that, when done legitimately, is known as flashing. This therefore “bricks” the device, rendering it unusable for its original purpose until it can be repaired or replaced.
Prediction #7: Growing Encryption to and from Cloud Applications
A few years ago, effective technology to secure communication to and from cloud providers and user
communities of companies simply did not exist. Now there is a great capability to encrypt this data en masse. It’s a trend that’s necessary but also wrought with folly and will ultimately prove a short-term solution to a larger problem.
Prediction #8: The Internet of Zombies
Security on Internet of Things (IoT) devices is abysmal—data will be breached at a higher rate than any other technical regime. Technical adoption is the paramount concern while security is an afterthought. These devices represent a cottage industry for privacy violators and the risks to this rich data source will be highlighted, transforming the Internet of Things into a dangerous Internet of Zombies.
