CISOs faced a number of challenges in 2020, not the least of which was COVID-19 and the mass migration from onsite to remote work. Maybe for the first time, corporate leadership saw just how vital the security team is to ensuring the company runs, and runs smoothly, thus making 2020 the year when the CISO and cybersecurity teams went from the background to the very forefront of enabling organizational productivity.
In 2021, CISOs and their security teams can expect to continue to show how vital their role is from risk mitigation to ROI – as they tackle the combined challenges of supply chain hacks, ransomware, WFH, the rollout of 5G, and more.
The impact of supply chain hacks
Capping off the end of the year (and what a year!), CISOs enter 2021 trying to make sense of the SolarWinds hack and how it could impact their own organization. As CNET explained, “It’s a big coup for hackers to pull off a supply-chain attack, because it packages their malware inside a trusted piece of software.” Government agencies are the first targets we know about, but it appears dozens of other companies have been impacted. Those affected will spend the next several weeks and months figuring out how someone could go undetected for nearly a year in their system, and sorting out the damage. [ Keep up on the latest thought leadership, insights, how-to, and analysis on IT through CIO’s newsletters. ]
Ransomware will continue to cause problems in 2021 and CISOs can expect to see threat actors becoming more creative with their attacks. Ransomware-as-a-Service is a quick and easy way for hackers to make a few bucks—an RaaS builder costs about $40 and there are videos available on social media showing how to develop attacks.https://imasdk.googleapis.com/js/core/bridge3.433.1_en.html#goog_1555837304Volume 0%
Nation-states are also deploying ransomware attacks, going after critical infrastructure with multi-staged attacks. They begin with a brute force attack to gain the admin password and then create a backdoor to enter the network. Once inside, malware is deployed to find the endpoints, and once that is completed, ransomware is launched. 2020 saw a number of organizations, including some prominent healthcare facilities, fall victim to these attacks, and 2021 will likely trend increasingly in the wrong direction.
The remote workforce
Workers aren’t going to be returning to the office in 2021. Work from home is going to be in place until there is a full vaccine rollout, and maybe even longer. That means whatever cybersecurity systems that are incorporated now are going to have to stay in effect or be modified for workers who are in a hybrid model of home/office work weeks. Cybercriminals know this, so they will target remote workers with phishing and other targeted attacks. CISOs can expect to see phishing campaigns around the COVID-19 vaccines, with likely “offers” on how to get ahead of your neighbor on the vaccine waitlist.
Phishing won’t be the only problem. Remote workers will continue to use BYOD, including new devices received as holiday gifts, that could cause problems for network security. If companies haven’t already developed a plan to monitor BYOD during remote work, CISOs might want to add this to their plans for 2021.
By Rick Grinnell, Contributor, CIO