Weaponization, iOS attacks and biometrics – the security landscape for 2016

It's the time of year when companies inevitably turn to their crystal balls and try to predict what the coming year will have in store.

Where security is concerned there's a focus across the board on the evolving threat landscape and the tools needed to deal with it. We've brought together predictions from some of the leading industry experts.

Andrzej Kawalec, CTO for HPE Security Services at Hewlett Packard Enterprise says, "2016 will bring a shift in how organizations protect their data. New cybersecurity tools and techniques will focus on applying big data analytics and automation to the threat landscape, as well as internal users and operations. Additionally, new methods for managing user identity will cross into biometrics and across cloud platforms, and we will see the increasing adoption of advanced consumer security and identity products and services".

But whilst new techniques are used old threats will continue to be a problem. Kawalec adds, "A large and worrying proportion of attacks will continue to prey on old vulnerabilities in standard software and operating systems versions that are poorly managed and updated. New vulnerabilities in mobile devices, operating systems and applications will outstrip more traditional areas of focus".

Mobile security will continue to be a problem too. Zimperium's Joshua Drake, VP of platform research and exploitation, thinks that iOS will be targeted more in the coming year, "iOS security will take center stage with more iOS kernel exploits and jailbreaks for iOS 9.2 and 9.3. We'll also see another Airdrop-esque attack, potentially through AirPlay or Continuity/Handoff".

He also predicts that Android's continued lack of timely updates will be a problem and that more exploits will take advantage of the shared address space ASLR weakness to gain system privileges. On a brighter note Drake believes, "More vulnerabilities will be publicly disclosed due to the expansion of bug bounty programs as more companies realize the value and build the internal acumen to digest the results. Legislative changes will also have a positive impact."

The IoT is also likely to become more of an attack target for cyber criminals. "Adversaries will exploit the influx of connected devices -- everything from watches to cars to critical national infrastructure -- to obtain personal and sensitive information. IoT represents the next battleground as we move towards smarter environments and adversaries advance their tactics to take advantage of new vulnerabilities that arise," says HP Enterprise's Kawalec.

Dmitri Alperovitch, CTO and Co-founder of Crowdstrike and RSA Conference Advisory Board member, believes data will be increasingly weaponized, "Use of data as weapon will be a major problem in 2016. In the past, data has been taken, destroyed or encrypted, but increasingly we’re seeing breaches during which data is leaked publicly in order to cause significant damage to a business, reputations, or even the government (eg, Sony, Ashley Madison, etc.). Criminals and hacktivists are now stealing data and threatening to place it on public websites for others to see. In conjunction with this, hackers are building massive databases that include multiple types of data (insurance, health, credit card) to present a 'full picture' of an individual. It's one thing to have your data stolen and another to have it used against you. We'll continue to see individuals', corporations' and public entities' info used against them as a weapon in 2016".

To help combat threats Stephen Cox, chief security architect at SecureAuth believes we'll see changes in authentication methods, "Biometrics will take a larger role as a second factor as organizations grow more and more distrustful of the password. The ubiquity of personal devices with biometrics sensors will make this possible. Open standards friendly to biometric privacy, such as FIDO, will help adoption".

Cox also says that 2016 will be the year of adaptive authentication, "In many attacks we saw in 2015, attackers were not using malware, they were simply using stolen credentials to log into the environment. With organizations moving to the cloud, there will be an increasing number of authentication touch points in an organization, and those will need to be protected with technology that can rapidly identify and respond to threats".

HP's Kawalec also predicts that senior managers will become more involved in security issues, "In light of the frequent and destructive data breaches we've seen over the last two years, CEOs will be at the forefront in leading the response to a cyber breach. Increasingly we will see these breaches fought in courtrooms and newsrooms, as well as on laptops and networks. Cyber risk will be top-of-mind for boards, elevating the CISO beyond traditional IT. And with this, enterprises will be increasingly responsible for the information security of consumer data".

Steve Lowing, the Director of Product Management at Promisec shares this view and adds that, "The Endpoint Detection and Remediation Market will grow as companies try to stay ahead of threats, and companies will place an importance on encrypting sensitive data due to the rise in ransomware. Companies will have to make sure their remote employees aren't working with confidential corporate data on old, vulnerable OS releases".

Whatever the experts predict you can be sure that security threats aren't going away and that something will come along to make new headlines.

Photo Credit: Anneka/Shutterstock