Network Security: A 2018 Priority for Public & Private Sectors

2017 featured some of the largest cyber attacks on record, a trend which is not likely to stop or slow down in 2018. One of the easiest targets for cyber criminals is DNS (Domain Name Server) as it is open by design and not well protected. Hence, it has become a primary target, being used in over 90% of malware-based attacks according to Cisco’s 2016 Annual Security Report. Furthermore, DNS-based attacks are gradually increasing their scale and points of impact, the rise of IoT and connected devices providing hackers new “vehicles” for their malware.

However, the main cause of worry for 2018 is the growing involvement of nation states in launching large scale cyber attacks. Governments and public sector organizations need to prepare themselves for this eventuality, as do private organizations like Duke Energy, Engie, or EDF, who also happen to be the world’s largest utilities organizations. Most experts view such attacks as likely, given the current cyber security landscape.

Below are major reasons cyber security will need to become a priority for public and private sector organizations alike in 2018:

1. Large-scale, more impactful attacks on the horizon

From influencing 2016 US presidential campaigns to the recent attacks on the 2018 Winter Olympics, international events will see their networks increasingly threatened. Large events like political or sporting events are bound to create a strain on networks, making the cyber criminals’ job that much easier. A DDoS volumetric attack can be carried out effortlessly with a massive amount of connections, and can often hide even more dangerous threats.

Even more worrying than an international event’s network being targeted would be a cyber attack on the utilities sector. Hackers could cripple critical infrastructure such as water treatment plants or nuclear power plants (remember Stuxnet?), and the consequences would undoubtedly be catastrophic.

2. Protecting valuable data will be a priority

With GDPR coming into force in May 2018, protecting valuable data will become a priority for businesses. As data’s value as a commodity increases, exfiltration of government and university research data via attacks on the DNS is likely to increase in 2018.

Government and public sector organizations, from the National Defense to university and hospital networks, should take measures to offer a better protection of public networks. Our 2017 DNS Threat Survey has shown 20% of public sector organizations had confidential data stolen in 2017, including major universities and city councils. In view of the strict regulations and fines imposed, GDPR compliance will be a major driving force for businesses small and large to take greater care in safeguarding their customers’ data.

3. IoT and connected devices, the new ideal targets for hackers

Mirai and Andromeda variants will continue and increase in scale in 2018. Businesses need to increase their capacity to mitigate these attacks (with a protection against DDoS volumetric attacks for example).

Connected devices will become the next great devastating targets of attacks, and the consequences will only get more severe as the population begins to integrate more and more of these devices into their everyday lives. As cars become increasingly sophisticated, the risks of hacking will increase as well: opening the car, stopping it on the highway. Even hacks that seem far-fetched like in the Fate of the Furious movie could be possible, and the eventuality of it happening on a large scale should not be dismissed.

DNS is the ideal vector for all these attacks: a DNS-based attack with IoT and connected devices used as vehicles could offer a maximum impact. Unfortunately, no one will be able to fully stop these attacks in 2018; we will only be able to minimize the impact, and to reduce the damage by having in place enhanced security and adaptive countermeasures.

4. Hacking-as-a-service will become even more popular

Given the growing scale and the deeper impact of all the attacks presented above, 2018 might mark the year hacking will truly become a board-level concern for businesses and a national defense concern for governments.

Companies will increasingly use white-hat hacking in order to test their defenses, strengthening their security and brand reputations. In 2017 the Wikileaks hacking challenge (beaten with simple DNS poisoning – see WikiLeaks Hacked By Saudi-Based OurMine), the Hackathon or Kaspersky sharing their source code, are simple examples of the growing importance of white-hat hacking-as-a-service. All the tools needed to execute these attacks are easily accessible with simple Google searches, increasingly benefitting hackers worldwide.

Organizations will also need to make use of specialist security providers who can conduct assessments of their network’s security system to ensure they are protected against constantly evolving threats.

2018 will mark a turning point in cyber security as the scale, profitability and objectives of cyber-attacks are evolving faster than ever. A threat can be devastating, be it far-reaching using IoT devices or even life-threatening by attacking the utilities sector. Organizations need to be ready.