The Cranky Admin
The Big IT Security Stories of 2018
IT security never gets any easier, and 2018 certainly looks set to present us with new challenges. There are always old favorites like Distributed-Denial-of-Service (DDoS) attacks, malware, ransomware and exploiting software flaws with which to deal. 2018 will bring a new wave of cloud-enhanced problems to contend with, problems that aren't getting a lot of tech press attention just yet.
BDCA-Enhanced Social Engineering
Social engineering is becoming increasingly automated. No longer simply tools hackers seeing to compromise networks, nation states are engaged in sophisticated social engineering campaigns that make use of both social and traditional media.
Today's social engineering marries modern technology with the psychological and political warfare concepts that grew to prominence during the cold war. These new approaches to social engineering use Bulk Data Computational Analysis (BDCA) tools combined with highly experienced disinformation specialists to identify topics and groups of individuals most likely to be exploitable.
In response, a new generation of Social Anti-Malware (SAM) tools is emerging. They look to integrate with everything from Web browsers to augmented reality in order to combat disinformation in real time. These second-generation SAM tools do this by flagging known bot and troll accounts on social media, or provide alerts when known disinformation or urban legends are encountered.
As the BDCA tools and techniques used for nation state-level social engineering become better understood, they'll be commoditized and used as part of more classic social engineering aimed at network penetration. In turn, the arms race should see SAM tools becoming a standard part of IT security defenses.
Last-Minute GDPR Scramble
The General Data Protection Regulation (GDPR) comes into force in May 2018, and it's significantly stricter regulation than most organizations are used to. Any organization that handles the data of a European citizen is subject to the GDPR. This includes international organizations, many of which don't seem to know this yet.
As the deadline approaches, expect a mad, last-minute dash for the GDPR compliance finish line. Many organizations will be looking for quick fixes and tickbox compliance. This will leave them vulnerable to any number of scams, con jobs and inadequate solutions.
GDPR compliance requires more than simply installing another application gateway or firewall on your network. It requires a complete overhaul of how an organization treats data.
The level of change that GDPR compliance requires of organizations makes them vulnerable. Staff adapting to (or resisting) change is more easily socially engineered, while gaps may exist between the implementation of new technologies and their final and complete integration with existing systems. The closer we get to May 2018, the greater the pressure will be; the greater the pressure, the higher the likelihood of making an exploitable mistake.
Hybrid Device Challenges
2018 looks set to be the year in which machine-to-machine communication really takes off. The explosion of Internet of Things (IoT) devices, combined with increased adoption of augmented reality will lead to Big Brother-style technological deployments.
The devices implementing these new Big Brother technologies aren't likely to have the local compute capacity to perform all of their BDCA tasks. They'll farm out much of the heavy lifting to the public cloud. Some of that can be done using the core public cloud infrastructure, but some of it will rely on the newly emerging phenomenon of edge computing.
These new hybrid devices harvest, process and act on personally identifiable data without human intervention. This opens up a whole new world of privacy, data sovereignty and legal liability concerns, especially in light of emerging regulations such as the GDPR.
These devices can also be used to augment and enhance BDCA-backed social engineering efforts, or be hijacked by malicious actors for any number of purposes. Additionally, spoofing and fooling BDCA tools has already piqued the interest of academics and hackers. Once these hybrid devices emerge as physical, commercially available devices, they'll be targeted.
About the Author
Trevor Pott is a full-time nerd from Edmonton, Alberta, Canada. He splits his time between systems administration, technology writing, and consulting. As a consultant he helps Silicon Valley startups better understand systems administrators and how to sell to them.