A JANUS Whitepaper
If someone asked in 2015, “Where Do You See Yourself in 5 Years?”, every one of us would have been wrong.
2020 is a year that none of us could ever have imagined, no less will ever forget. The changes and turmoil experienced world-wide will be felt for years to come. Organizations have been forced to reimagine themselves, sometimes overnight and those that adapted have survived, and in a few cases even flourished. 2020 has been a year of activating plans that we thought we would never need, reengineering operations, and sometimes reacting very quickly as situations morphed in front of our eyes. With the exception of First Responders and health care professionals, those of us in information technology and cyber security have had tougher years than most. Getting workers set up for remote operations en masse, sometimes with little or no budget, has proven that we are smart, agile, and flexible.
This document sets out what we at JANUS see 2021 shaping up to be. It is a result of research, speaking with clients, and listening to other well-respected people in the industry. The challenges of 2020 will continue into 2021 and in some cases become more pronounced. New challenges will rear their heads and make our jobs more interesting and challenging.
We hope you find this paper insightful and will consider JANUS as a partner in the coming year for your cyber security, privacy, and compliance needs.
Coronavirus Remains an Issue for 2021
Work from home scenarios will continue well into 2021, and forever in some cases. Security teams already stretched thin will continue to worry about adequate staff and budget. Cybercriminals will continue to take advantage of the pandemic and will attack more often and with greater stealth and ferocity. The use of employee owned devices will continue and the security risks inherent will become an ever-increasing issue. Companies that haven’t done so already will need to institute a formal remote work policy. Adopting appropriate software tools will become more prevalent, helping to ensure that remotely accessed company data and systems remain secure.
Cloud Security & Cloud Jacking
Cloud security will continue to be a concern of those in the cyber security community. What was once billed as an easy to deploy and secure solution will continue to see security issues related to improper deployment and configuration. Errors in configuration will lead to weekly disclosures of data buckets being left open to anyone who discovers them. No user ID’s or passwords necessary, these breaches are scoop and run, yielding treasure troves of PII, PHI and company confidential information, and configuration issues will continue to drive cloud data spills. Relatively new, Cloud Jacking attacks will
increase in frequency. Cloud jacking is when complete control and take-over of your cloud infrastructure by use of a simple automated script occurs. Cloud security services from JANUS will help you understand your risk footprint.
Phishing Emails and Malicious Attachments
Email, the mainstay of business, will continue to be the number-one method of cyber-attacks as employees continue to feel overworked and stressed. The increased level of stress plays right into the hands of attackers. Every organization can expect phishing attacks to increase in rate and sophistication as 2021 unfolds.
Malicious attachments will also increase in frequency, sophistication, and play upon employee stress or their desire to help. Regardless of the security protocols put in place safety, employees will continue to fall victim to these types of attacks. Minimizing the risk requires a multi-faceted approach including employee awareness training, next generation fire walls and software/hardware solutions.
Ransomware – New and More Vicious Strains
Ransomware affected 28% of businesses this past year and cybercriminals have realized that ransomware is a highly lucrative business that comes with a low risk of getting caught. It is estimated that in 2021, ransomware will claim a new victim every 10 seconds. The coming year will bring new strains that install backdoors allowing criminals to return and re-encrypt without warning. Ransom fees that were once a few hundred dollars will continue to skyrocket into the tens of thousands or more. Entities that refuse to pay can expect to see their data posted in public forums, and the US government is now talking about criminalizing the payment of ransoms. All is not lost, anti-ransomware software solutions that stop the process, coupled with proper off-site backups and employee training can minimize business disruption.
Supply Chain Compliance
If you are currently a Department of Defense contractor/subcontractor, or planning on becoming one, you need to start thinking about CMMC, the Cybersecurity Maturity Model Certification.
CMMC certification is a direct result of repeated and successful nation-state hacks of government and supplier systems which have led to the theft of sensitive data including that of the F-35 fighter.
BYOD and Mobile Security
Many workers will continue to be remote, and employers will be reluctant to issue company owned devices due to budgetary constraints. Employees will continue to co-mingle personal and business use on a single device leading to increased security risks for every government and business entity. Organizations will continue to enforce use of Virtual Private Networks (VPN’s) for remote mobile access.
Cybersecurity Staffing and Skills Shortage
The need for cyber security professionals will continue to outstrip availability in 2021. Keeping remote workers securely online in addition to the ever increasing frequency and sophistication of cyber attacks will keep current cyber security staff occupied and, in some cases, overworked. As requirements increase, so too will the need for newer, more advanced certifications. Older simple certifications will increasingly be no longer acceptable in today’s threat landscape. As requirements and knowledge increase, so will the cost of hiring and retaining skilled personnel. This will lead to a substantially smaller applicant pool and higher salaries for true professionals.
Virtual CISO (vCISO) services will continue to gain in popularity as a way to augment existing teams. Operations with less mature security postures will look to retain a good vCISO with a team of subject matter experts to fill the gap, often at a lower cost compared to staffing up a full team. JANUS offers vCISO services and additional information can be found on our website.
Although new to many, Threat Hunting will continue to gain in popularity and importance in 2021. Threat hunting utilizes skilled operators in conjunction with sophisticated tools to take a deep dive inside an infrastructure searching for activities that might indicate infiltration from the outside. This advanced process looks for anomalies such as data exfiltration, emails being sent out of band (off hours), or beaconing. Beaconing is when malware communicates with a command and control server asking for instructions or to exfiltrate collected data at a predetermined interval. Speak with JANUS to learn more about our threat hunting services.
One-third of all cyber events have been attributed to employee actions. The upcoming year will yield a continuing increase in insider attacks whether un-intentional or intentional. Organizations can expect to see data exfiltration continue to increase as employees work from home and have less 1-on-1 direct supervision. Security personnel will need to increase vigilance for activities such as unauthorized storage device attachment, connections to cloud file share systems such as Drop Box, and out-of-band emails with large attachments. JANUS insider threat services can help you reduce your risk.
Data privacy will be one of the hot button issues for 2021 as unauthorized and/or unintentional sharing of data will continue to pose challenges in the coming year. Increased public concern and an uptick in data breaches will result in citizens and government watchdogs calling for stricter controls and oversight. Organizations will need to be ready to share plan details related to how they will protect data in their possession, and how they will respond to a data spill. As a result of increased pressure from state and federal lawmakers, individuals will most likely be offered an option to forbid sharing their data. Additionally, encryption of data in transit, and at rest will become more important and in some cases required by industry standards and/or legislation.
Cyber insurance will become a necessity for many companies writing new business to conduct daily operations with existing customers, in addition to writing new business. The cyber policy will help businesses mitigate financial risks from cyber-attacks, employee malfeasance, and accidental data loss or spill.
JANUS Associates® is an independent consultancy that provides a full range of information security, risk management, cloud security services, cloud vendor choice assessment services, business recovery and compliance solutions.
We are specialists in risk analysis, penetration testing, compliance assessments, disaster recovery and business continuity planning, data forensics, data breach crisis management, advanced biometric and authentication software, and mainframe security audit solutions.
In business since 1988, JANUS has the longest tenure of any independent IT security and controls firm in the nation. JANUS is a vendor neutral full service company with strong credentials in the federal, state and municipal government sectors. Numerous Fortune 500’s and Not-For-Profits are also satisfied clients.
JANUS corporate headquarters is located in Stamford, CT with additional locations in Baltimore and Potomac, MD, Miami, FL, Chesapeake and Alexandria, VA, Charlotte, NC, Lubbock, TX and West Hartford, CT.
THE JANUS APPROACH
JANUS approaches all consulting assignments as a team. Bringing a high level of expertise coupled with flexibility to ensure that client needs are met staff works with each client to confirm a mutual
understanding of needs prior to the engagement, and then structures the assignment and tasks to meet them.
While every consulting engagement is unique, the general process for ensuring clear communication and understanding with clients includes the following:
- Needs Assessments
- Scope of Work Statements
- Proposed Approaches and Methodologies
- Statements of Expected Outcomes/Deliverables
- Work Plans
- Progress Updates
- Detailed Reports and/or Exit Presentations