T7 – The Trend of Trends 2017

The seven best trend articles in 2017 . . .

For ISO’s of small financial institutions.

We’ve  identified a whole new set of trend articles in Information Security that those in the field should know about, and while our take on this year’s installment is coming a little late, we think you’ll agree that there have been plenty of new developments since last year!

As we’ve said before in our previous takes on this article (Here’s the 2015 edition, and here is 2016’s), it’s important to consider when reading these pieces whether they are discussing current trends or if they’re making predictions. While both kinds of articles can be interesting to read, we try to consider them differently: by basing tactical plans on current trends, and longer term strategies based on predictions.

Whether planning or strategizing, you’ve got to start somewhere–and we think the following subjects (and articles!) are a good place to start for 2017:

1. The Internet of Things. As common household items from thermostats to light bulbs start coming bundled with internet access the number of attack vectors for criminals has and will continue to grow at a rapid pace. Making matters worse, many of these devices lack the ability to be updated should a fatal vulnerability be discovered, and you may lose all functionality if you later decide to turn off internet access!
2. Encryption by the bad guys. The push to encrypt everything hasn’t been lost on those wishing to do you and your business harm–the use of encryption in malware command and control channels makes detection by IDS/IPS systems more difficult, and can also prevent detection on endpoint machines as well.
3. Cyber risk insurance. Part of your risk strategy in dealing with ransomware, reputation attacks and similar incidents should be insurance that covers some of the (potentially high) costs associated with a breach or other cyberattack.
4. Vendor Security. Many security breaches that have made headlines as of late started due to poor vendor security–from card readers to secure messaging services, very few organizations can afford to do everything in-house, and the risks presented by a vendor may not always be obvious at first.
5. Cloud Security. As adoption of cloud storage continues to climb, it’s more important than ever to have a good strategy when it comes to the risk such services may expose you and your organization to.
6. More advanced and targeted phishing attacks. No, phishing attacks aren’t going away any time soon–far from it, they’re actually increasing dramatically in their complexity and how their targets are being chosen! Now if you or an employee accidentally get hit by a phishing email it’s almost certain to contain ransomware, which as we covered in #2 is also a burgeoning field.
7. Reusing passwords coming back to haunt you. With more sites and services demanding more out of your passwords (letters, numbers, special characters and other requirements abound) it has never been more tempting to reuse that one “good” password you’ve memorized–and the bad guys are counting on you to do that!

This article is now a collaboration of several infotex team members.  Original T-7 article concept by Dan Hadaway CRISC CISA CISM. Founder and Managing Partner, infotex

Dan’s New Leaf is a fun blog to inspire thought in the area of IT Governance.