Top six security threats for 2014

Post date: Dec 06, 2013 7:4:42 PM

Posted on 03 December 2013.

The Information Security Forum (ISF) has announced their forecast of the top six security threats global businesses will face in 2014. Key threats include BYOD trends in the workplace, data privacy in the cloud, brand reputational damage, privacy and regulation, cybercrime and the continued expansion of ubiquitous technology.

“As we move into 2014, attacks will continue to become more innovative and sophisticated. Unfortunately, while organizations are developing new security mechanisms, cybercriminals are cultivating new techniques to circumvent them,” said Steve Durbin, Global Vice President of the ISF. “Businesses of all sizes must prepare for the unknown so they have the flexibility to withstand unexpected, high impact security events.”

The top six threats identified by the ISF are not mutually exclusive and can combine to create even greater threat profiles. They are most certainly not the only threats that will emerge over the course of the next twelve months. The most prevalent threats include:

BYOD trends in the workplace

As the trend of employees bringing mobile devices in the workplace grows, businesses of all sizes continue to see information security risks being exploited. These risks stem from both internal and external threats including mismanagement of the device itself, external manipulation of software vulnerabilities and the deployment of poorly tested, unreliable business applications.

If the BYOD risks are too high for your organization today, stay abreast of developments. If the risks are acceptable, ensure your BYOD program is in place and well structured. Keep in mind that if implemented poorly, a personal device strategy in the workplace could face accidental disclosures due to loss of boundary between work and personal data and more business information being held in unprotected manner on consumer devices.

Data privacy in the cloud

While the cost and efficiency benefits of cloud computing services are clear, organizations cannot afford to delay getting to grips with their information security implications. In moving their sensitive data to the cloud, all organizations must know whether the information they are holding about an individual is Personally Identifiable Information (PII) and therefore needs adequate protection.

Different countries’ regulations impose different requirements on whether PII can be transferred across borders. Some have no additional requirements; others have detailed requirements. In order to determine what cross-border transfers that will occur with a particular cloud-based system, an organization needs to work with their cloud provider to determine where the information will be stored and processed.

Reputational damage

Attackers have become more organized, attacks have become more sophisticated, and all threats are more dangerous, and pose more risks, to an organizations reputation. With the speed and complexity of the threat landscape changing on a daily basis, all too often we’re seeing businesses being left behind, sometimes in the wake ofreputational and financial damage. Organizations need to ensure they are fully prepared and engaged to deal with these ever-emerging challenges.

Privacy and regulation

Most governments have already created, or are in the process of creating, regulations that impose conditions on the safeguard and use of Personally Identifiable Information (PII), with penalties for organizations who fail to sufficiently protect it. As a result, organizations need to treat privacy as both a compliance and business risk issue, in order to reduce regulatory sanctions and commercial impacts such as reputational damage and loss of customers due to privacy breaches.

Furthermore, we are seeing increasing plans for regulation around the collection, storage and use of information along with severe penalties for loss of data and breach notification particularly across the European Union. Expect this to continue and develop further imposing an overhead in regulatory management above and beyond the security function and necessarily including legal, HR and Board level input.

Cybercrime

Cyberspace is an increasingly attractive hunting ground for criminals, activists and terrorists motivated to make money, get noticed, cause disruption or even bring down corporations and governments through online attacks. Organizations must be prepared for the unpredictable so they have the resilience to withstand unforeseen, high impact events.

Cybercrime, along with the increase in online causes (hacktivism), the increase in cost of compliance to deal with the uptick in regulatory requirements coupled with the relentless advances in technology against a backdrop of under investment in security departments, can all combine to cause the perfect threat storm. Organizations that identify what the business relies on most will be well placed to quantify the business case to invest in resilience, therefore minimizing the impact of the unforeseen.

The Internet of Things

Organizations’ dependence on the Internet and technology has continued to grow over the years. The rise of objects that connect themselves to the Internet is releasing a surge of new opportunities for data gathering, predictive analytics and IT automation. As increased interest in setting security standards for the Internet of Things (IoT) escalates, it should be up to the companies themselves to continue to build security through communication and interoperability. The security threats of the IoT are broad and potentially devastating and organizations must ensure that technology for both consumers and companies adhere to high standards of safety and security.

“You can’t avoid every serious incident, and while many businesses are good at incident management, few have a mature, structured approach for analyzing what went wrong. As a result, they are incurring unnecessary costs and accepting inappropriate risks,” continued Durbin. “By adopting a realistic, broad-based, collaborative approach to cyber security and resilience, government departments, regulators, senior business managers and information security professionals will be better able to understand the true nature of cyber threats and respond quickly, and appropriately.”