What can cybersecurity leaders and professionals expect in 2021? Here's a list of the top cybersecurity risks to consider that may affect organizations and cybersecurity leaders across a variety of industries and company sizes:
Ransomware will remain prevalent, but the evolution of attacks likely won’t change.
The main goal of most cyber attacks is monetization and as long as attackers continue to successfully get businesses to pay to get their sensitive data or systems back online, threat actors will stay the course as the method is still very lucrative.
The prevalence of cyber insurance will increase.
Cyber insurance will increase as the occurrence of ransomware and attacks goes up. With this increase, insurance companies will likely decrease the coverage amounts and provide further stipulations on what or how much they cover as a result of a ransomware attack. These changes could significantly impact small and medium businesses (SMBs) that have already been significantly impacted by the pandemic.
Zero Trust models will be adopted more prevalently.
As companies rely more and more on a remote workforce, they will look at Zero Trust models that assume the perimeter has been breached and segment authentication and access to sensitive data accordingly. VPNs simply are not enough to ensure that your remote environment is connecting to the network safely—as VPNs come with too many inherent vulnerabilities.
A lot of the same cyber attacks that have impacted companies will continue.
It’s not overly exciting, but it’s true. Cyber threats like social engineering attacks and ransomware will continue to be the main methods of attack. Known vulnerabilities are a huge reason for this. A majority of Patch Tuesday releases in the past year have reported 100+ vulnerabilities, which is an amount that’s impossible to maintain if patching teams are deploying updates through VPNs. This means that attackers are likely to find a device at an organization that is exploitable through an unpatched, but patchable, vulnerability.
An increase in cyber attacks against remote work infrastructure.
Companies have had to deploy new technologies organization-wide and within a short period of time to support remote workers. Knowing this, expect attackers to target things like VPNs and collaboration applications that are in high use and now under increased scrutiny from a security standpoint.
Social engineering attacks will evolve.
We’ve seen how phishing has changed over the years—from generic to personalized emails, to context-aware methods that are scarily realistic. Deepfakes could see a similar evolution where an attacker leverages video or audio recordings to impersonate an important figure at an organization to gain access to certain assets.
Cloud misconfigurations will be even more prevalent as cloud data increases.
More and more technologies are going to cloud-based models, increasing the amount of cloud data companies have. With this, expect more leaks from cloud storage buckets where a company overlooks basic security configurations in the cloud, leaving information open to the internet for anyone to find.
Everything will revolve around remote workers, but the core target will remain the same.
2021 will likely see malware and attacks focus heavily on remote workforces. These devices and users will often be outside the scope and perimeter of corporate security. However, many of these devices will continue to regularly access critical assets and IP via a VPN. Adversaries will likely increase focus on these devices in an attempt to land and expand to other critical infrastructure. Each device could become its own leak in the firewall and organizations will need to come up with new and innovative ways to stay ahead of attackers exploiting this vector.
Fortune 1000 companies will consider Zero Trust.
Zero Trust approaches will become critical for securing IP and critical infrastructure and will likely become the de facto replacement for cumbersome VPN approaches. We predict that by the end of 2021, every company in the Fortune 1000 list will have evaluated Zero Trust for their organizations. This will lead to significant interest in CASB, cloud-enabled security tools, and cloud-native IT solutions.
Adversaries will lean in on targeting more known exploits, considering the potential of at-risk and vulnerable remote devices.
Adversaries will begin to more broadly attack remote workforces in 2021. This will lead to the utilization of more tried and true, or well known, vulnerabilities being targeted for exploitation, leading to less targeted attacks using bleeding-edge vulnerabilities due to the ease of using known exploits. Overall, the impact of this will be a vulnerability management mirage effect. Addressing vulnerabilities will be just as important as ever; however, tools like firewall rules will not be at the ready for remote devices which means that patching endpoints becomes more important.
2021 will be the costliest year for cybersecurity for the next decade.
In 2021, CISOs will likely see budgets strained by IT needs, especially for VPN, and spend less on cybersecurity as a consequence. Reduction in resources and revenue often coincides with cutting corners. Shadow IT will increase while investment in security decreases, leading to breaches from misconfigurations, missing patches, and poor cyber hygiene. Coupled with an ongoing pandemic and pervasive use of ransomware as a quick monetization path for attackers, 2021 will see more healthcare facilities attacked and exploited leading to the highest number of directly attributed casualties from cyber attacks.
About Automox Automated Patch Management
Facing growing threats and a rapidly expanding attack surface, understaffed and alert-fatigued organizations need more efficient ways to eliminate their exposure to vulnerabilities. Automox is a modern cyber hygiene platform that closes the aperture of attack by more than 80% with just half the effort of traditional solutions.
Cloud-native and globally available, Automox enforces OS & third-party patch management, security configurations, and custom scripting across Windows, macOS, and Linux from a single intuitive console. IT and SecOps can quickly gain control and share visibility of on-prem, remote and virtual endpoints without the need to deploy costly infrastructure.
Experience modern, cloud-native patch management today with a 15-day free trial of Automox and start recapturing more than half the time you're currently spending on managing your attack surface. Automox dramatically reduces corporate risk while raising operational efficiency to deliver best-in-class security outcomes, faster and with fewer resources.
