The Top Security Threats of 2017

The beginning of a new year is a great time to reassess your strategic IT plans, map out new strategies and refresh aging hardware and software. It’s also a good opportunity to forecast what threats your organization might face over the next 12 months and figure out how you’re going to deal with them.

Some of the top IT security threats we predict in 2017 are similar to those we’ve seen in the past, such as ransomware and mobile malware, but others are relatively new, or evolving quickly, such as Internet of Things (IoT), Mac and iOS vulnerabilities.

Ransomware: It’s no surprise ransomware will continue to be a major threat in 2017. The primary goal of most hackers is to make money and ransomware, which locks down data until a ransom is paid, is a great cash generator. Most ransomware attacks target consumers, but successful attacks on businesses can generate a lot more money for hackers. 2016 saw a number of successful ransomware attacks on businesses, hospitals and other organizations and there’s little reason to believe the attacks will cease in 2017. The only bright side is that higher-profile ransomware attacks have resulted in the IT security industry and law enforcement working more closely together to defeat them, which could result in fewer attacks in the latter half of the year.

Mac: In the past, using a MAC made it much less likely that you would be targeted by a hacker.  Well, times may be changing.  In 2017, hackers may be pivoting to address the broad adoption of MACs in both government and corporate environments.  According to a report by Network World, two security researchers have found a Mac based malware that they believe may be an attempt by Iranian hackers to go after the US Defense Industry.  I’ve been expecting this for some time now, and it seems that it may finally be happening.  We should all keep a close eye on this as the year goes on.

IoT: The IoT has grown quickly, in large part because devices that generate and transmit data enable organizations to make better decisions. With so many connected devices generating reams of valuable data, the IoT is also a major potential security risk. Hackers could use ransomware to lock down important IoT devices until they receive payment. Industries with widely distributed networks supporting a multitude of mission-critical devices, such as power distribution and healthcare, are particularly vulnerable.

Mobility: Mobile malware has grown significantly over the last few years and the trend is almost certain to continue over the next 12 months with ransomware and remote access tools leading the way. In 2017, McAfee Labs predicts mobile malware authors will combine mobile device locks with other forms of attacks such as credential theft. The firm also believes malware authors will use remote access tools disguised to look like support utilities on application markets to spy on users. Organizations should ensure employees only download apps from secure and trusted app marketplaces to minimize their security exposure.

iOS Apps: Not to be confused with IoT, the iOS apps that we love to download to our phones are coming under more and more pressure to stay secure.  In one recent instance, a number of developers misconfigured code related to networking functions, allowing the phones to accept an invalid Transport Layer Security (TLS) certificate.  Just another vector to worry about when organizations are thinking of protecting their systems.

Social Engineering: Social engineering attacks, where employees are tricked into divulging confidential information after clicking on legitimate-looking e-mail, or even answering questions over the phone, are one of the oldest forms of information attacks. However improved machine learning will make it easier for hackers to refine their social engineering attacks and improve their success rates in 2017. Machine learning toolkits are more accessible than ever and could, for example, allow cybercriminals to perform sophisticated, targeted attacks at scale by scanning social media accounts tied to a user to extract information that could be used to make a spear phishing attack look more like a legitimate email from a trusted source. .

How organizations can protect themselves: Unfortunately there’s no foolproof way to foil every potential IT security threat. But there are steps CIOs and CSOs can take to minimize their risk.

Educating all employees about security best practices, such as not opening suspicious e-mail, or not using potentially infected USB drives will continue to be important. Most cyber-attacks are the result of human error and an informed workforce is less likely to make mistakes.

Ensure you have a solid security plan in place that encompasses any data relevant to your organization – whether it’s on-site, in the cloud or on employee laptops or smartphones. Use multi-factor authentication if possible and set alarms for suspicious activity. Data today moves outside the corporate perimeter and security teams need to make that data as secure as possible.

A strong security stance can help organizations defeat potential attacks before they really get started.