Andrew tang, Service Director, Security at MTI Technology predicts the biggest cyber-security threats that will emerge in 2016.
What will be the emerging IT security threats in 2016 and do you expect as many or even more attacks as 2015?
Although Ransomware attacks have been talked about a lot in 2015, the number of attacks has risen significantly during Q4 2015. Ransomware attacks are so effective that the number of attacks will rise, as well as the level sophistication behind the attack. Especially as corrective measures to protect from the attack are rarely in place.
DDoS (distributed denial-of-service) attacks aimed at extracting data have been getting stronger and harder to defend against, as evidenced by the high profile TalkTalk and Carphone Warehouse breaches.
There have also been a growing number of blackmail attempts, threatening a company’s resources with DDoS attacks if they are paid a sum of money.
Ransomware and DDoS attacks will only increase in frequency in the next year. They do not demand high levels of technical ability and the rewards can be great. Many companies cannot afford lengthy downtimes on their servers therefore will pay the sum demanded, even without any guarantee that the same attackers will not return.
Who will they affect the most?
Ransomware can affect a majority of computer users. Assuming you will not be a victim of a cyber-attack is a major mistake, and the risk of such an attack should be taken seriously.
Blackmail attacks with a threat of DDoS attacks will affect medium to large sized companies who have the budget to pay the sum of money demanded. The transaction is usually in the form of crypto-currency, bitcoin. The companies that have the same budget to invest in the right protection against these types of attacks are likely to be the ones under attacked.
What security solutions will become invaluable to businesses in 2016?
As Ransomware is typically distributed via email, an email sandboxing solution will be required. The relevant solution has to be able to scan emails whether they are being delivered to computers on the network, remote workers using a VPN or BYOD users, who use wireless or cellular connections. As Ransomware will execute with the user-credentials of the user who opens it, there is a need to look at controlling administrative credentials of all computers, whether they are servers, workstations or laptops.
How will the IT security cope with the lack of talent in the UK?
There is not a lack of talent in the IT Security sector, but rather qualified talent. The challenges have been the roles that have been advertised where the skills required are beyond many technical people, or looking for specific certifications and accreditations. I believe there are many good universities in the UK producing excellent candidates for IT Security, as well as many people with the right aptitude and attitude to learn. Although this may not give companies the “right” skillsets immediately, they can be learnt with the right program of education and mentorship.
[su_box title=”About Andrew Tang” style=”noise” box_color=”#336588″]
Andrew Tang is responsible for all technical and service delivery aspects for MTI Security. His team includes a group of highly qualified and experienced consultants, responsible for professional, consulting, assessment, testing and delivery services Through a consultative approach and best practice, using industry standard frameworks such as ITIL and Prince2, Andrew’s team works hard to achieve client and partner objectives and exceed expectation, through tailored solutions and services from the extensive security portfolio. The portfolio includes security solutions, consulting, professional services, CHECK and CREST penetration testing and IT Health Checks (ITHC’s). Assessments are tailored to meet various compliance standards such as PSN CoCo, PCI DSS, ISO27001, Data Protection Act (DPA), eGaming and N3 NHS IGSoC and all of the testing team retain SC clearance or above.
After graduating from Manchester Metropolitan University with a BEng (Hons) in Integrated Engineering Systems, Andrew started his IT career at Henley Industries. Moving to Logicalis in 1996, he became a Senior Systems Engineer, responsible for installing technology solutions for a wide variety of clients, from large financial institutions in the City to small medium enterprises. After appointments at Acxiom and IT Manager at STL, Andrew found his passion for IT and Network Security as the Technical Director at e92plus. During his tenure of over 7 years at e92plus, Andrew developed a team that was both commercially aware and technically responsible for supporting resellers from a pre and post sales perspective. Andrew currently holds a number of industry certifications, including CISSP, MCSE and MCTS.[/su_box]
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.