It should come as no surprise that 2015 was the worst year on record for cyber security threats. Washington Times reported that the breach of over 100 million health care records gave the annum an edge over its prior, the year of the infamous SONY Pictures Entertainment hack. SONY wasn’t alone, mind you. Target, Home Depot, Neiman Marcus, and JP Morgan were all hacked in 2014, with cyber attacks compromising credit cards and consumer information.

The wave of cyber security news spilled from corporate to pop-culture in 2015, with the biggest headline landing in the summer as online infidelity proponent Ashley Madison was hacked by a group known as “The Impact Team”. To date, members continue to receive blackmail and extortion solicitations. Given the moral implications of the online business model, there was little public outrage over the Ashley Madison hack. But the year delivered blow after blow to big and small organizations alike, across the world. 

Most notable, was the hack of the federal Office of Personnel Management which suffered access to over 21.5 million people, including data theft of 5.6 million federal employee fingerprints (which hold classified clearance). Gemalto, a dutch manufacturer of globally consumed mobile phone SIM cards, also took a hit in 2015, proving security measures put in place after their publicized attacks in 2010 and 2011 were not enough. The year also saw cyber security fails from Moscow’s antivirus firm Kaspersky Lab, the US Internal Revenue Service (IRS), and CIA Director John Brennan’s personal AOL account. Other leading internet security firms were ironically susceptible, with Juniper NetScreen Firewalls breached, allowing hackers to take complete control of any vulnerable NetScreen device connected to the web.

2015 was a record setting year for cyber attacks, costing the global economy up to $575 billion. 2016 is expected to follow suit. The call-to-action for internet security has become so essential that President Obama asked Congress in early February to open up $19 billion for an all-encompassing cyber security plan.

Enterprise level businesses have IT security at a high priority and can afford to, but are small and medium sized businesses in any way prepared for what’s to come?

Worse, do they even know what’s at stake? Given the advent of security breaches, we polled our own team to rank the major threats in 2016 and beyond, and provide some definition around what hackers are after. 

The 5 Biggest Threats to Global Cyber Security in 2016 and Beyond

1. Increased Hacker Focus on Mobile Consumer Payment Systems

With 30% growth in the existence of internet connected devices in 2016 over 2015, opportunity for hackers has increased exponentially. Their focus? Infiltrating your consumers’ online pocketbooks, namely through mobile. Malware writers will attempt to infiltrate smartphone payment systems such as Google Wallet, Apple Passbook, Lemon Wallet, and PayPal and steal consumer information. They will attack underlying operating systems and release a greater number of malware-infected apps. But the buck doesn’t stop at the consumer.

Once hackers have infiltrated consumer mobile payment systems they may be able to access your corporate networks. The emails, contacts, confidential authentication measures and apps that access your corporate network become susceptible. A Chief Information Officer (CIO) plan educating your consumers about how they can help protect your business by default (by starting with their information) against mobile-focused malware will be essential in 2016.

2. Rise in Ransomeware and Corporate Extortion

Corporate extortion will be even bigger in 2016 as hacking groups hold sensitive data ransom in order to fund their endless attacks on the global economy. By definition, ransomeware is a form of malware that restricts access to an infected internet enabled device and provides the hacker with sensitive corporate information, including (but not exclusive to) photos, email conversations, contracts, and other classified files. The hacker locks out users and holds this information for ransom, demanding that the user pay up to return files and access. Some forms of this advanced malware systematically encrypt files on your system’s hard drive, making it extremely difficult (if not impossible) to remove ransomware without paying. If you think paying is a solution, it’s not. There’s nothing to guarantee that the culprits will follow-through on their promise.

To hedge risk against this growing form of corporate extortion, have your CIO institute a company wide program to protect devices, staff, and stakeholders from ransomware attacks. This includes advanced email malware eduction, regular updating of software and applications, frequent and comprehensive file backups, and an improved layered protection suite.

3. Cracking the Cloud

Cloud storage and services can be economical, flexible, and quite secure, but it is not as inherently safe from cyber attacks as people think. As more and more organizations switch to cloud storage (80% of SMBs are now on the cloud) proportionate growth in hacker concentration on the cloud is expected to follow. They know where the opportunity is. As we speak, cyber criminals are building malware specifically designed to crack corporate cloud-based systems. Apps that rely on the cloud will also be more readily compromised, and thus mobile devices running on them will provide a route for hackers to remotely attack private clouds and access corporate networks. Smart hackers will use the sanctioned cloud-drive infrastructure to evade security watchdogs and sink-hole assets. These malicious cloud-drive services will enable written malware to both send and receive commands without raising suspicion. It will appear to be associated with legitimate traffic and thus increase the longevity of the hack crusade.

CIOs will need to concentrate on securing the most advanced form of cloud backup and security, one that uniquely aligns to their organization.

4. Increased Concentration on IoT Takeover

The Internet of Things (IoT) is the ever-growing global network of physical internet-enabled objects. This includes devices, automobiles, buildings, medical equipment, wi-fi toys, wearable gadgets and all other electronic items that can be embedded with software, sensors, and web connectivity to enable them to collect and exchange data. Even military defensive mechanisms are considered as such, which is why concern over the growth in IoT hacks are justified. Any corporation or organization that manufactures, uses, and/or depends upon an IoT object is susceptible. For example, if you manufacture consumer vehicles you can only imagine the implications of cyber attacks on your product, on the road. Wired Magazine reported it quite succinctly when they quoted cyber security expert Chris Rouland on the rise of IoT breaching:

Cyber Barbie is now part of the kill chain (wired.com)

In 2016, organizations need to consider security beyond their network by including the internet-enabled products they put to market in addition to web-based materials they use in the course of day to day business. A global improvement in IoT security standards will be a key to keeping safe from cyber attacks in the years ahead.

5. Hacktivism

Hacktivism is a dangerous beast because as evidenced in 2015, it often garners public support. Driven by a political and/or social mandate, hacktivist groups are on the rise and are not afraid to go after any entity that they deem fit. By now, everyone knows Anonymous, and they’ve gained empathy in their publicized efforts in going after global terrorist cells. However, copycat groups are popping up all over the world, each with their own agenda. Federal and municipal bodies, financial institutions, and corporations of all shapes and sizes are big targets. If your organization can in any way be connected to a political or social agenda 2016 will be a year where you need to beef-up cyber security.

Hackers Are Becoming More Sophisticated, Are You?

The cyber security threat landscape is changing fast. As new security measures are instituted cyber criminals are adjusting, adapting, and attempting to stay ahead of the system. One of the biggest threats is the proverbial ghost in the machine, known as ghostware.

Ghostware is a form of malware that enters a system, accomplishes its goal (i.e., steals data or plants malicious code), then vanishes without a trace. Ghostware is extremely difficult for organizational security to identify or track. You may not even know you were hacked until a year or more down the road. By then, the damage is done, all trace of the hack is gone, and prosecution attempts are fruitless. Then there is two-faced malware. Two-faced malware executes a seemingly simple task while in the sandbox (a security testing environment that isolates untested code) and as soon it passes inspection it performs its malicious task.

We believe most North American organizations are not only ill-prepared for the coming onslaught, they aren’t even in-tune with the level of risk. Is cyber security a priority for your organization. If yes, we are keen to see your comments and questions below. We encourage you to contact us if you interested in learning more about how we can implement robust security measures for your organization.