The Leading News & Information Service For The Facilities, Workplace & Built Environment Community

Cyber Crime and GDPR - Trends For 2018

22 January 2018 | Updated 01 January 1970
 

David Ferbrache, chief technology officer in KPMG’s cyber security practice, highlights ten cyber security trends we can look out for in 2018. He said:

 

1. Everyone will be waiting for 25th May

“This is the day that the General Data Protection Regulation (GDPR) comes into force. Most firms have taken time to understand what GDPR may mean for them, and in many cases have reviewed (or even partially disposed of) their holdings of personal data. It is far harder to predict quite how sanctions under GDPR will be applied by the various regulators. We can expect a few high profile examples to be made early on, but perhaps not the tsunami some expect. Nevertheless, privacy rights are on the agenda, and we can expect zero regulatory tolerance for the long delays in notification of major breaches seen recently.”

 

2. Criminals will hunt out the weak points

“Organised crime groups are on the hunt for new ways to monetise stolen information and access to systems, and in a post Bank of Bangladesh world they will be increasingly creative in how they do this. We can expect more attempts to initiate fraudulent payment transactions (often with a social engineering elements), as well as ongoing interest in our core financial infrastructure including payment and trading platform gateways. Growing demands are being placed on fraud control and anti-money laundering systems to catch these transactions, while customers demand instantaneous financial transfers. If these controls fail, expect to see a $100 million pay-out from a cyber-attack”.

 

3. Governments will continue to block and tackle cybercrime

“As criminals industrialise cyber-attacks using crime as a service model to rent attack tools and ransomware, governments are increasingly looking for ways to disrupt the infrastructure used by criminals. Closer links with telcos and service providers are being built along with the operational processes needs to block sites hosting malware, detect and counter phishing attacks. Trusted DNS services and Domain-based Message Authentication, Reporting and Conformance (DMARC) will be rolled out at scale across the community by both the National Cyber Security Centre and by organisations such as the Global Cyber Alliance. These community measures linked to improved intelligence sharing will start to make a difference.”

 

4. A new model of cyber security will emerge

“As firms invest more in cloud computing, a new model for cyber security is emerging. Increasingly, firms can look to cloud providers to embed good IT security, but firms still own the problem of setting their requirements and determining just who can access what. The shift towards DevOps and agile development, build on these more flexible infrastructures also demands new ways of embedding security into the development lifecycle and an equally agile test regime. Security can no longer engage at the end of development cycles, and if it does, it risks being seen as a blocker rather than an enabler.”

 

5. Automation of controls and compliance will be the order of the day

“Firms are coming under pressure to contain their burgeoning cyber security budgets. Manpower intensive compliance processes are beginning to give way to continuous testing and controls monitoring, helping firms build a more accurate picture of their IT estate – helping the CIO as well as the CISO. The growing demand for supply chain security and third party assurance will also lead to a burgeoning industry of testing firms offering risk scoring and testing services for those third parties.”

 

6. Digital channels will demand customer centric security

“Digital channels are becoming more and more sophisticated demanding new consumer identity and access management approaches, dynamic transaction risk scoring and fraud controls, and an emphasis on usable non-intrusive security measures which don’t impact the consumer’s experience. Open Banking and the arrival of Payment Services Directive 2 will drive richer interactions between a new ecosystem of payment service providers and the banks who handle our money. A new world of open API is on the horizon, but concerns over criminal exploitation of these rich interfaces abound.”

 

7. The internet of insecure things continues

“Criminal groups continue to exploit insecure ‘internet of things’ devices as sources of attack traffic for denial of service attacks, leading to more and more extortion attacks but also an increasingly sophisticated response from the international community involving telcos, content delivery networks and Distributed Denial of Service (DDoS) mitigation firms. Unfortunately, this response won’t be consistent globally, and many nations may find themselves vulnerable to these attacks which will cause major disruption in 2018.”

 

8. The Shadow of State activity lengthens

“As countries invest to develop their cyber espionage and offensive capabilities, we will see more signs of their activities. Disclosures of high end techniques used by nations will continue, fuelling the opportunistic re-purposing of these vulnerabilities by less sophisticated States and organised crime groups. Expect more evidence of industrial control system attack tools being tested as States explore the potential of this new form of warfare.”

 

9. Balkanisation continues and paranoia grows

“States continue to intervene to protect their national security interests in cyberspace, risking an increasingly complex framework of international regulation and controls around the supply chain for critical infrastructure firms. While there will be some moves to align regulation across the global financial sector around the G7 fundamental elements of cyber security, this will take time and effort to achieve.”

 

10. Resilience and speed matters

“Regulators are focussing on resilience – the ability of an organisation to anticipate, absorb and adapt to disruptive events – whether cyber-attack, technology failure, physical events or collapse of a key supplier. Exercises and playbooks are in fashion as firms try to build the muscle memory they need to respond to a cyber-attack quickly and confidently, while cyber insurance is finding its place not just as a means of cost reimbursement but as a channel for access to specialist support in a crisis.”

 

Picture: David Ferbrache, chief technology officer KPMG

 

Article written by Cathryn Ellis | Published 22 January 2018

Share


Related Tags


Related Articles

Why Does China's New Data Protection Law Matter to the UK Property Sector?

China's new Personal Information Protection Law came in on August 20 – find out what the repercussions are for UK property owners. David Smith...

 Read Full Article
What Do The Bosses Know? What Do They Need To Know?

What data does your boss collect about you? Half of us don’t know –  and don't know what it is used for – according to new research from...

 Read Full Article
World Education Not Taking Cyber Threat Cost Seriously

The 2019 Global DNS Threat Report has revealed the education sector is one of the most heavily targeted industries for cyber attacks - and yet invests very little to stop...

 Read Full Article
Facial Recognition Now Available - But Trouble Brewing Ahead

A commercially available facial recognition system has just been launched. Meanwhile, developer Argent could be in hot water for using LFR and both the ICO and a...

 Read Full Article
In Shreds - Most Companies Still Failing On GDPR

It's over a year since GDPR came in to force and yet over two-thirds of poll respondents still think their organisation is not compliant. This lack of confidence...

 Read Full Article
Malicious Intent Is Biggest Threat to Personal Data

A social media poll has found that sixty-five per cent of respondents believe that humans pose the biggest threat to their personal data rather than cyber...

 Read Full Article
Most Organisations’ Biggest Security Concern Is Users

What Keeps You Up at Night – The 2019 Report looks at over 350 global organisations' security concerns and reveals people are the biggest perceived...

 Read Full Article
Ecocleen Awarded ISO 27001 Certification

Ecocleen, the commercial contract cleaning provider, has successfully achieved ISO 27001 certification in recognition of its information security standards. This...

 Read Full Article
GDPR and CCPA Are Businesses Biggest Risks

Gartner's quarterly survey has shown that privacy regulation has returned to the top of the list of emerging risks that worry organisations in light of the GDPR and...

 Read Full Article
Security Training For Commercial Resi Sector

Interphone, the security and building systems integrator, is hosting a product exhibition and training day for managing agents, facilities managers and other...

 Read Full Article