What Are Your Cybersecurity Predictions for 2021?

[Bryce W]

For a bit of fun, what are your cybersecurity predictions for 2021?

We can come back to this thread at the end of next year and see how we went.

My prediction: A major cloud provider like Amazon/Microsoft/Google will get knocked offline due to a hacking attack for an hour or more. And the average-joe will notice the outage.

 

[phaZed]

Cybersecurity will be front and center in multiple government "scandals" and leaks. Mostly in the US, but perhaps other nations as well. This is not limited to actual hacks but also to baseless propaganda used by political parties and think-tanks, against the citizenry and opposition parties.

The "cybersecurity space" along with other industries, will see much consolidation, as we have recently seen with NortonLifelock and Avira.. and "Norton" and "LifeLock". This will be fueled primarily by US government contracts, of which the US legislature is set to "buy American" - which is code for, the company's HQ must be in the USA, but everything else 'X' company controls, can be over-seas. Another large factor is the "Stock Market" and the Fed propping it up to the tune of $1T a day, at times. Another is the US Democrat vs. Republicans - which in truth is actually one party - The corporatocracy... which is/has been passing legislation to give everything but the kitchen sink to corporations, at the expense of the citizenry. This is going to create a rich environment for cut-throat global business, hence, Mergers and Acquisitions.. at the expense of "people".

TLDR - The world economy is in deep trouble and the books are cooked and the train ride is coming to a slow, painful end. Cybersecurity makes for an easy scapegoat, excuse, and means to an end - oft cited without any evidence or proof. While this story will not rest on "cybersecurity" alone, it will be used front-and-center as a means and method to some end - Re. "Russia" "China", etc.

 

[nlinecomputers]

What ever happens the bad guys just got a big new set of tools...

U.S. cybersecurity firm FireEye discloses breach, theft of hacking tools

(Reuters) -FireEye, one of the largest cybersecurity companies in the United States, said on Tuesday that it had been hacked, likely by a government, and that an arsenal of hacking tools used to test the defenses of its clients had been stolen. The hack of FireEye, a company with an array of...

finance.yahoo.com

 

[phaZed]

What ever happens the bad guys just got a big new set of tools...

U.S. cybersecurity firm FireEye discloses breach, theft of hacking tools

(Reuters) -FireEye, one of the largest cybersecurity companies in the United States, said on Tuesday that it had been hacked, likely by a government, and that an arsenal of hacking tools used to test the defenses of its clients had been stolen. The hack of FireEye, a company with an array of...

finance.yahoo.com

Welp, there we go, prediction proven! lol

 

[JoeTech]

This link is more what people think the next decade will be like, but there are also links to what people in 2010 thought the previous decade would be like. I found it all very interesting to see what came true and what didn’t

https://news.ycombinator.com/item?id=21941278

 

[GTP]

I run a couple of these just out of curiosity to see where outbreaks occur.
7 "live" cyber attack maps.
Cyber attacks live

 

[britechguy]

When it comes to cybersecurity:

1. It's a cat and mouse game.
2. There are strong parallels to the old Spy vs. Spy bit in Mad Magazine.
3. It's almost always a variation on an existing theme.

Short version, in essence: SSDD or SSDY.

 

[YeOldeStonecat]

Loved those "Spy vs Spy" comics....had a few of their books too.

All bets are off after the recent FireEye breach. Gonna be a nasty year. Bad guys will have tools that'll cut through defenses like a hot knife through butter! Time to change careers!

 

[Fred Claus]

I run a couple of these just out of curiosity to see where outbreaks occur.
7 "live" cyber attack maps.
Cyber attacks live

Thanks for the link. I've never heard of this site but it looks interesting.

 

[britechguy]

Bad guys will have tools that'll cut through defenses like a hot knife through butter!

Or not. There's little doubt that if anything starts showing up that FireEye recognizes as "from our stuff" that the security community will have the information shared, and promptly, on how to stop it, if that hasn't already occurred behind the scenes.

The difficulty is with novel tools that no one knows how they work. Although this breach is undoubtedly very serious, those who were breached are in an ideal position to put preventive measures into place very early on. And given their line of business, I feel fairly certain that they will, but that the general public is not going to ever have "all the deets" about what's necessary to thwart what could be coming. Security by obscurity still has an essential place in the whole arena, just not a primary one.

 

[YeOldeStonecat]

I'm not seeing it what way. Tools to bust open operating systems, firewalls, who knows. To block those tools, someone will have to release patches, who knows how long that will take. And then those patches will have to get installed. All outside of any control of FireEye.

 

[britechguy]

I'm not seeing it what way. Tools to bust open operating systems, firewalls, who knows. To block those tools, someone will have to release patches, who knows how long that will take. And then those patches will have to get installed. All outside of any control of FireEye.

My experience has been that critical security patches don't take long, once it's known what's being dealt with, which is critical to building the patch. The opportunity exists to put those patches out tomorrow, so to speak. I doubt very much that there is going to be a "wait and see" approach to this particular breach on the part of those in charge of cybersecurity. And that sector moves very, very rapidly when possible.

FireEye knows what's been stolen and, given their line of business, I would presume they're sharing that information on a need to know basis. It doesn't help their reputation any were they to keep this information under wraps and their tools were then used to wreak havoc. It's not like it will be difficult to trace stuff back to those tools.

 

[YeOldeStonecat]

And....BOOM...here we go! Predictable move....target big MSP platform, basically steal the keys to the kingdom!

Security Advisory | SolarWinds

This page covers the SolarWinds response to both SUNBURST and SUPERNOVA, and the steps we are taking in response to these incidents.

www.solarwinds.com

 

[britechguy]

And....BOOM...here we go! Predictable move....target big MSP platform, basically steal the keys to the kingdom!

Security Advisory | SolarWinds

This page covers the SolarWinds response to both SUNBURST and SUPERNOVA, and the steps we are taking in response to these incidents.

www.solarwinds.com

Notice, though, that a patch already exists, and in one day (12/15/2020) another will.

There is a window of opportunity to exploit when no one knows that nefarious actors have stolen certain tools. But once that information is out there, the patches start flying fast and furious (or at least they do in competent companies who care about security).

I expect some whack-a-mole in the early weeks and even months, but nowhere near to all of 2021.

 

[nlinecomputers]

Sadly I think it took FireEye discovering the problem before anyone knew what was going on. Meanwhile the Russians have been in many federal agencies via this exploit.

 

[YeOldeStonecat]

Notice, though, that a patch already exists, and in one day (12/15/2020) another will.

There is a window of opportunity to exploit when no one knows that nefarious actors have stolen certain tools. But once that information is out there, the patches start flying fast and furious (or at least they do in competent companies who care about security).

I expect some whack-a-mole in the early weeks and even months, but nowhere near to all of 2021.

The damage has been done. Did ya see what parts of the gov't they already got into? And who knows how much data they extracted from SW..having access to the tools...credentials, and already the ability to push out additional malware/bots.

It's like slo motion antivirus vs malware. The most damage from malware is done on the zero day....and then antivirus releases definitions to detect it, but the virus ran its course already. This here is a similar game..except in very slow motion.

So in the past days, Solarwinds was the target. Which major RMM is next? And after that?

 

[nlinecomputers]

The damage has been done. Did ya see what parts of the gov't they already got into? And who knows how much data they extracted from SW..having access to the tools...credentials, and already the ability to push out additional malware/bots.

It's like slo motion antivirus vs malware. The most damage from malware is done on the zero day....and then antivirus releases definitions to detect it, but the virus ran its course already. This here is a similar game..except in very slow motion.

So in the past days, Solarwinds was the target. Which major RMM is next? And after that?

The real question is can we trust ANY of our tools? If you argue that you can’t trust RMM products, then how do you monitor your clients? Even if you do alot of manual remoting in, you still have to use firewalls and vpn products all of which could have backdoors.

 

[britechguy]

Where did I say it hadn't been done?

This is just the next round in the never-ending cat and mouse game. I have long ago gotten over the idea that cyber breaches will ever be 100% preventable. There will always be someone who figures out "the next way in" and those who, after awareness of that way in exists, find a way to block it.

I'm not saying any of this is good, it just is. And you be as proactive as you can, but sometimes that's not going to work, and then you need to be as promptly reactive as you can. Thus is cyber life.

 

[YeOldeStonecat]

The real question is can we trust ANY of our tools? If you argue that you can’t trust RMM products, then how do you monitor your clients? Even if you do alot of manual remoting in, you still have to use firewalls and vpn products all of which could have backdoors.

Which RMM(s) will be breached next week? Who knows.....anything is game for a while.

 

[frase]

I run a couple of these just out of curiosity to see where outbreaks occur.
7 "live" cyber attack maps.
Cyber attacks live

That is interesting thanks @Barcelona - Reminds me of the old UPLINK game
I had been reading something about Solarwinds patch code being breached and then embedded with malware, thus uploaded to cloud based delivery. I think this is where more sophisticated breaches will occur, as well as more prevalant ransomware attacking corps and verticals, to not only get encryption bitcoin, but blackmail data information to the Darkweb.