Predictions for 2021 in Security and Tech

Winston Churchill once said, “I always avoid prophesying beforehand because it is much better to prophesy after the event has already taken place.” Because Mr. Churchill was a brilliant man and I am far less so, I foolishly cheerfully offer my predictions of what I believe will happen in 2021 in the security and tech spaces:

  • There will be at least two significant cyberattacks against critical infrastructure targets in the United States and/or Europe, most likely against electrical power systems. These will be noisy attacks in that they will disrupt large numbers of customers and may last several days. My guess is these attacks will be in the Northeastern United States and in France.
  • In the same vein, there will be a greater emphasis on attacks against various types of Operational Technology (OT) infrastructure. The growing number of sensors and other Internet-enabled devices can be used effectively for a variety of purposes, including penetrating networks and disabling infrastructure as part of ransomware and other attacks. The work-from-home model that will continue at nearly its current pace well into 2021 will be a key enabler of these attacks. A cheap baby monitor that lives on the same home Wi-Fi network that is used to access corporate databases and email does not make for good security.
  • There will be continued high levels of phishing, but we will see an increased emphasis on business email compromise (BEC) as a proportion of total phishing attacks. In fact, we will see record levels of BEC aimed both at senior executives (e.g., CFOs) and lower level employees in HR and finance departments. a) Good security awareness training, b) skeptical employees, and c) communication backchannels to verify these kinds of requests dramatically reduce the chance of bad actors successfully stealing funds, but not enough companies have sufficient numbers of a, b or c.
  • There will be a significant increase in ransomware, but there will be higher ransom demands than we have seen in the past. Recently, there was a $34 million ransomware demand directed at Foxconn Electronics (the highest ransom demand to date that we can tell) and another against Dutch firm Randstad. I expect to see more and much higher ransom demands in 2021 (one ransom demand of $50+ million). At least one of these high-value demands will be directed at a critical infrastructure system.

  • China will begin military operations against Taiwan no later than July 2021 (and will receive very little pushback from most world leaders for doing so). Of course, this will create significant political repercussions, but also major disruptions in the world economy and in the technology space (for example, Taiwan is Apple’s number one supplier, and Google is currently building its third data center in the country.) Chinese President Xi said in early 2019 that Taiwan “must and will be” reunited with China. In May 2020, Chinese Premier Li Keqiang dropped China’s long-standing use of the word “peaceful” in discussing China’s reunification with Taiwan. In late 2020, the senior director at a think tank that specializes in China-Taiwan affairs noted, “This is the most dangerous, the most unstable, and the most consequential flashpoint on the planet.” And, in recent months, there have been a number of incursions by Chinese military aircraft into Taiwanese airspace.

I’d like to hear your thoughts on these predictions.

Phishing and Ransomware are the Logical Evolution of Cybercrime

Phishing, which can be considered the delivery mechanism for various types of malware and cybercrime attempts; and ransomware, which is a specialized form of malware that is designed for the sole purpose of extorting money from victims, are critical problems that every organization must address and through a variety of means: user education, security solutions, vulnerability analysis, threat intelligence, good backup processes, and even common sense. The good news is that there is much that organizations can do to protect themselves, their data, their employees and their customers.

Phishing, particularly highly targeted forms of phishing like spearphishing and CEO Fraud/Business Email Compromise (BEC), as well as ransomware, are the logical evolution of cybercrime. Because there have been so many data breaches over the past few years that have resulted in the theft of hundreds of millions of records, there is a glut of this information on the market. The result, as there would be in any other business driven by the economics of supply and demand, is that prices for stolen records are dropping precipitously: a leading security firm estimates that the price of a stolen payment-card record has decreased from $25 in 2011 to just $6 in 2016.

Consequently, cybercriminals are turning increasingly to more direct means of theft. For example, ransomware will extort money directly from victims without requiring stolen data to be sold on the open market where it is subject to economic forces that can reduce its value. CEO Fraud/BEC can net hundreds of thousands or millions of dollars in a short period of time by getting victims to wire funds directly.

We are in the process of writing a white paper on phishing and ransomware, and will be publishing the results of an in-depth survey on these problems. Let us know if you have any questions or would like copy of the white paper when it is published next week.