To mark the start of a new year, the security industry has set its goal. According to the ‘2020 Security Threat’, security organizations such as KISA (Korea Internet & Security Agency), Financial Security Institute, and domestic security specialized companies such as Igloo Security, ESTSecurity, SOPHOS, SK Infosec, Check Point, and Trend Micro have selected 7 cyber security keywords for the year 2020. △AI △Ransomware △Supply Chain Attacks △Cloud △IoT △Malicious Emails △Dark Web
Keyword 1- Artificial Intelligence
AI has been around for quite a while now and one of its most memorable advancements was the Go game between ‘AlphaGo’, a computer Go program developed by Goggle DeepMind, and the world champion Lee Se-dol. AlphaGo was able to use its collected data to achieve its goal. The so called ‘weak AI’ used on AlphaGo is also applied to various fields within cyber-security. The number of such AI security solutions is on the rise and so is the number of attackers misusing AI.
Careful observations on malware features, abnormal acts, characteristics of its attackers, and machine learning based AI algorithms enable the defenders to deal with cyber threats. However, such observations also give the attackers a chance to invent new attack methods. Since the risk of inputting false data and many other unsolved errors are relatively high in AI, defenders must always stay alert.
Even though most security solutions are built and driven on human logic-based detection engines, keeping the latest technology, its devices, and threats manually up to date is impossible. To solve this problem, AI is useful for detecting threats, accelerating its responding speed, and blocking out the attack before its proliferation. However, stronger malware will be developed, weaknesses will be revealed as cyber criminals continue using the same technology as the defenders to search and destruct.
Keyword 2- Ransomware
Over the past years, ransomware has been aiming at innumerable targets. However, its new method of attack now aims at specific targets, where companies, communities, and public institutions are at risk. Companies with strong financial powers are most likely to be their targets as the attackers will be rewarded huge sums of money for their success. Those providing Infra and Database storage, local government and healthcare organizations, are listed as the main targets of ransomware attacks.
Keyword 3- Supply Chain Attack
Supply Chain attack is a cyber-attack which affects the organization by targeting less-secure elements in the supply network. Supply Chain attacks were already on the list of the 7 Cyber-security keywords last year, and still manages to maintain its place. Such attacks will continue to infiltrate into the supply chain through third party systems and services. Therefore, due to its weak security systems, those purchasing third party vendor products and services, must take extra caution.
Keyword 4- Cloud
The interest in Cloud Security is on the rise. However, it is pointed out that Cloud computing’s largest vulnerability is the operator’s configuration error. More complex and flexible Cloud systems will eventually lead to a greater number of errors and reveal itself as a target for many cyber attackers.
Keyword 5- Malicious emails
Receiving emails containing malware is not a new thing anymore. The Financial Security Institute warns us how malware email attacks are becoming more cunning and harder to block. Spear Phishing, a traditional method of attack which uses HWP and DOC documents, will not stop this year.
Keyword 6- Internet of Things (IoT)
Building castles in the air was the perfect phrase to describe how IoT was perceived. However, IoT has now become a part of our lives. People can now watch YouTube on their refrigerators and gas valves can be closed by using Smartphone applications. Many are experiencing an easier lifestyle but are also suffering from many cyber threats.
IoT devices are now being more commonly used and those using 5G network are as well. On the contrary, network weaknesses of the large scale multi vector 5G cyber-attacks are predicted to increase in large numbers. The main problem is that the network between IoT devices, its network, and Cloud is security-wise still unstable. This makes it harder to perceive clear visibility of the devices and requires complex security requirements. Approaches such as the macroscopic Holistic Approach is essential for attaining IoT security. The existing regulations and the new ones must be integrated in order to protect the developing network of all industries and business fields.
Keyword 7- Darkweb
Due to several incidents, Darkweb, which was only known to cyber attackers and security professionals, is now well-known to the public. For example, Warez and Webhard are the two programs in which Netizens in Korea can improve their networking skills, but also leads them to be involved in distributing illegal programs and even in cybercrime.
Personal information and hacking tools traded on Darkweb are mostly used for attacks. Darkweb has a high chance of being used in the hacking market, where attacks such as credential stuffing, spear phishing, and smishing all misuse personal information. Darkweb is also a place where financial crimes are taking place, and it was for this reason why the Financial Security Institute included Darkweb on the 9 Cyber-security issues of 2020.
