Security: The Threat is Evolving.

Last month I was at a tech conference talking to the President of a peer Solution Provider. He was telling me a story of his brother-in-law, Tom. Tom and his wife were closing on an investment property and the amount of money due at closing was $310,000. Before closing Tom received wire instructions from his real estate agent, and sent the money. When Tom and his wife showed up for closing the title company asked Tom for a check for the funds. Tom eagerly said he had already wired the funds, to which the title company representative responded that they do not accept wire transfers. Tom went flush and was overcome by a cold chill. He slowly realized he had just lost $310,000.

At the same conference I heard General Michael Hayden, former Director of the CIA and NSA, speak on security. One of my top takeaways was an assumption Michael always makes when assessing risk, which he calculates the following way: RISK = Threat x Vulnerability x Consequences. That takeaway was this: always assume that your network has already been breached and take a position of mitigating negative consequences.

Oh and General Hayden had one other point to make…the US Government has not and will not solve this problem.

In a talk earlier this month the Global Security Strategist for Fortinet, Derek Manky, made a few pointed predictions for 2017:

Automated and human-like attacks will demand a more intelligent defense.

Threats are getting smarter and are increasingly able to operate autonomously. In the coming year we expect to see “human-like” malware designed with adaptive, success-based learning to improve the impact and efficacy of attacks.

Ransomware was just the gateway malware. We expect to see very focused attacks against high-profile targets, such as celebrities, political figures and large organizations. Automated attacks will introduce an economy of scale to ransomware that will allow hackers to cost-effectively extort small amounts of money from large numbers of victims simultaneously, especially by targeting IoT devices.

20 billion IoT (Internet of Things) devices will be the weakest link for attacking the cloud.

The weakest link in cloud security is not in its architecture. It lies in the millions of remote devices accessing cloud resources. We expect to see attacks designed to exploit endpoint devices, resulting in client side attacks that can effectively target and breach cloud providers.

Consider that Gartner, Inc. forecasts that 6.4 billion connected things will be in use worldwide in 2016, up 30 percent from 2015, and will reach 20.8 billion by 2020.

As building automation and management systems continue to grow over the next year they will be targeted by hackers. The potential for massive civil disruption should any of these integrated systems be compromised is severe, and are likely to be high-value targets for cybercriminals.

Technology will have to close the gap on critical cyber skills shortage.

Organizations simply do not have the experience or training necessary to develop a security policy, protect critical assets that now move freely between network environments, or identify and respond to today’s more sophisticated attacks.

The Matrix Position

The posture indicated by General Hayden combined with Manky’s predictions causes me concern for our clients. That is why I’m writing to you today.

We are in another great age of globalization where power is wielded not from large government centers but from individual non-state actors at the edges. The bad actors, whether nation states, organized criminal gangs or hacktivists steal your stuff, corrupt your stuff, hurt your network and create physical destruction. They are empowered by connectivity and are operating in the Web – the largest ungoverned space in history.

While the Internet is an enabler and can (and in many cases does) unlock the very best in people, it also enables the very worst of people.

With the rise in threats, the proliferation of devices, the increased complexity of networks and the general shortage of security professionals, there is a real threat to you and your organization. As General Hayden says: your network has already been breached and it’s now a matter of mitigating the impact of the breach.

My mission and the mission of our team is to “Help people succeed and improve their lives through the use of technology”. To this end, I am doubling down on network security for our clients in 2017. The threat is too insidious and too dangerous to ignore. I urge you to take the action needed to continuously secure your network. We are.

In the face of the coming threats, it’s the only reasonable course of action, and necessary to preserve our businesses, and our way of life.

I wish you all a happy, prosperous and very, very secure 2017.

Nathan Stallings

President, Matrix Integration