How well companies and large organizations can ensure the security of data and IT in the digital economy is increasingly a critical factor for their success or failure, according to a new report from TÜV Rheinland.
TÜV Rheinland—a leading international provider of testing, inspection, and certification services— Cybersecurity Trends 2019 report acts as an annual forecast of cybersecurity trends, gathered from its world leading cybersecurity experts in Europe, Asia, and North America.
According to the latest report, companies are increasingly recognizing cyberattacks as a central business risk and are beginning to align their organization accordingly. Cybersecurity trends also focus on how strongly cybercrime influences technologies such as Operational Technology (OT) in industry and the Internet of Things (IoT), why skills shortages could become a growing problem, and what role concepts such as red teaming or agile security are likely to play.
TÜV Rheinland Executive Vice President for Digital Transformation & Cybersecurity Frank Luzsicza said the modern world is rapidly transforming into a digital, knowledge-based “Industry 4.0” economy.
“This change has an equal significance to the industrial revolution,” Luzsicza said. “That’s why the existential question for many companies will be about mastering the cyber-physical challenges of the digital economy. It may simply amount to a binary—success or failure, without the option to compromise”
Below are the highlights of the eight cybersecurity trends that TÜV Rheinland has identified for 2019.
Trend 1: Cybersecurity has become a topic for the management level
Until recently, lack of cybersecurity was not seen as a business risk, but as an IT problem. The effects of the NotPetya cyberattack in 2017 changed this view, with several large companies reporting losses as a result of the attack. These companies reportedly each lost up to hundreds of millions of euros. This makes NotPetya the most expensive cyberattack to date.
Breaches of data protection also remain a cause for concern. Risks associated with a lack of cybersecurity have evolved from a hypothetical problem to a recognized business risk. This realization is now leading to long-term changes in the management of cybersecurity risks and the question of who is responsible for this problem.
Trend 2: Industrial cybersecurity is years behind general IT security
In an Operational Technology (OT) system, computers recognize or modify physical processes by controlling and monitoring devices such as electric motors, valves, or relays. They are used, for example, by energy and water suppliers as well as in industrial facilities. Although the lack of cybersecurity of OT systems can have serious consequences, industrial cybersecurity has long been neglected and has been characterized by indifference and under-investment. Today, the risks of neglecting OT systems protection have fundamentally changed due to new technologies and geopolitical tensions. This applies to security monitoring systems in particular. If something can become a target for attack—and we must assume that it can be done at any time—those responsible should do everything possible to prevent the success of such an attack.
Trend 3: Standards pose a challenge for IoT cybersecurity
Standards organizations and industries around the world are developing the security and privacy standards needed to secure the next stage of development in the Internet of Things (IoT) and OT. Although well intentioned, it can be confusing and time consuming for manufacturers to determine which of these regional and industry standards they need to consider. Global companies that need to understand how to ensure compliance when developing their products are particularly affected. The existence of competing standards could therefore lead to a waste of time.
Trend 4: The pressure caused by GDPR represents a turning point for consumer data protection
The European Union’s (EU) General Data Protection Regulation (GDPR)—enforced in May 2018—holds many unknowns. A few months after GDPR was implemented, a hospital in Portugal was fined 400,000 euros by the Portuguese Data Protection Authority for alleged unrestricted access to patient files and information. Although overall enforcement is relatively slow to start and the first fines imposed were rather low, it is clear that the DSGVO will have a significant impact on data protection not only in the EU, but worldwide. For most industries, it will be more cost effective to develop and design their products and services to meet the highest global standards, rather than limit themselves to geographically limited privacy.
Trend 5: The shortage of skilled workers in cybersecurity will distort the labour market
While the importance of cybersecurity has increased, the staff needed to meet the specific cybersecurity demands have not. It is estimated that by 2020, there could be a shortage of 1.5 million skilled workers worldwide. This figure could more than double by 2021. Such an extreme shortage of skilled workers often leads to market distortions—larger, financially stable organizations and service providers are able to recruit competent staff, while smaller companies may have problems in some sectors. Inevitably, this not only makes cybersecurity more expensive, but also has an economic affect on supply chains that connect large and small businesses. In terms of the long-term interests of the industrial economy, cybersecurity is of importance to the general public and should therefore be accessible to all. If this problem is not solved, there will be greater challenges in this area in the future.
Trend 6: The detection of and response to threats depends on the establishment of Security Orchestration, Automation and Response (SOAR)
The SOAR approach reduces the time required to detect incidents, accelerates threat response, and minimizes the impact of cyberattacks. The greatest added value is provided by automated threat containment workflows, which are critical in dealing with rapidly spreading malicious malware. Other benefits of SOAR include standardization of cyberattack investigation processes, faster prioritization and response, the ability to proactively search for threats, and improved quality and efficiency of detection and response processes. However, to implement a new wave of automation with SOAR, organizations must invest and plan at a time when established investments such as Security Information & Event Management (SIEM) solutions are just beginning to pay off.
Trend 7: “Red Team” tests and agile security gain general acceptance
The terms “Red Team” test and “holistic test” have origins in the penetration testing field. “Red Teams” simulate how an attacker can penetrate an organization and gain access to resources under real-world conditions by exploiting existing vulnerabilities. While vulnerabilities can be found in many resources (applications, devices, or infrastructures), “Red Teams” also simulate topics such as social engineering, hijacking social media, physical access to a building or—in extreme cases—their own employees with malicious intentions. Unlike traditional pen testing, Red Teaming tries to understand how these factors interact. At the same time, agile security testing is becoming more important. Their goal is to eliminate as many weak points as possible during software development.
Trend 8: Cybersecurity decides on winners and losers of the digital economy
The modern world is rapidly developing into a digital, knowledge-based “Industry 4.0” economy. This change has a similar meaning as the industrial revolution in the 18th century. A fundamental challenge in this process is to recognize how to ensure one’s own security, where the resources should come from, and what global standards are needed to make development as smooth as possible. The ability to meet the security challenges of the digital economy will determine the success of economies, economic sectors, and perhaps even the political systems on which they are built. It is possible that for many large organizations this will result in a simple scenario of either success or failure without a middle course.
Click here for more information about TÜV Rheinland’s Cybersecurity Trends 2019 report.