ENISA Threat Landscape - Emerging trends

From January 2019 to April 2020

Emerging trends

ENISA Threat Landscape

Overview

_What to expect

With the start of a new decade, we can expect significant changes in the way we perceive and understand cybersecurity or the security of

cyberspace. Cyberspace as defined in ISO/IEC 27032:2012 is a “complex environment resulting from the interaction of people, software and services on the Internet by means of technology devices and networks connected to it, which does not exist in any physical form”. The

protection of this complex environment will become even more challenging as we connect more people, devices, systems and run more processes and services in the network. We are also more dependent from its reliability, integrity, availability and trustworthiness to work, relate and do many of our day-to-day activities. With this growing dependency, more opportunities will arise for malicious actors to use cyberspace to manipulate, intimidate, deceive, harass and defraud individuals and organisations. The protection of individuals, business and organisations while using cyberspace will tend to shift during the next decade, from the traditional network and information security (NIS) to a wider concept including content and services.

During the last decade the ‘fourth industrial revolution' has significantly accelerated the pace of change, transforming what people do, how they do it, what skills are required, where work is performed, how work relations are structured, and how work is organised, distributed and rewarded.

Because of the current COVID-19 pandemic, we initiate the decade with a new norm and profound changes in the physical world and cyberspace. With social distancing or confinement, people will tend to

use the virtual space to communicate, relate and socialize. This new norm will introduce new challenges across the digital value-chain and in particularly, the cybersecurity industry.

During the next decade, cybersecurity risks will become harder to assess and interpret due to the growing complexity of the threat landscape, adversarial ecosystem and expansion of the attack surface.

There are too many variables to consider when making cyber risk management effective. An important factor is the technological diversity most organisations experience today. Another aspect is the sophistication of tools, tactics techniques and procedures (TTPs) used by adversaries to conduct attacks. Malicious actors are adapting and adjusting the TTPs to their victim’s environment as needed and collaborating with others to reach their goals.

Defining a risk posture, managing data, applying relevant metrics, and responding to change are obstacles to creating an effective cyber risk

governance strategy. New approaches will be required during the next decade to stay away from silo analysis and move closer to a matrixtype of interconnected factors, variables and conditions. This

constitutes a significant challenge for many organisations trying to protect their infrastructure, operations and data against stronger, better resourced and equipped adversaries.

Emerging trends

__ cybersecurity challenges

Ten

01_Dealing with systemic and complex

risks. Cyber risk is characterised by the speed and scale of its propagation as well as the potential intent of threat actors. The interconnectedness of various systems and networks enables cyber incidents to spread quickly and widely, making cyber risks harder to assess and mitigate.

02_Widespread of adversarial AI detection.

The detection of threats exploiting AI to launch an attack or avoid detection will constitute a major challenge for the future of cyber defence systems.

Reduction of unintentional errors With 03_ .

the growing number of systems and devices connected to the network, unintentional errors continues to be one of the most exploited vulnerability in cybersecurity incidents. New solutions aiming at the reduction of these errors will provide an important contribution to reducing the number of incidents.

Supply chain and third party threats. The 04_

diversified supply chain that characterizes the technology industry today provides new opportunities for threat actors to take advantage of these complex systems and exploit the multiple vulnerabilities introduced by a heterogeneous ecosystem of third party providers.

05_Security orchestration and automation.

Cyber threat intelligence and behavioural analytics will gain importance with the automation of processes and analysis. Investing in automation and orchestration will allow cybersecurity professionals to invest in the design of more robust cybersecurity strategies.

Reduction of false positives. This long waited 06_

promise is key in the future of the cybersecurity industry and in the fight against the alarm fatigue.

Zero-trust security strategies. With an 07_

increasing pressure on IT systems from new business requirements such as remote working, digitalization of the business model and data sprawl, zero trust is seen by many decision makers as the solution de facto to secure corporate assets.

Enterprise cloud migration errors. With 08_

many businesses migrating their data to cloud-based solutions, the number of configuration errors will increase exposing data to a potential breach. Cloud service providers will address the issue by implementing systems that identify these type of errors automatically.

Hybrid threats. New modus operandi adopt virtual

09_

and physical world threats. The spread of disinformation or fake news for example, is a key fixture of the hybrid threat landscape. The EUvsDisinfo is a flagship project of the European External Action Service’s East StratCom Task Force established to address the disinformation threat.

10_The attractiveness of the cloud infrastructure as a target will grow. The

increasing reliance on public cloud infrastructure will surge the risk of outages. Misconfiguration of cloud resources is still the number one cause for cloud attacks, but attacks aiming directly at the cloud services providers gaining popularity among hackers.

Emerging trends

_ Cybersecurity spending

According to Gartner , many boards of directors will demand improved data and understanding of the returns after years of intensive investment in cybersecurity. This is mainly due to a growing spend in cybersecurity proportionately to the investment made in new technologies. According to a report from IDC , spending on cybersecurity reached $103 billion (ca. €87,5 billion) in 2019, which is 9.4% higher than the previous year. Security managers will soon be scrutinised for the results obtained from years of investment and are essential to maintain improved data about the results obtained.

_ Cyber threat intelligence will help defining cybersecurity strategies _ Knowing the threat landscape

With more cybersecurity automation and orchestration seen as a growing

trend, cybersecurity teams will spend less time in monitoring activities and more in readiness and preparedness tasks. A well-

designed CTI capability can provide contextualised and actionable knowledge about threats to inform strategic, operational and tactical stakeholders across the organisation. In practical terms, a CTI capability should aim at responding to the following questions considering the stakeholders’ requirements and the organisation’s context and environment:  What is the attack surface?  What are the most valuable assets and the cyber terrain?  What are the most critical vulnerabilities?  What are the most used attack vectors?  How adversaries typically behave and operate?  How does the threat landscape looks like for:  the sector and type of business the organisation operates?  the technological environment adopted by the organisation?  Who and what needs to be done to mitigate risks from these threats?

_ Shortage in cybersecurity skills

The lack of highly-skilled tech professionals is already issue for Europe’s digitalisation ambition. According to a study , over 70% of European firms report that lack of skills is hampering their investment strategies, while 46% of firms report difficulties in filling vacancies due to skills shortages in key areas such cybersecurity.

Emerging trends

__ trends with cyber

Five

threats 01_Malware is getting an upgrade. Malware family strains are Threats will become fully mobile. Users are increasingly 02_ 03_Attackers are using new file types such as disc image files (ISO and IMG) for spreading malware. DOC, 04_Increase in targeted and coordinated ransomware 05_Credential-stuffing attacks will widespread. “During the next decade, cybersecurity risks will become harder to assess and interpret due to the growing complexity of the threat landscape, adversarial ecosystem and expansion of the attack surface.”

Emerging trends

__Ten emerging trends in attack vectors

01_Attacks will be massively distributed with a short

duration and a wider impact

02_Finely targeted and persistent attacks will be

meticulously planned with well-defined and long-term objectives

03_Malicious actors will use digital platforms in targeted

attacks

04_ The exploitation of business processes will increase

05_ The attack surface will continue expanding

06_Teleworking will be exploited through home devices

07_Attackers will come better prepared

08_Obfuscation techniques will sophisticate

09_ The automated exploitation of unpatched systems and

discontinued applications will increase

Cyber threats are moving to the edge

10_

References Related

ENISA Threat Landscape Report The year in review ENISA Threat Landscape Report List of Top 15 Threats ENISA Threat Landscape Report Research topics ENISA Threat Landscape Report Main incidents in the EU and worldwide ENISA Threat Landscape Report Sectoral and thematic threat analysis ENISA Threat Landscape Report Cyber Threat Intelligence overview

RelatedOther publications

Advancing Software Security in the EU ENISA good practices for security of Smart Cars Good Practices for Security of IoT - Secure Software Development Lifecycle “The threat landscape is becoming extremely difficult to map. Not only attackers are developing new techniques to evade security systems, but threats are growing in complexity and precision in targeted attacks.”

About

_ The agency

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found at www.enisa.europa.eu.

Contributors

Christos Douligeris, Omid Raghimi, Marco Barros Lourenço (ENISA), Louis Marinos (ENISA) and all members of the ENISA CTI Stakeholders Group: Andreas Sfakianakis, Christian Doerr, Jart Armin, Marco Riccardi, Mees Wim, Neil Thaker, Pasquale Stirparo, Paul Samwel, Pierluigi Paganini, Shin Adachi, Stavros Lingris (CERT EU) and Thomas Hemker.

Editors

Marco Barros Lourenço (ENISA) and Louis Marinos (ENISA).

Contact

For queries on this paper, please use enisa.threat.information@enisa.europa.eu. For media enquiries about this paper, please use press@enisa.europa.eu.

Legal notice

Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the Regulation (EU) No 526/2013. This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

Copyright Notice

© European Union Agency for Cybersecurity (ENISA), 2020 Reproduction is authorised provided the source is acknowledged. Copyright for the image on the cover: © Wedia. For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

ISBN: 978-92-9204-354-4 DOI: 10.2824/552242