Let’s face it, 2020 was a rough year for predictions. But as we near a new year, I’m emboldened to take a stab at what 2021 holds for us in the cyber security world. I see two main drivers: The emergence of 5G and the continued impact COVID-19 is having on businesses. From these drivers, I see many important developments we’ll need to watch in the coming months.
5G achieves lift-off, and that changes things
We’ve all been talking about 5G for years now, but the inclusion of 5G support in the latest Apple iPhones show that 2021 will be the year that 5G finally lifts off. Gartner forecasted 5G infrastructure spending to top $4.2B in 2020. And while speeds of early networks are not expected to reach 5G’s eventual capability, they are impressive nonetheless. Verizon customers are experiencing nearly 800 Mbits/second on average, which represents a roughly 5X improvement over the typical fixed broadband speeds in the US. That means 5G often represents a more viable transport for enterprise networks than traditional fixed broadband.
That’s a big deal for business. First, there will be a lot of 5G endpoints—IDC predicts a billion new 5G devices in the next three years. And while many of these will be phones and tablets used by remote workers, a lot of these will also be IoT devices within enterprises.
A cellular network chock full of IoT devices presents challenges for security managers. First, nearly all IoT traffic today is transmitted unencrypted, making it low-hanging fruit for bad actors. In addition, most IoT devices are poorly maintained from a patching and safeguard perspective, and analysts tell us 57 percent are vulnerable to medium- or high-severity attacks.
There’s more. 5G networks will facilitate the shift within business to building networks outside the corporate firewall. On its face, this presents a challenge, but a lack of visibility within 5G networks will exacerbate this.
Security challenges of the COVID-19 pandemic new normal network
As we near the one-year anniversary of the introduction of COVID-19, we’re all familiar with the stunning changes in the workplace. Analysts tell us 74 percent of business workers are working from home during the pandemic. As vaccines start to come online, that will undoubtedly drop off, but there is a growing consensus that work-from-home will remain with us going forward. Some estimates show that 42 percent of workers will continue working from home, and Gartner predicts that most businesses will support work-from-home, even after the pandemic is over.
A related shift is that businesses have accelerated their move to becoming cloud-first. In fact, 95 percent moved key applications to cloud and SaaS footings this year in response to the work-from-home push.
There is a reason that these two shifts are here to stay. What businesses (and employees) have learned during the pandemic is that working from home is actually a productivity enhancer, not a detractor. But only if businesses can adequately address security issues. And, as it turns out, these trends have a huge impact on security in a variety of ways:
- Visibility issues: A distributed, hybrid, and multi-cloud, SaaS-driven network is far more difficult to gain visibility into than the traditional corporate, inside the perimeter network.
- Consumer-grade last-mile equipment: The typical IT professional is used to configuring enterprise-class networking gear from industry heavyweights such as Cisco. They are used to a rich set of security features to help secure the workplace. Overnight that has changed to a world of cheap routers and hubs targeted at unsophisticated consumers.
- Change = Risk: When three-quarters of their business users headed home in March, IT was faced with having to make massive changes to firewall and VPN rules. Any mistakes or omissions create vulnerabilities for bad actors.
- New technology = Risk: Similarly, all the new work from home (WFH) technology IT needed to onboard quickly (such as Zoom) comes with a sizeable risk of misconfiguration and inadvertent vulnerabilities.
- Overtaxed VPN creates opportunity for unprotected users: In most cases, it is up to the user to use IT-approved network access protocols that have security baked into them. But when these network routes are saturated, users easily become frustrated. The temptation to forgo these safeguards and connect directly to cloud and SaaS resources creates a huge vulnerability for businesses.
- No IT footprint: And that brings us to one of the most crucial security gaps today. In most cases, there is zero IT footprint where business users are getting work done. This further complicates visibility and security compliance.
- Bad actors targeting WFH employees: For all the above reasons, bad actors are zeroing in on WFH business employees. They have changed their strategy from looking for ways to break into the network into ways to steal user credentials. Privileged access abuse allows bad actors to gain access to valuable assets, virtually undetected. Their exploits look almost indistinguishable from legitimate business activities.
There is one more impact we expect COVID-19 WFH activities to have: An expansion of compliance and risk management activity. As business leaders become aware of the increased level of security risk they face, they will mandate action from their internal risk mitigation teams.
Brave new world
2020 has caused more change than most workers have seen in their entire careers. But it has also taught us that businesses are resilient and can adapt to just about anything. Furthermore, the pandemic has forced remote working models upon business, and in hindsight, that’s a good thing.
But the challenge remains. Businesses must adapt their security practices, so they can take advantage of the benefits of work-from-home models without creating extra risks.
John Nellen is CEO of Todyl.