ExtraHop, the leader in cloud-native network detection and response, announced its top predictions for the cybersecurity and technology industries in 2020. Informed by insight from customers, partners and industry analysts and insiders, ExtraHop leaders predict a year of tool consolidation, headline-grabbing breaches and a shifting industry focus on what makes a successful tech start-up.

The Year of Deeper Scrutiny for Fast-Growth Companies: “2019 was a tough year for heavily hyped, fast-growth companies going public in Silicon Valley. Several companies that raised huge rounds ultimately failed to deliver expected results or even approach profitability after they went public, and Wall Street was not amused. In 2020, we expect the investment community to more deeply scrutinise companies' financials and business fundamentals, ultimately leading to the support of companies who deliver on their promises, are capital-efficient with sound vision and innovation, and have truly sustainable business results and models to back them up.” - Arif Kareem, CEO

File hashing has been the default mechanism for detecting malicious threat activity"

Antiquated Threat Detection Methods like File Hashing and Signature-Based IDS Waste Time: “Since the 1990s, file hashing has been the default mechanism for detecting malicious threat activity, despite the fact that it's ineffective against modern attacks that use polymorphic or fileless methods to go undetected. The same goes for signature-based IDS, which are extremely noisy while providing very little actual alert context. Security teams will continue to rely on these antiquated methods of detection because they are expected to, regardless of how well they work in today's threat landscape.” - Jesse Rothstein, CTO and co-founder

Accountability for the Ethical Use of Users’ Data: “Recent headlines tell of giant data corporations like Google and Facebook monetising users' data and lacking sufficient transparency in these activities. There’s already been significant social backlash, but in 2020 we predict that users will demand companies not just follow the often-dated laws, but that they also do what’s right. Regulations like GDPR and CCPA are helping to bring more clarity around what’s appropriate, but 2020 will be the year that the industry is held accountable for the ethical, in addition to regulatory-compliant, use of personal data.” - Raja Mukerji, CCO and co-founder

A Slowing Economy Will Force Tool Consolidation: “In security programs, it's been very difficult to turn tools off. What gaps will I create? What unintended consequences will I see? As the economy has rolled along over the last decade, most security programs have had the necessary funding to add new tools and retain legacy tools under the guise of risk management. Economic slowdown is likely to change all of that, as investments in new technology will require cost savings elsewhere. A tighter economy will finally cause us to pull the plug on legacy security tools.” - Bill Ruckelshaus, CFO

A tighter economy will finally cause us to pull the plug on legacy security tools""Observability" Will Gain Ground as Both a Concept and a Vocabulary Term in Security and DevOps: “Observability is a term that several companies are using to describe the practice of capturing metrics, logs and wire telemetry, or sometimes other data sources, mostly in the DevOps space. The value of correlating insights from these data sources has gained enough ground that vendors need a word for it.

Observability, The SOC Visibility Triad, and other terms have been spotted in marketing materials and on big screens and main stages at security and analytics conferences. In 2020, we'll see heated competition to control the vocabulary and mental models that enterprises and vendors use to discuss and market security best practices regarding gathering multiple data sources and correlating insights between them.”- John Matthews, CIO

A Major Information Leak from a Cloud Provider is Coming: “In 2020, we are likely to see a major information leak from a cloud provider. While at the same time the cloud providers are providing many useful built-in tools, it's not clear that they are using their own tools to secure themselves. As a further prediction, the leak will not effectively diminish migration to the cloud. As we have noticed with other breaches, they do not significantly erode confidence in the services.” - Jeff Costlow, CISO

2020 may well be the year that a breach of a vendor’s environment exposes the data of one or more of their customers"

The Wave Begins Towards Security Tool Consolidation: “Organisations will take a strong look at the number of security vendors within their ecosystem in 2020 to determine overlap and begin a move towards consolidation of tools. The winners will include those that have proven their API superiority and ability to work together within an organisation’s ecosystem. The losers will be those who have not proven their ability to strengthen core security.” - Chris Lehman, SVP of Worldwide Sales

A Vendor Will Be Responsible for a Major Breach of Data Due to Phoning Home: “In 2019, ExtraHop issued a security advisory about the vendor practice of phoning data home and how this is happening without the knowledge of customers. The problem with this practice is that it expands the attack surface via which that data can be breached, exposing it to threats within the vendor’s environment. 2020 may well be the year that a breach of a vendor’s environment exposes the data of one or more of their customers. Regulations like GDPR have imagined exactly this type of scenario and laid out specific requirements for data controllers and data processors. But when such a breach occurs, it will have broad impact and implications.” - Matt Cauthorn, VP Security

The Big IoT Breach is Coming: “In 2017, major ransomware attacks crippled the networks, and operations, of major global organisations. While those attacks did billions in damage, for the most part, IoT devices were left unscathed. But sooner or later, and probably sooner, the big IoT breach is coming, and it could have global implications. Whether it happens in the US or abroad, in healthcare, shipping and logistics, or manufacturing, IoT devices around the globe are fertile hunting grounds for attackers. Taking down every connected device, from telemetry sensors to infusion pumps to mobile points-of-sale, could easily grind operations to a halt.” - Mike Campfield, VP of Global Security Programs

Share with LinkedIn Share with Twitter Share with Facebook Share with Facebook
Download PDF version Download PDF version

In case you missed it

What is the role of higher education to create next-gen security leaders?
What is the role of higher education to create next-gen security leaders?

Traditionally, security industry professionals have often come from backgrounds in law enforcement or the military. However, the industry is changing, and today’s security professionals can benefit from a variety of backgrounds and educational disciplines. The industry’s emphasis on technology solutions suggests a need for more students of computer science, engineering and other technology fields. The closer integration of security with related disciplines within the enterprise suggests a need to prepare through a broad array of educational pursuits. We asked this week’s Expert Panel Roundtable: What is the role of higher education to create the next generation of physical security leaders?

Transport security: utilising the cloud to manage passenger flow and improve health & safety
Transport security: utilising the cloud to manage passenger flow and improve health & safety

Throughout the COVID-19 pandemic, ensuring the safety of passengers and staff aboard public transport has been an ongoing concern. The scenes of underground trains, still packed with commuters as infection rates soared, will have raised alarm bells with bus and train managers, transport officials and government representatives alike. Now, as infection rates hold steady and people slowly return to the workplace, a rise in commuter levels, coupled with a need for strong infection control protocols, is putting a strain on an already overburdened transport system. Managing passenger flow through bus terminals and train stations, while ensuring adherence to social distancing and mask-wearing policies, can be a difficult task. On buses and trains, staff have the unenviable task of challenging any individual who flouts the rules, while attempting to maintain safe operation for the benefit of all passengers. This is where advances in digital surveillance technologies can play an important role in enhancing security, improving operations and supporting the customer facing teams in their day to day roles.  The power of the cloud Keeping businesses afloat and people connected throughout the pandemicCloud or hosted technology has played an important part in keeping businesses afloat and people connected throughout the pandemic. When it comes to physical security such as video surveillance and access control, today’s cloud-enabled systems are far removed from the outdated CCTV and manual access control technologies employed in the past. Cloud connectivity brings with it many benefits, from a security, operational and also business intelligence point of view, thanks to the powerful data that these solutions produce which can be used to inform decision making. The advantages of cloud-based physical security technologies are many, and have wide ranging applications for all areas of the transport sector; across stations, transport hubs and vehicles. When used to support staff and complement existing processes, such systems can prove invaluable for transport professionals in helping to create a safer working environment, promoting confidence among personnel and passengers, and assuring passengers who are fearful about the current pandemic that all possible precautions are being taken during their journey. Managing occupancy across bus and rail Monitoring the movement of staff and passengers is an essential part of being able to maintain a safe operation. Through the utilisation of surveillance cameras at entrances and exit points, as well as at key areas within transport terminals and on the transport mode itself, occupancy thresholds can be determined to ensure passenger numbers do not exceed safe limits. Network surveillance cameras, accessed via mobile device, can enable transport officials to check passenger flow in real-time, while live alerts to warn that health and safety protocols are being breached, enable swift drafting of security or operations personnel to address the situation. Live alerts to warn that health and safety protocols are being breached Through internet of things (IoT) connectivity, additional devices can be easily added to complement the surveillance solution and unlock further benefits. Network audio speakers can be triggered to play pre-recorded messages to alert or inform passengers. Similarly, frictionless access control, enabling customers and staff to move ‘hands-free’ through gateways and ticket checkpoints to avoid viral spread, is made possible by having an access reader which is activated, for example, via QR codes on a mobile phone. And when access readers are integrated with surveillance cameras, this will act as a second layer of authentication to grant or refuse access based on valid staff credentials. Improving security in challenging times Such technologies, interconnected and able to share data, can be used to more effectively report in real time on activity that threatens to have an adverse effect on passengers, staff and the transport environment. Significant parts of the rail network are relatively unmonitored, and inevitably these areas are more vulnerable to vandalism. Similarly, on bus services, abuse of passengers and staff, and acts of criminal behaviour remain a concern. By alerting security staff to a developing situation before it occurs, an incident can be dealt with quickly, minimising disruption to transport services. Cloud based technology can be relied on Cloud based technology can be relied on to not only help improve current services, around passenger occupancy in the current pandemic, but also to help transport officials plan for the security challenges of the future. Simple customisation and easy scalability, plus software upgrades and firmware updates to ensure the system is always up to date and operational, form essential components of a future proof solution which is capable of bringing peace of mind to the transport industry. Additionally, predicted future benefits include the potential for customers to check transport occupancy levels via a mobile app. This would inform them of particularly busy times of passenger transit, allowing more choice over when and where to travel based on real-time data, and ultimately helping to even out passenger numbers to balance journeys and greatly improve efficiency and flow. In a busy world where the demands on our rail and bus networks are now impacted by the COVID-19 pandemic, and indeed the possibility for further related challenges in the future, such cloud-connected technologies represent a worthwhile investment.

In a cybersecurity 'wild west', look for the sheriffs!
In a cybersecurity 'wild west', look for the sheriffs!

As the media often reports, the world of cybersecurity can be seen like the ‘Wild West’. There’s now a wide range of Internet of Things (IoT) devices connected to the web, making this a hot topic. Among these devices are security cameras. IoT devices are computers that use software that makes them vulnerable. As the famous cybersecurity evangelist Mikko Hypponen says, "If a device is smart, it's vulnerable!" Hypponen is right. On a daily basis, new vulnerabilities are found in software, regardless of the manufacturer. In 2019, more than 12,000 vulnerabilities worldwide were made public and reported as a CVE (Common Vulnerability and Exposure) in the National Vulnerability Database (NVD). Unfortunately, vulnerabilities are a given. What really matters is how a company deals with and resolves vulnerabilities. Cybersecurity vulnerabilities Awareness of cybersecurity vulnerabilities is vitally important Awareness of cybersecurity vulnerabilities is vitally important to protect you, your business and the Internet, but it’s also important to understand that a vulnerability is not synonymous with “backdoor”, and is not necessarily indicative of “cheap quality.” But there are companies out there that are embedding safeguards into their development processes to reduce the risks. You could see them as ‘Sheriffs’, taking steps to make this Wild West a little safer.   Why Hikvision chooses ‘Secure-by-Design’ Security cameras, like all other IoT devices, are vulnerable to cyberattacks. Fortunately, manufacturers of IoT devices can significantly reduce these vulnerabilities during the production of devices, using a process called ‘Secure-by-Design’. Implementation of Secure-by-Design requires a commitment on the part of the manufacturer’s management team and a serious investment in resources and technology, which can result in a longer production process and a higher cost of the IoT device. Cost is often the reason why some IoT device manufacturers do not use Secure-by-Design (and are indeed cheaper).  Hikvision is a producer of IoT devices that takes security and privacy very seriously and has implemented Secure-by-Design in its production process. Management supports this process and has even set up a dedicated internal cybersecurity structure charged with product cybersecurity. This group is also the central point of contact for all other cybersecurity matters. The Hikvision Security Development Life Cycle (HSDLC) is an essential part of Hikvision's cybersecurity program. Cybersecurity checks take place at every stage of product development — from concept to delivery. Cybersecurity checks take place at every stage of product development For example, product testing takes place during the verification phase, the company also regularly invites well-known security companies and public testing platforms to conduct penetrating testing. Does this mean that all Hikvision products are immune to hacking? No, that guarantee cannot be given, but the HSDLC is a testament to a manufacturer that makes every effort to produce products that are as cyber secure as possible.  Source code transparcency centre In addition to the Secure-by-Design process, Hikvision opened a Source Code Transparency Center (SCTC) lab in California in 2018, being the industry’s first-of-its-kind lab to open such a centre. At this centre, U.S., Canadian government and law enforcement agencies can view and evaluate the source code of Hikvision IoT devices (IP cameras and network video recorders). It’s important to emphasise that no product is 100 percent secure. Hikvision has a Vulnerability Management Program in place when a vulnerability is discovered in a product. To date, vulnerabilities that have been reported to Hikvision and/or made publicly known, have been patched in the latest Hikvision firmware, and are readily available on the Hikvision website. In addition, Hikvision is a CVE CNA, and has committed to continuing to work with third-party white-hat hackers and security researchers, to find, patch and publicly release updates to products in a timely manner. These vulnerabilities are collected in the National Vulnerability Database (NVD) and are public. Hikvision recommends that customers who are interested in purchasing security cameras inquire about a manufacturer’s cybersecurity practices and if they have an established Vulnerability Management Program.    Cybersecurity questions to consider  The cybersecurity of IoT devices is a topic that needs to be addressed in a serious way and it should play an essential role in the product development process, beginning at the concept phase of an IoT product. This requires time, investment and knowledge.  Consider the following questions: Do I trust the manufacturer of a low-cost security camera? Does this manufacturer have a dedicated cybersecurity organisation? How does this manufacturer handle vulnerabilities?   These are the questions that everyone should ask themselves when making a purchase, be it a camera or any other IoT product.  There is no absolute 100% guarantee of security, but Hikvision has industry-leading practices to ensure the cybersecurity for its cameras. Cooperation, with its customers, installers, distributers and partners, and full transparency are key elements to successfully secure IoT devices. When you read cybersecurity news, we invite you to look beyond the headlines, and really get to know the companies that produce the IoT devices. Before you buy a security camera or any IoT device, check out the manufacturer’s cybersecurity practices, look for a company with a robust vulnerability management program, a company that aligns itself with Secure-by-Design and Privacy-by-Design and a company that employs cybersecurity professionals who are ready and eager to answer your questions. Remember, there are Sheriffs out there, as well as bandits.