Top Security Issues in 2021

IT security issues are evolving. Threats that plagued cyberspace ten years ago differ greatly from today’s challenges. Looking ahead, we’ll continue to see shifts in emerging threats and transforming security issues.

Join us as we take stock of current IT threats and follow projections to explore top security issues in 2021. We’ll look at trending incidents as well as the initial vectors through which attacks most commonly occur. In looking at data points from 2020, we have insight into the current threat landscape. We’ll then extrapolate based on year-over-year trends, examine AI predictions, and hear from industry experts across the globe in order to better understand emerging security issues for 2021 and beyond. We'll also discuss how technology like DNS security can help mitigate these trending security issues.

Current Security Issues: What does the threat landscape look like now?

In 2020, as in years past, ransomware reigned supreme. Data theft, covert surveillance through unauthorized server access, and insider threats accounted for most other security breaches.

Ransomware

According to IBM’s X-Force Threat Intelligence Index 2021 report, 6 out of every 10 companies experienced a ransomware attack in 2020. This type of cyber attack surged by over 150 percent compared to the previous year, which suggests that threat actors are finding ransomware to be more profitable than other avenues. Not only did organizations see an increase in frequency of ransomware attacks, but the average extortion amount nearly doubled. Also doubling was the amount of downtime companies reported experiencing as a result of the incidents.

Cybercriminals perpetrated most ransomware attacks by phishing, stealing credentials, or exploiting vulnerabilities to enable remote desktop protocol. The most commonly targeted industries in 2020 included manufacturing, professional services, and wholesale. There was even a joint advisory by CISA, the FBI, and HHS about hospital ransomware attacks.

Experts suggest that these organizations suffered higher frequencies of ransomware attacks in 2020 because, especially during the height of the pandemic, these industries had a low tolerance for downtime—and threat actors exploited this.

Data Theft

Similar to ransomware, data theft saw a significant increase in 2020 compared to the previous year. According to IBM’s threat report, data theft grew by 160 percent. The three most susceptible industries for this type of attack were manufacturing, energy, and finance. Combined, these sectors accounted for 71 percent of all data theft incidents for 2020.

Server Access

Though ransomware accounted for the largest share of incidents in 2020, server access saw the largest increase in activity. In just a year, unauthorized server access grew a staggering 233 percent.

Other Security Issues in 2020

Organizations faced several other cybersecurity issues in the past year, most notably business email compromise (BEC), remote access trojans (RAT), insider threats, and misconfiguration. 

Trending Threat Vectors: How are cybercriminals penetrating defenses?

We’ve addressed the top security issues that organizations have faced last year, so let’s take a look at how cybercriminals managed to get past security defenses in 2020. 

In examining the data, it’s clear that phishing isn’t going anywhere. In fact, threat actors are increasingly turning to phishing scams in order to penetrate private networks. Back in 2019, phishing attacks were responsible for 31 percent of all cyber incidents. By 2020, that number grew to 33 percent, signifying that fully one in three security breaches can be attributed to phishing.

Which industries are being targeted?

Last year, in large part due to the pandemic, there was a considerable shake-up in the industries being targeted by cybercriminals. In 2020, finance and insurance led the industries as the most-attacked sector. This is nothing new: the financial industry has held this position for five years in a row. More interestingly, manufacturing and energy saw a significant shift. In 2020, manufacturing was the second-most attacked industry, whereas only a year prior it was ranked eighth. This massive leap was, according to experts, driven by the growing interest in operational technology by threat actors. Healthcare also saw a spike in targeted attacks, many of which were COVID-related. Transportation and retail saw a considerable decline, which can also be attributed to the effects of the pandemic.

It appears that 2021 will have a similar shake-up. Global recessions, drastic shifts in consumer behavior, and uncertainty are expected to push cybercriminals into different industries. Mining, transportation, construction, and energy are predicted to be key targets moving forward.

The emerging trends—whether it be industry targets, attack vectors, or security issues — are evolving. We’ve taken a look at the current threat landscape, so let’s set our sights into 2021 and beyond.

Emerging Security Issues in 2021

Looking ahead, we’ll see continued pandemic fallout, push for consolidation, and more trust in zero-trust framework.

The Pandemic Effect

COVID-19 has permanently changed the way in which we conduct business. The pandemic has led to an unprecedented surge in remote work and digital acceleration, and we’re seeing that cybersecurity teams are increasingly responsible for securing digital assets outside of traditional infrastructure. IT security that worked before the pandemic no longer fully protects this new workspace. An upended business landscape means similarly upended security issues and cyber threats. Cybersecurity methods that have served well in previous years won’t necessarily protect you today.

Digital acceleration—ushered in by an explosion in remote work, but also by geopolitical shifts, new supply chain stressors, and continued cloud adoption—requires flexible and scalable security options, such as DNS protection, multi-factor authentication, and data encryption. Organizations must reexamine their existing cybersecurity solutions because the risk surface has exploded and expanded in the past year. Threat actors are consistently adapting to global events and emerging technologies, making it necessary for businesses to do the same.

Push for Consolidation

Many organizations are reaching a tipping point as they increase their digital footprint. For one, companies have too many vendors. The risk surface grows with every new application, business tool, and vendor that organizations add to their portfolio. Add to that the growing number of personal devices and private networks resulting (in large part) from remote workers and it’s safe to say that organizations are experiencing an astronomical expansion of their digital footprint.

It’s not just business vendors, either. A 2020 CISO survey conducted by Gartner reported that 78 percent of CISOs have 16 or more tools in their cybersecurity vendor portfolio. Twelve  percent of respondents admitted to having 46 or more vendors. Having too many tools contributes to a proliferation of endpoints, increased risk, and ultimately results in complex operations and reduced insight. In the same Gartner survey, 80 percent of organizations expressed a desire to consolidate their vendors. Looking ahead, the best cybersecurity solutions will be those that are flexible and can be deployed across all devices and networks.

Many organizations are turning to lightweight, powerful services (such as DNS filtering security) that can protect users from ransomware, phishing, malware, and a host of other threats. Highly-specialized tools that only focus on a single security issue aren’t cutting it in 2021. 

More Trust in Zero-Trust Framework

Moving forward, we’ll see organizations placing more trust in zero-trust solutions. Risk grows as the number of employees working outside of the office increases and as the number of personal devices are added to a company’s network. How can one’s IT security team monitor and protect an ever-expanding risk surface? The best solution is to implement a zero-trust solution, like DNS filtering, that essentially creates a protective perimeter around specific applications. 

In their Global DNS Threat Report, EfficientIP and IDC revealed that in the past year, 31 percent of organizations implemented zero-trust strategies, up from 17 percent in 2019. This number is expected to rise considerably in 2021. Gartner predicts that in the next two years, 60 percent of organizations will replace VPNs in favor of zero-trust solutions.

Conclusion

Last year marked a seismic shift in the way the world does business. Digital acceleration (and the resulting digital risk surface) has led to an explosion of vulnerabilities. While many cybersecurity trends are carrying on as expected, others have emerged as new threats as a result of a tumultuous year. As we set our sights on the future, one thing is consistently true: in order to outpace threat actors, IT teams need to invest in agile, scalable cybersecurity solutions.