recommended reading

Why Machine Learning Will Help Improve Government Cybersecurity in 2017

PureSolution/Shutterstock.com

ARCHIVES

By Haiyan Song December 27, 2016

recent posts

Haiyan Song is senior vice president of security markets at Splunk.

Email security, ransomware, insider threats and state-sponsored attacks have been headline news for the past year. Cybersecurity, which is generally viewed as bipartisan issue, has officially made it into the mainstream consciousness as a result.

And while it’s certainly never good to see news that another breach occurred, one positive outcome has been increasing conversations about the cyber-oriented world in which we all live and work, and the serious security challenges private-sector and government organizations face going forward.

» Get the best federal technology news and ideas delivered right to your inbox. Sign up here.

These discussions are happening now and part of the focus needs to be on the future of cybersecurity, and identifying what’s on the horizon so organizations from every business sector can prepare. Below are some security predictions for 2017 that will undoubtedly affect both industry and government operations moving forward.

The internet is a critical infrastructure: Distributed denial-of-service attacks—like the Mirai botnet powered—on Dyn have shown us the foundation of our connected world, the internet, is tremendously vulnerable. As such, the internet must be treated as a critical infrastructure.

What does this mean?

The internet must be continually monitored and well-protected from debilitating attacks. The internet needs to be more resilient. As a society, we’re as dependent on internet as electricity. This issue carries even more importance in industries like health care and the government, for which downtime could mean life or death and national security.

To ensure systems stay online at all times, we’ll see more companies start to talk about and place emphasis on understanding what they need to detect—not just preventing attacks. This shift in mentality in which detection is valued over prevention has been in the works for years, but 2017 is the year the industry finally starts to turn over a new leaf. Attacks are unavoidable, but protecting critical assets and infrastructure (like the internet) through detection-centric technology will be the pursuit of cyber security professionals.

Machine learning, behavioral analytics and adaptive response come front and center: It’s clear hackers have refined their art and are outpacing enterprise security defenses. More organizations are adopting an analytics-driven approach to security, leveraging machine learning and enabling adaptive response, which encourages automating retrieval, sharing and response in multivendor environments. In 2017, adoption of machine learning and adaptive response will increase to make further inroads against the bad guys.

Machine-learning based solutions and Runbook automation will become more mainstream in 2017 as companies seek to become smarter and faster to identify and respond to threats. An example of this is behavioral analytics, which will allow companies to apply more data and automation techniques to monitor and verify identities, API requests, machine-to-machine interactions, and signal anomalies that could be a security threat.

Machine learning built into core platforms (like SIEM) is the next evolution, allowing greater flexibility and better efficiency in threat investigations, risk management and incident response. Many government agencies are also exploring the use of machine learning, with the Defense Department leading feds in embracing this technology.

A ransomware marketplace is emerging: In 2017, we’ll see ransomware being commoditized and democratized in dark web marketplaces. This is a real threat because it shows nefarious entities and cybercrime syndicates around the world work together to establish structure and a value chain for ransomware tools, which will generate greater profits.

In effect, this marks a fast-growing underground industry on the dark web in which the makings of cyberattacks can be bought and sold, and profit reinvested to better the tools to generate even bigger returns.

To combat this, enterprises and government agencies are seeking dynamic resources for real-time intelligence that help detect ransomware threats in real-time within their security nerve center. In the meantime, companies need to identify their risk tolerance to place the highest security around their most valuable assets and enterprises needs to revisit their business continuity plans to ensure critical IT infrastructure and mission-critical data are protected from taken hostage. This approach will increasingly help stop the propagation of ransomware and enable companies to put “bodyguards” around the assets that matter most.

Internet of things will be the new favored vector of cyberattacks: Backdoors in IoT infrastructures may provide hackers a gift—millions of unprotected gateways into IT or operation technology systems. Many reports will tell you large enterprises are already facing hundreds of millions of automated attacks per day, and IoT growth is likely to increase this figure exponentially. With the attack surface both widening and deepening, OT will become a popular and well-known acronym just like IT.

The proliferation of IoT devices and its lack of maturity in security design will demand better strategy in enterprise topology, network zoning and operational intelligence to protect the enterprise. As data collection within IoT poses news challenges, we’ll see instrumentation, automation and real-time monitoring and response get a lot of attention as well.

The weaponization of information: Information on your personal desktop enables you to work—but what happens when that information is stolen?

Historically, hackers have stolen data and extorted valuable IP or personal information for one reason: monetary gain. But over the past two years, that has changed. Whether it be the Democratic National Committee hack, the Sony breach, or the more recent hack of AdultFriendFinder, hackers are weaponizing information to damage reputations and brands.

Many tools will be needed to combat rogue stealing of secrets for purely malicious reasons, with user behavior analytics technologies being a key component of the solution. Expect to see further adoption of UBA in 2017 as organizations leverage the real-time insights these technologies provide to learn who has access to their most sensitive information

JOIN THE DISCUSSION

Close [ x ] More from Nextgov
 
 

Thank you for subscribing to newsletters from Nextgov.com.
We think these reports might interest you:

  • Modernizing IT for Mission Success

    Surveying Federal and Defense Leaders on Priorities and Challenges at the Tactical Edge

    Download
  • Communicating Innovation in Federal Government

    Federal Government spending on ‘obsolete technology’ continues to increase. Supporting the twin pillars of improved digital service delivery for citizens on the one hand, and the increasingly optimized and flexible working practices for federal employees on the other, are neither easy nor inexpensive tasks. This whitepaper explores how federal agencies can leverage the value of existing agency technology assets while offering IT leaders the ability to implement the kind of employee productivity, citizen service improvements and security demanded by federal oversight.

    Download
  • Effective Ransomware Response

    This whitepaper provides an overview and understanding of ransomware and how to successfully combat it.

    Download
  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation

    Download
  • IT Transformation Trends: Flash Storage as a Strategic IT Asset

    MIT Technology Review: Flash Storage As a Strategic IT Asset For the first time in decades, IT leaders now consider all-flash storage as a strategic IT asset. IT has become a new operating model that enables self-service with high performance, density and resiliency. It also offers the self-service agility of the public cloud combined with the security, performance, and cost-effectiveness of a private cloud. Download this MIT Technology Review paper to learn more about how all-flash storage is transforming the data center.

    Download

When you download a report, your information may be shared with the underwriters of that document.