The New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) has revealed its predictions for the cyber threat landscape in 2020.
According to a post, the NJCCIC says we are likely to see the following threats in 2020:
Election Security: Voting machines and voter databases could be targeted in the 2020 US presidential primaries and general election. Threat actors may intend to create voting havoc, spread disinformation, generate voter-fraud alerts and interrupt or manipulate vote submissions.
Social Engineering: Social engineering tactics will continue to become more sophisticated in order to convince users to open malicious documents or click on links directed to spoofed websites. Credentials for cloud-based productivity and collaboration software are likely targets. Malicious actors may use URL shorteners, password-protected files, traffic distribution systems and other obfuscation techniques to hide payloads from security protection systems.
Cloud Services: Organizations continue to move their servers and data to the cloud to reduce operating costs and increase throughput, reliability, and availability; therefore, cloud service providers are high-value targets. Security protections and controls must be implemented to safeguard client networks and limit the impact of a malware infection, such as ransomware.
Ransomware: Ransomware attacks will continue to greatly impact critical businesses and organizations that depend on availability, including state and local governments, healthcare institutions, industrial control systems, cloud services, and managed service providers and their clients. Attacks will be more sophisticated and targeted, and extortion tactics will be used to maximize ransom profits.
Supply Chains: There will be continued targeting of supply chain vendors and clients via spear-phishing campaigns, business email compromise (BEC) scams, and compromised vendor accounts – particularly to launch ransomware attacks. Organizations are advised to adopt a vendor management program and implement security protections and controls, including DMARC to help prevent email spoofing.
Artificial Intelligence (AI): Malicious actors may use AI in order to learn about its targets and their environment to then automate tailored attacks. Impersonation scams can imitate the writing style of known and trusted contacts to reduce suspicion when used in email or SMS text-based attacks. However, organizations can also use AI to defend their networks by quickly identifying and analyzing potential attacks.
The NJCCIC recommends users practice good cyber hygiene including keeping hardware and software up-to-date, using strong and unique passwords, enabling multi-factor authentication where available, running an updated anti-malware/anti-virus program, and keeping offline data backups. Additionally, they advise users to maintain awareness of current and emerging threats, and to review and apply the recommendations in the NJCCIC Cybersecurity Best Practices guide to become more resilient to cyber threats.
