To understand the current and future state of the cybersecurity landscape we spoke to and received written responses from 50 security professionals. We asked them, "What’s the future of cybersecurity from your perspective?" The most frequent responses focused on artificial intelligence, machine learning, and automation. You can read more about the future of security in Part two.
AI, ML, and Automation
- Some of the largest investments and resources for Enterprise security exist in the network and infrastructure. With the growth of public cloud, SaaS, and mobile, the shift in security will go toward identity, data, and applications. Looking further out into the future, security vendors have not yet reaped the benefits of machine learning and AI like other industries have. It will eventually happen in security but not in the next few years.
- We are going to see more agent-based security embedded within our workload and implemented with the applications in microservices. There will be a distributed security position. Automation will help to handle changes. It will be absolutely critical to have higher intelligence to infer what challenges will come in future environments. We will need to deploy these in a very specific manner to get helpful insights.
- AI technologies hold a lot of promise for the future of cybersecurity in helping organizations become truly proactive in addressing advanced threats. While it’s nowhere near capable of replacing cybersecurity expertise at the moment, we’re making progress in terms of harnessing analytics driven by AI to process larger varieties, volumes, and velocities of data more efficiently in order to produce better insights for human operators.
- Get smarter with information. AI will be used across the board. We’re early in the game. AI will provide better contextual analysis to make better-informed decisions. A more focused approach to make security more effective.
- Increasing automation and AI is paramount for the future. The only way to combat highly automated cyber threats is to respond with intelligent software-based solutions; humans are too limited to deal with the complexities surrounding threat-detection.
- If you look at the growth of the internet from the 1970s and lay in the growth of cyber-attacks (essentially since 2010), it’s a scary graph. The attacks are increasing in frequency, scale, and effectiveness with success beyond data breaches and into debilitating ransomware.
Globally, we are increasing our reliance on the Internet of Things (IoT); nearly 26,000,000,000 devices will be connected to the internet by 2020. The cybersecurity industry is going to need to leverage AI, machine learning, and deep learning more than ever in order to automate and augment the cyber workforce. Growing skills gaps and limited talent pools (estimated 3,500,000 million unfilled positions by 2021) are stretching current cyber teams beyond their limits, leaving company frontlines more vulnerable to threats.
We will see the industry looking to AI/ML/DL to alleviate these challenges, but we must remember that new tools alone will not strengthen the company’s cybersecurity posture. We need to equally place a focus on upskilling the individuals and teams operating these new technologies in order to effectively use them to our greatest benefit.
The industry is already making strides in leveraging AI in cybersecurity products, many of which analyze user behavior and detect network anomalies. In the future, new products will leverage machine learning for log aggregation and enrichment, while the full scope of AI will provide intelligent advisors, feedback, and an AI adversary to practice against. - Cybersecurity in the next few years will be both exciting and challenging at the same time, stemming from a few different areas:
1. AI: The proliferation of technologies, such as Artificial Intelligence, will drive some of that. We expect challenges in 2019 to come in the form of bots implementing supervised learning techniques to better mimic human behavior in attacks, such as credential stuffing. Hackers aren’t the only group that will cause companies AI headaches; security vendors will increasingly be part of the problem. I predict there will be more false claims by security providers that their product uses AI, forcing organizations to be diligent in the procurement process to separate fact from fiction.
2. IoT: The threat attack surface will continue to expand as the portals to configure and control the plethora of connected devices are exposed. Hackers will increasingly be less interested in the device itself and more in what can be obtained and/or accomplished by infiltrating the control portal. One industry that showcases this vulnerability is the automotive sector, as more cities allow self-driving cars, I predict there will be a major accident as a result of a hacker taking over the controls.
3. Cloud: As more companies adopt cloud-based apps, security approaches will need to evolve to keep pace as companies can no longer rely on solutions built into the cloud environment. Flexibility is essential in this landscape, as many legacy solutions can’t provide visibility into hybrid environments. In addition to this need for adaptability, I predict the threat landscape will continue to struggle with DDoS attacks, which are expected to increase in both size and scope. That said, I do still believe passwords will remain the dominant threat vector in 2019. Although by 2025, I anticipate that passwords will be rendered obsolete and replaced by a new security standard
