Bangalore January 6 2019:  We bring you CyberSecurity predictions from leading industry experts:
Zakir Hussain, Director,  BD Software Distribution 
Ransomware lost its spot as the number one cyberthreat to consumers and enterprises during the first half of 2018, after topping the list for years. Despite being somewhat outpaced by cryptojackers, though, ransomware has made a rapid recovery, showing that file-encrypting malware is here to stay. And all signs point to a 2019 riddled with emerging new threats.
Ransomware: The most profitable form of malware, ransomware remains a constant threat. We still record copious numbers of infections daily, but the good news is ransomware is no longer growing – it’s plateauing. One reason is already well documented: ransomware has taken a back seat to cryptojacking in the past year as bad actors developed a taste for stealing computing power to generate digital currency while flying under the radar. But an even heftier factor behind ransomware’s stagnation is the emergence of dedicated solutions aimed directly at thwarting this form of malware. There will always be new versions of ransomware, some more complex than others and some harder to catch, but we don’t expect ransomware to take on much bigger proportions. At least not bigger than in the past year.
Internet of Things (IoT): We expect more attacks leveraging Internet of Things (IoT) / smart / connected devices. As lawmakers scramble to come up with a way to regulate the IoT space, attackers will continue to capitalize on their inherent weaknesses. Hackers are becoming better at hijacking IoT products like baby monitors, surveillance cams and other home appliances. And connected medical devices are far from safe either. In fact, body implants that support wireless connectivity may lead to the first ransomware attacks where you need to pay or die. Sound wild? Just remember that, in 2013, former US Vice President Dick Cheney asked his doctors to disable the wireless function in his pacemaker to thwart the potential of terrorists hacking it.
In another noteworthy trend in the IoT landscape, manufacturers are jumping on the cellular bandwagon, gradually moving their IoTs from WiFi to LTE and from ipv4 to ipv6. While this shift promises increased security, it will likely open up a new can of worms since it’s relatively new ground for
Sophos CISO Ross McKercher.
1. Security teams will need more development and engineering skills
Security teams used to focus on firewalls and endpoints and many security professionals cut their teeth as system and network administrators. Nowadays infrastructure is defined by code, breaches are increasingly caused by weak applications and automation is essential for under-staffed teams. understanding of applications and an ability to build automation into our tools and processes.
2. Organisations will up their focus on software supply chains
Everyone relies a huge amount nowadays on Open-source libraries that are often maintained very informally by loose-knit communities that are easy to infiltrate. This used to be the domain of nation states but the criminals are getting in on the action.
3. AppSec will continue to grow
We are getting better at protecting Endpoints and attackers are shifting their focus. Legacy applications will continue to be a fertile hunting ground!
4. Threat Hunting really will be driven by ML
|Bit of a cliché but ML will no longer be something that you just buy. Tools & techniques that were previously the domain of data science experts are getting easier to use. Won’t be long before larger SOC teams are using the tools directly rather than via models that are embedded in products.
5. Zero-trust starts to become achievable
The tools, knowledge and technologies for achieving a true Zero-trust architecture are rapidly maturing. Maybe like nuclear fusion – 15 years away and always will be but 14 years after the Jericho forum declared the end of the network perimeter we are getting close the point where many enterprises have a realistic chance of keeping their clients off “trusted” networks, particularly non-technical employees.

Rohan Vaidya, Regional Director of Sales – India, CyberArk|
1. ‘Unique Human Identities’ under attack
As the world goes digital, humans have become the primary target for cyber criminals. We will witness a new wave of attacks against emerging ‘unique human identities’. Biometric fingerprint, voice and face recognition have proven effective in consumer devices, and organizations will look to new authentication methods like embedded human microchips.
2. New Guidelines have been formulated for government social media accounts   
Social media is being used by different government agencies across the world to communicate with their citizens. In order to encourage the use of this dynamic medium of interaction, Department of Electronics and Information Technology have a framework and guidelines formulated for the use of social media for government organizations. These guidelines will help them to make informed choice to meet the requirement of interaction with varied stakeholders.  In 2019, we will witness government sanctioned social media accounts (elected officials and agencies) as critical infrastructure. Just like government text messages are monitored, similarly social media will be regulated as well.  
3. Trade wars trigger commercial espionage
Government policies designed to create ‘trade wars’ will trigger new ways to steal intellectual property and other trade secrets to gain competitive market advantages. Nation-state attackers will combine unsophisticated, yet proven, tactics with new techniques to exfiltrate IP, as opposed to just targeting PII (personally identifiable information).
4.Blockchain will help supply chain
Blockchain will transform the supply chain in 2019. Throughout the history of supply chains, there have been various innovations.  Following allegations of nation-states targeting the supply chain at the chip level to embed backdoors into both B2B and consumer technologies, organizations will |
5.  Transferring of trust and risk to third parties like Google and Facebook
The embrace of Google’s BeyondCorp strategy – shifting access controls from the network perimeter to individual users and devices without the need for a traditional VPN will expand the attack in 2019 if we do not take necessary precautions. This ‘zero trust’ approach can open up several attack vectors. First, it transfers risk and trust to third parties, like Google or Facebook and then the identity providers are exposed to an expanding attack surface with the help of authentication protocols and temporary API keys that can be compromised.  This transfer of trust opens up the very real possibility of attackers weaponizing identity provider assets or services to expose credentials or allow privileged access.  

Tim Jefferson, VP, Public Cloud, Barracuda Networks
In 2019 public cloud security will become more automated, and attackers will get stealthier
The public cloud market is maturing, and we expect to see a huge appetite for cloud security in 2019.  Businesses aren’t just experimenting with the public cloud anymore, and now that more customers have critical infrastructure and workloads on platforms like AWS and Microsoft Azure, they’re realizing they need purpose-built cloud security solutions to help them protect workloads moving to these platforms.
As workload migration accelerates to the public cloud, security risk professionals will need to get more actively involved in their DevOps team’s processes, so they can automate the application of governance and compliance controls. It’s not about dictating what tools the team uses, but verifying that controls are being met and helping the builders build securely. After all, configuration errors can be easy to make as people try to use new cloud services they might not fully understand. That’s why I expect to see more teams embracing automation to continuously monitor cloud security and remediate problems automatically.