In today's working environment, it is essential to ensure security in all aspects, especially against cyber threats. The methods of cybercrime have become increasingly complex and sophisticated, potentially disrupting your organization's internal operations. Therefore, let's take a look at what threats we need to be cautious of in 2019.

Prediction 1: Business emails will receive increasingly surprising attachments.

Businesses are easy targets for cybercriminals. Over the past five years, global losses from emails tricking recipients into transferring money, known as Business Email Compromise, have exceeded 392 billion baht (USD 12 billion).

Unauthorized access to systems using login credentials is a common occurrence in organizations. Attackers are confident and motivated to target both small and large entities by impersonating partners or stakeholders, which can lead to severe damage if organizations do not update their security systems.

Examples of phishing emails that lead to incorrect financial transactions illustrate the increasing complexity and cunning of cybercrime. This often starts with the creation of fake websites to trick employees into providing personal information used on social media, which can then be exploited. Cybercriminals are constantly seeking ways to penetrate internal systems. Is it possible that in 2019, businesses will combat cybercriminals using the same tactics they employ in their attacks? We anticipate this may be the case.

TIP

If there is regular movement or transfer of critical data within organizations, each organization should routinely check and assess the flow of information internally and continuously monitor every step. We see that password systems are highly vulnerable for securing computers, making it easy for unauthorized use and difficult to trace which user is responsible. Given these various risk factors, we expect to see increased identity verification methods, including two-factor and multi-factor authentication, as well as biometric verification using physical or behavioral traits for access control.

Prediction 2: Supply chains will become a vulnerability for attacks.

The digital age has significantly reduced barriers to communication. The Global Supply Chain (GSC) allows businesses to connect manufacturers with external service providers (outsourcing) located worldwide. The connections vary, whether through data exchange between organizations or networks, strengthening organizations and enhancing operational efficiency while allowing data analysis for future benefits. However, if the connections lack robust security measures, it may provide opportunities for cybercriminals to exploit system weaknesses. For example, attacks on the supply chain in the healthcare sector, which connects with medical device providers like MRI systems and X-ray machines, can easily become vulnerable if hospitals lack stringent security measures.

As supply chains become more complex, implementing risk mitigation measures against cyber attacks may become more challenging. Therefore, organizations must identify who or which entities are connected to their internal networks and what management systems or services they rely on.

TIP

Chief Security Officers (CSOs) must regularly monitor network traffic to ensure that sensitive data is stored for specific use only and is well protected. Devices connected to the organization's network can turn the "Internet of Things (IoT)" into the "Internet of Cyber Threats." If external devices or applications must connect to the system, organizations must prioritize the security standards of those connected devices, including ensuring that firmware for users and applications is always up-to-date. The login systems should also be changed from their default settings. If devices and applications are connected to the organization's internal network, a Zero Trust Mode security system should be implemented to verify and authorize only permitted users and applications to access network traffic. In 2019, connecting insecure devices to organizational networks will provide cybercriminals with easy access, using only a smartphone or computer.

Prediction 3: There will be increased enforcement of personal data protection laws in the Asia-Pacific region.

As many countries in the Asia-Pacific region collaborate to prevent cyber attack threats, establishing frameworks for protecting against data theft is inevitable. For instance, Singapore and Australia have begun implementing data protection frameworks, and other countries in the region will gradually follow suit as they recognize the threats to national security and the need to protect citizens' personal data. Given the varying levels of digital advancement across regions, these countries may take time to enact suitable personal data protection laws, facing various obstacles along the way. However, 2019 will be a year when many countries worldwide become more aware and begin implementing measures to protect their citizens' data.

TIP

The European Union's General Data Protection Regulation (GDPR) serves as a call to action for entities in the Asia-Pacific region to prioritize the data they collect. For businesses, this regulation can be used as a basis for evaluating different compliance criteria and aid in decision-making regarding overall security strategies. While it may take time to establish common practices in the Asia-Pacific region, businesses can adopt GDPR policies as guidelines for collecting unnecessary personal data, potentially reducing risks and moving towards further development.

Prediction 4: The future of cloud computing awaits us in 2019.

The current era of applications is partly driven by cloud computing, which has become a data source for business operations, offering new products and services without requiring significant capital investment for data evaluation. Cloud computing simplifies security in some aspects but also presents new challenges. Implementing cloud computing strategies often means that critical systems and data reside with third-party vendors, product manufacturers, or software and hardware organizations that are not directly related to the business. This critical data must be stored and transmitted securely, with specific usage rights defined. Cloud security is not solely the responsibility of the service provider; organizations must also protect their data, applications, operating systems, network configurations, and more. The interconnected ecosystem complicates security measures, especially for organizations seeking capable partners to enhance security and considering the myriad of security products available in today's market.

TIP

As organizations strive to innovate and deliver new services, they face the complexities of data storage on websites. Collaborative efforts among development teams and operations teams (known as DevOps) can accelerate development speed, but challenges remain in securing data storage, particularly for organizations undergoing transformation. Therefore, utilizing human resources is crucial; if system administrators are well-suited for their roles, the entire internal system will be safeguarded against attacks.

Prediction 5: Finally, we understand why managing the security of critical infrastructure is essential.

Critical infrastructure (CI) differs from general infrastructure. Today, CI is vital and necessary, encompassing key sectors such as finance, banking, communications, and media. This is due to the integration of digital technology and automation, making it a target for cybercriminals, particularly in SCADA systems that monitor and analyze real-time data for controlling industrial processes and engineering tasks. Industrial Control Systems (ICS), which relate to energy networks, water systems, and public transportation, remain outdated and cannot be patched.

The UK's National Cyber Security Centre has warned of inevitable cyber attacks in the UK, targeting election periods and critical public infrastructure (CI). This perspective is echoed in the Global Risks Report 2018, which states that cyber threats are rapidly growing and spreading globally, ranking second only to natural disasters and severe climate change. How will the Asia-Pacific region prepare for 2019?

TIP

Those responsible for critical infrastructure projects must prioritize data confidentiality and adhere to principles of data protection, including "Integrity", which ensures that our accurate data is not altered by unauthorized individuals or hackers, and "Availability", which means that when we need to use computer systems, they must always be capable of supporting us. These aspects are increasingly important as countries in the region embrace Industry 4.0 technologies (e.g., Machine Learning for autonomous vehicles), which rely on Telemetry—automated remote measurement technology that requires constant connectivity. To begin, those responsible for critical infrastructure systems, whether in the public or private sector, must implement a Zero Trust Mode security system and ensure robust access authorization protocols.

Source: Palo Alto Networks