Brad LaPorte, Chief Evangelist, Kasada:
"Bad bots, malicious automated tools, and evil AI now make-up 25% of the internet. Next year it will double, making half of the internet saturated with malicious traffic. This will be further exacerbated by IoT, 5G, and the adoption of ubiquitous internet-facing infrastructure.
IoT will explode
IoT devices already generate more than 1 billion gigabytes per day. I predict that by 2025, there will be 40 billion connected devices which will double by 2030 as the technology continues to advance over the next decade. IoT bugs will increase too, with new findings like AMNESIA:33, a set of 33 vulnerabilities that significantly impact four open-source TCP/IP protocol stacks that are commonly used in IoT devices.
Nation-state attacks and advanced persistent threats (APTs) will rise higher
There will be an immediate increase in malicious automation attacks on critical infrastructure - especially for internet-facing assets such as web properties, mobile apps, and APIs. This will multiply as these capabilities move to the black market and organized crime syndicates.
2021 will be the year of malicious automation
Over 90% of cyberattacks will involve some form of malicious automation by the end of 2021. What will immediately follow is a period of rapid investment and adoption, primarily using automation for cybersecurity.
Examples of attackers using malicious automation will include:
Content scraping malware to make attacks more efficient
AI-Supported CAPTCHA breaking, making it obsolete
Convincing social engineering attacks at scale, rendering gesture detection and biometric authentication useless
Intelligent targeting and evasion attack vectors
Data pollution and rampant misinformation ingestion
Advanced Persistent Bots (APB) will outnumber basic bad bots
Not all bad bots are created equal in terms of sophistication. A “spray and pray” bot is much easier to buy, build, and use than one that has laser beam surgical focus. But the higher the sophistication, the higher the reward.
Cybercriminals’ ability to access sophisticated tools - ones that are preconfigured with corporate data to allow for “walk right in” level access - is a fraction of a Bitcoin away. Script kiddies will be able to deliver government-sanctioned, nation-state level damage to their targets for financial gain.
Application programming interfaces (APIs) will be the new frontier for cybercriminal pioneers
APIs make everything A LOT easier from data sharing, to system connectivity, to simply making things work. But they also make it much easier for the bad actors to deploy malicious bots.
Soon over 90% of web-enabled applications will have more surface area for attack due to exposed APIs. This is because they are being implemented without security being part of their design, making them WAY too easy to discover and exploit. Put simply, APIs can expose a significant amount of data too easily, making it open season for any organization that has not made API security a priority."
###