As we head into 2020, it’s clear that nothing much has changed in the cybersecurity community: threats are still very real, and the hunger for experienced security professionals remains high. Experts suggest that the coming year’s landscape will feel very much like a continuation of 2019, as far as cybersecurity and DevOps roles are concerned.

Let’s break down some of the core issues facing the cybersecurity arena in 2020:

IP Protection Matters

Enterprise IT strategist Brad Snow
thinks 2020 will be the year that companies start paying strict attention to
what’s being compromised. While stolen user data will always dominate the
headlines (especially the biggest hacks), just as big a threat is intellectual
property being stolen.

“Although it’s
difficult to assign an exact value to the amount of intellectual property that
is stolen annually, we can all agree it is astronomical,” Snow said. “In response,
worldwide enterprise security spending is forecasted
to grow to $124 billion this year. Organizations cannot place the entire burden
of security on IT teams. Everyone that has a device connected to the internet
needs to be trained on how to keep the organization safe. There are a ton of
programs that will enable leadership to engage every employee on the basics of
security.”

DevOps Teams: Overworked

Rani Osnat, vice president of strategy for Aqua Security,
thinks 2020 may be the year that DevOps teams finally reach critical mass in
many organizations. That’s to
say, their workloads will finally balloon out of control. As Osnat predicted:

“DevOps
teams will find themselves taking on more and more responsibilities, including
more security and quality automation. As enterprises adopt DevOps practices at
an ever-growing scale, the impact on the business and mission-critical
applications cannot be ignored. The processes and methods that traditional IT,
security, QA and compliance teams have been using are often incompatible with
the agility of DevOps, and cannot cope with the rate of change. The solution
lies in automating many of these practices into the DevOps processes and
toolchain, enabling a more integrated ‘detect early, fix fast’ environment.”

Part of the issue, as Osnat sees it, is a skills shortage: “The IT skills shortage will continue to plague the market, especially for new technologies such as Kubernetes, and what is by now a chronic shortage in skilled IT security professionals. It will drive organizations to seek solutions that provide a high degree of automation, with ‘zero-configuration’ out of the box capabilities that provide value immediately, and don’t require a lot of integration work or management overhead.”

Managing Credentials Will
Get Rough

A core principle for any cybersecurity or DevOps professional is
proper management of user credentials. It’s never simple—and in an odd twist,
trying to make it easier may come back to haunt you in 2020.

Brendan Diaz, CEO of encrypted enterprise chat service HighSide Inc., told us:
“Identity providers themselves will start to become the target of
cyber-criminals. If ‘X’ identity provider has the key to access all of company
‘Y’ and ‘Z’’s data, ‘X’ becomes a lucrative target.”

“Cloud services will make managing identities more and more
important, and increasingly difficult without appropriate tools,” added Aaron
Turner, HighSide’s chief security officer. “Identity will be the last perimeter
IT security teams can hope to have, and as has been proven with this year’s Capital One /AWS
breach, even the best-resourced teams will have an occasional lapse in
operational implementation of identity policies and controls.”

Sean Gallagher, IT and national security editor for Ars Technica,
agrees the almighty ‘cloud’ isn’t the answer: “As more businesses rely on cloud
resources, they are going to inevitably screw up securing them. We’ve already
seen lots of problems with Amazon S3 bucket security because of bad developer
security practices.”

Meanwhile, lots of attacks against cloud platforms take advantage of misconfigurations and “bad hygiene” moves, such as a lack of two-factor authentication or reuse of passwords. “‘Credential stuffing’ and harvesting passwords from other breaches to get into cloud email accounts is going to continue to be a threat, as is business email compromise,” Gallagher said.

Changing Roles and Accepting Responsibilities

“The case for why companies should protect consumer data is
clear: companies lose less money and consumer information is safe from
predators,” said Simon Marchand, chief fraud prevention officer for Nuance
Communications. “But in the event of a data breach, what many people don’t consider is that, once
their data is stolen, it is often made available for the highest bidder on the
dark web. And, in some cases, this personal data is used to fund some of the
most heinous of crimes—from terrorist organizations to drug and human
trafficking.”

Companies have a responsibility to stop the broader implications
of fraud that go beyond their bottom line and their brand perception, Marchand
added: “It’s not only about preventing
customer information from being stolen, it’s preventing fraudsters from getting in
organizations with information stolen elsewhere.” 

To that, Munya Kanaventi, senior director of information security
at Everbridge,
added: “A gap exists in the current
Chief Security Officer and Chief Information Security Officer job descriptions,
which is the ability to add strategic value to the company. There’s a lot of highly technical
people in this role, but when you advance to the C-suite title, there’s a need for business
vision alongside technical prowess.”

In other words, cybersecurity professionals who work within a company’s upper echelons need “soft skills” and a broader understanding of the business, in addition to their technical abilities. “Understanding how the company’s threat management strategy ties to the overall business goals and developing an action-orientated plan will be essential for CSOs in 2020,” Kanaventi continued. “As the CSO, it is your job to develop the company’s operational risk and demonstrate how that fits into larger business goals. After outlining the risk, the CSO must be able to establish a program that protects their people and assets from cyber and physical threats.”

2020 should be the year companies take a hard look at their
processes and people to decide if those in charge of protecting staffers and
users are properly skilled, and have the right tools to do the job they’re
assigned to. It’s now clear that breaches and hacks aren’t one-off events meant
to snipe user info; the compromised data is being used for much more than opening
up a credit card in someone’s
name.

The Cybersecurity Growth Balloon Pops

At some point, being ‘cool’ stops being cool. One of the coolest
things in tech is inflating growth, and security advocate Johnny Xmas
thinks 2020 will see the bubble burst.

“It is nearly impossible to go a single hour in InfoSec career
channels without hearing about how projected growth is absolutely insane, and
so far above every other industry that new types of math are actively being
developed to accurately calculate it,” he told Dice. “This propaganda seems to
mainly be spread by university career counselors and the respective current and
former students trying to justify the tuition costs, and, like all great
statistics-based scams, are suspiciously always presented with percentages.”

He continued: “[The role of information security analyst] is expected
to grow by 32% in the next 10 years. That sounds absolutely insane—until we do
the math. It turns out that 32 percent is a paltry 35,500 jobs. This is a tiny,
tiny industry, and as more and more IT pros come out of university with the security
knowledge the graybeards initially lacked, we’re going to see companies slowly
shrinking their internal teams and outsourcing way more, where costs and
salaries are always significantly lower.”

And Finally, the 2020
Presidential Election

Whatever your political leanings, a United States Presidential
election is always a microcosm of our society at the moment. For DevOps and Cybersecurity
professionals, this election cycle may represent a significant challenge.

A number of cybersecurity professionals think the 2020 election
will again see state actors influencing voters via social media and the
like—and we may see some good old-fashioned hacking. As voting machines roll
out to garages and libraries across the country, we’ll again be reminded that
the hardware is dated and insecure…
and so are the systems backing them up.

This sorry state will no doubt illicit hot takes from
cybersecurity pros. Based on our conversations, nobody necessarily believes the
election can be hacked broadly enough to forcefully and directly influence the
election itself, but the attempts to do so will nonetheless prove instructive
for cybersecurity and DevOps professionals.

State-sponsored hackers are among the most skilled black hat
hackers there are, and the election will shine a bright light on their
activities. If you’re in a cybersecurity or DevOps role, keep a close watch on
the election. Ignore the campaign rhetoric, but stay for any lessons imparted
by some of the best hackers in the world. A lot can be learned from them;
politicians, not so much.