No doubt, hurricanes devastated both our physical and virtual worlds with unparalleled fury. Meanwhile in cyberspace, data breaches, fake news spread via social media, malware attacks, hacktivists releases of hacking tools and other online shenanigans led to a blur of bad news headlines.
When added to alarming headlines about abuse and sexual misconduct by news anchors, Hollywood stars and political leaders, the net of effect of these incidents is a loss of trust in many U.S. institutions.
These trends were confirmed this week when Google revealed the top searches for 2017, with Hurricane Irma and Matt Lauer as the top two most popular.
While Hurricane Harvey, Hurricane Maria and Hurricane Irma brought record-breaking devastation, including significant loss of life, over $200 billion in property damage, personal tragedy and much more, a long string of high-profile data breaches and cyberattacks may actually bring more long-term damage in terms of economic impact and loss of trust in our digital economy and way of life in America.
From Equifax to Uber, the top data breaches of 2017 brought personal financial impact to every American with a bank account, mortgage, credit card or other credit history. Beyond Americans that are worried, millions of Canadian and European Union citizens were also impacted by the Equifax and Uber data breaches.
Other cyberattacks included new types of ransomware, including NotPetya, WannaCry and Locky, which brought down global businesses and locked customers out of their data — including medical devices impacted at hospitals.
This lack of trust contributed to the late-year surge in the price of bitcoin according to some experts, who point to the decentralized control and use of bitcoin for ransomware payments and other online transactions as motivators to buy in late 2017. (Note, there are many other factors as well leading to the bitcoin surge, including the Japanese government actions.)
Brief History of the Past Few Years in Cybersecurity
Before we dive into more details on 2017 cybersecurity and infrastructure events and trends, it is always helpful to take a quick look at the years leading up to 2017. Here are the year-end summaries (with links) for 2014, 2015 and 2016:
2014: The Year Cyber Danger Doubled — Cybersecurity stories were more popular than ever in 2014, with the word "cyber" showing up in front of topics ranging from security to shopping scams to global online attacks. But no matter how we rename, reclassify or reanalyze the data in cyberspace, it is clear that the dollars spent, problems encountered and attention given cyber has virtually doubled in 2014.
2015: The Year Data Breaches Became More Intimate — Something new, even unprecedented, happened this year in our cyberworld. The most noteworthy data breaches were not focused on financial data. Here’s a data breach recap from 2015 — along with my views on what these events tell us.
2016: The Year Hackers Stole the Show — With A Cause — In 2016, hacktivists took center stage. Hacktivism disrupted many global causes — providing new online missions with anti-establishment goals that wounded public credibility and trust. Here’s a cyber-roundup highlighting major international activities online, and how they impacted news headlines in the past year.
Also, you may want to look back at security predictions for 2017 that were made at the end of last year, to keep score on how your favorite prognosticators are doing — or not. (Note: 2018 security industry predictions are coming next week.) Here you go:
The Top 17 Security Predictions for 2017: What will happen in 2017? Whether you prefer to call them cybersecurity forecasts, online risk trends or security predictions, the answers are similar. Here’s a roundup of what our top industry experts, security companies and tech magazines are saying about the year ahead — and what you can do to prepare.
What Happened in 2017? Top 5 Cybersecurity and Infrastructure Stories for the Year
1) Hurricanes Devastate — When Hurricane Harvey struck the Texas coast in August, Americans were shocked by the flood pictures and damage estimates that ensued. Little did we know that the cleanup of Harvey was just the beginning of months of significant impacts from more hurricanes affecting people, property and critical infrastructure.
After Harvey came Hurricane Irma and Hurricane Maria, and we are still learning from and recovering from all three emergencies which stressed our response capacity as a nation as never before. Some may wonder how this topic integrates with cybertrends and the wider technology infrastructure stories.
A related emergency response area worth noting in 2017 are the wildfires. California has had record year in 2017, placing immense pressure on state, regional, state consortium and national fire response resources. Future disaster planning and management plans need to recognize the interaction and simultaneous human and infrastructure short-term causes and impacts, short- and long-term resource demands among disasters such as hurricanes, floods, droughts and wildfires.
In response, I urge readers to review these lessons learned on emergency preparedness from the interview with Andris Ozols in September. In addition, there is no doubt that the future of smart cities and technology investment will be guided by these events. From drones that flew over flooded areas to hackers who used phishing scams during fundraising efforts to hundreds of real and fake news stories about the hurricanes, our physical world and virtual (online) worlds are coming together even faster than in 2016.
2) Data Breach Stories — As in many previous years like 2014 and 2016, many commentators will call 2017 the year of the data breach. As I have written on numerous occasions, every year (at least for the last five and likely the next five years) could be given that same title, which makes the headline virtually meaningless.
That being said, the significant data breaches in 2017 somehow topped the incredible data breaches from 2015 (which included OPM and Ashley Madison among others) as well as the huge 2016 email hacks and hacktivist mischief. I won’t talk about 2018 yet — but the trend is certainly discouraging when one observes the breadth and depth of those affected as well as the impacts of these global incidents.
If Uber’s data breach taught us any lessons (beyond the fact that even billion-dollar companies are hiding and covering up what’s really happening), the Equifax data breach certainly broke all records for societal impact. The string of major data breaches this year also showed us (again) that we are all very vulnerable and pride often comes before a technology fall — and/or a data breach.
CSO Magazine offered this helpful article on the true costs of a data breach. Also, many breaches were not just about data or financial gain, but also affected daily operations for companies.
3) Real News or Fake News, Affect Trust, Social Media and Data Use — The Russian involvement in the 2016 election, along with ongoing stories of fake Twitter accounts, the use of Facebook and other social media sites to influence public opinion, as well as plenty of real-life finger-pointing, certainly makes the top 5 topics to remember about online life in 2017.
Meanwhile, a huge debate has ensued regarding the ability to stop terrorists use of social media (which began several years back) after the Manchester bombing and other major incidents in 2017. A huge debate regarding freedom of speech is swinging back and forth as it pertains to good and evil online and what can be done before, during and after major emergency incidents.
The reality that large parts of society get their news from social media websites has opened up the eyes of our leaders to the importance of this issue. Big tech companies responded, but Vanity Fair offered this article on: Why Zuckerberg's New “Trust Indicators” Can't Fix Fake News.
Additionally there is a big data component. A few of the reasons that this trust topic make the top list include:
- Information is ubiquitous, some silent, much of it overwhelming. Some is generated automatically (e.g., IOT), some produced as part of business and government processes and services, some as public policy, some as entertainment or consumer goods.
- All hinge on a degree of trust in the premises, processes, institutions and individuals involved. By necessity, intermediaries are required in processing, managing, sharing, and interpreting data and information. The strong push for the use data analytics, machine learning and processing raises the question of what sources are trusted.
- Intermediaries can have multiple motives, some of which can result in misinformation, disinformation or old-fashioned lies.
On the positive side, the havoc caused by NotPetya and WannaCry led to a stronger push for solutions like the NoMoreRansom Program/Initiative that has global support from the criminal justice community and the wider security industry.
5) Vaults 7 and 8 and Shadow Brokers — Leaked Hacking Tools — In March 2017, Wikileaks started releasing Vault 7 and Vault 8, collections of documentation (and eventually the source code for at least one actual tool) of CIA attack tools taken from an internal CIA development server.
As described by the lawfareblog.com: “Similarly, the Shadow Brokers have publicly released four separate dumps of data in three waves: August 2016, January 2017, and April 2017, three “ops stations” (collections of tools used for ongoing attacks) and one containing information about a campaign to extract information concerning SWIFT bank transactions.
In April, Symantec Security Response published an article about a group called Longhorn, which it had identified using the tools and operational protocols outlined in the Vault 7 leaks.
Longhorn was using these tools and protocols to carry out cyberattacks against at least 40 targets in 16 different countries, and Symantec researchers determined that there was little doubt that Longhorn’s activities and the Vault 7 documents were the work of the same group.
Bonus Item: FCC Net Neutrality Rules to End
A late-breaking story from this week includes the net neutrality rulings. As reported by The New York Times, “The Federal Communications Commission voted on Thursday to dismantle rules regulating the businesses that connect consumers to the internet, granting broadband companies the power to potentially reshape Americans’ online experiences.
The agency scrapped the so-called net neutrality regulations that prohibited broadband providers from blocking websites or charging for higher-quality service or certain content. The federal government will also no longer regulate high-speed internet delivery as if it were a utility, like phone service. …”
It remains to be seen if these new rulings will take effect in 2018 or not, since many expect lawsuits to be filed to challenge this change. Regardless, the potential for eliminating net neutrality rules is certainly a top topic of discussion as we head into 2018.
How About Good News Stories in Technology in 2017?
There was plenty of good news on the technology front in 2017 as well. MIT described these 10 breakthrough technologies, which includes reversing paralysis, self-driving truck, paying with your face, practical quantum computers, gene therapy 2.0 and the (not-so-positive) botnet of things.
Technological breakthroughs were also seen in batteries, various health-care industry areas, digital learning, smart cities, blockchain and more.
In government circles, the National Governors Association (NGA) announced the first-ever technology-focused office for states. The new NGA front page says: “With the rapid pace of innovation, each governor and state CIO can be challenged to keep up with emerging technology developments. The National Governors Association recently launched NGA Future, an initiative to give governors insights into potentially disruptive technology that is three to five years away.”
While this NGA move may seem minor in the grand scheme of things, it signals the importance of tech in every area of life. Meanwhile the National Association of State Chief Information Officers (NASCIO) top ten priority list points to cybersecurity and risk management staying as top initiatives — while continued emphasis on moving data to cloud computing, consolidating and optimizing data and creating digital government remain hot topics.
Final Thoughts
As we end 2017, the U.S. economic outlook is brighter than in many years, as the news about tax cuts and low unemployment numbers continue to brighten the overall domestic mood. The stock market is near all-time highs, and a “feel-good” holiday season certainly tempers the bad cybernews seen this year.
And yet, as CNET pointed out recently, the good and bad news associated with security awareness has now become a part of the mainstream media conversation. We will be dealing with the ramifications of the Equifax and other 2017 data breaches, ransomware and other cyberattacks for a long time.
How can we reconcile these complex narratives? The Internet is an accelerator of change. Cybersecurity both affects and reflects society. Our physical space and our cyberspace continue to merge as never before. As the number of IoT devices explodes in the coming years, bringing new artificial intelligence, drones, robots, smarter cities and homes and transportation, cyberprotections will be even more important in every area of life.
In closing, if I were to write one sentence to summarize cybersecurity and infrastructure from the past year, it would be this: 2017 was the year that hurricanes devastated land, data and trust.
