2020 Cyber Security Predictions from a CISO

2020 is here and hopefully, all security teams have resolutions of improving the cybersecurity of their business in the new year. But what new challenges and developments will 2020 bring that you need to be prepared for?

How cybersecurity will change in the next 10 years

Fewer passwords: In the next few years we will see the adoption of more non-password-based consumer authentication technologies (e.g. FIDO). Consumers and tech companies are increasing the pressure to move to systems that require fewer passwords. Technologies like single sign-on (SSO) and multifactor authentication (MFA) can help users authenticate users without requiring them to remember passwords.

Biometrics: There’s going to be more movement towards leveraging rich biometrics for convenience (e.g. Iris scans). These rich biometrics will leverage significantly more and better sensors (iris scanning, body posture, etc.) in consumer/end user-facing devices. 

Machine learning: Advanced machine learning models will allow for better context-based authentication assessments and improve the authentication process, like geofencing and device biometric sensors. Some of those models and technologies are already available. For example, MFA solutions can do geofencing based on GPS. Advanced sensors on mobile devices will also be usable over the next several years.

The key to implementation is back-office instrumentation – there’s machine learning that needs to take place to understand normal vs. anomalous behavior and that takes time.

Security breaches and passwords

According to the Verizon Data Breach Investigations Report, 80% of breaches are still caused or enabled by weak and reused passwords. So the question remains: when will consumers and end-users improve their password behavior?

This really comes down to two questions: 1) When will it be harder for breaches to occur so fewer passwords are exposed?  and 2) When will users use better and stronger passwords? 

In terms of reducing breaches, this will be a long journey that requires enterprises to incentivize good security practices such as secure development over glitzy features. Over time, insecure services will have a higher likelihood of failing due to falling customer trust. This has started (e.g. scrutiny over Facebook’s data losses) but will still take more time to become considered a top tier risk for enterprises.

In terms of better passwords, this is all driven by consumer awareness. Newer authentication technologies will continue to whittle away at password-based systems, which may alleviate parts of this problem. But companies dealing with sensitive data (fintech, healthcare, etc.), they will also start enforcing more complex password policies to lower their risk. 

Biggest identity and access management challenges/ trends in 2020

All companies will face different challenges depending on their size and their sector. However, all companies face the challenge of security awareness among employees, contractors, and customers. And without the support from all users, technological efforts will not be fully effective.

To help with this effort, here are a few recommendations:

Multi-directional communication is extremely important in a security program, meaning working from the top-down, bottom-up, and side-to-side to get your message across. Reinforcement of best security practices should come from an employee’s manager, peers, c-suite and more. And yes, it’s true. Security is everyone’s responsibility.

People learn differently – some are more receptive to visual guides or written instructions while others may want a hands-on lesson. Also, the content can vary depending on your audience. Some may like content that is funny, serious or provides historical background. Whatever you choose, providing consistent communication is the key to a strong awareness program. Part of our focus is to make sure we are delivering our security training and materials in a variety of channels. We’ve also included employees in everything from video creations and contests – and it gets them involved and excited about it too.

When it comes to high-tech industries like those in the finance or healthcare industries, the key is to establish and maintain control over BYOD and Bring-Your-Own-App policies and mentality without impacting employee productivity.

I’m excited to see where this new decade takes us. Leave a comment below with your predictions for 2020.

By Gerald Beuchelt LastPass blogs

Comprehensive Benefits of America

For an expanded presentation of asset protection and financial wellness strategies and to receive regular updates on strategies to protect what you have earned, visit and register with CBAPlan on the link below. Registration is free.

Visit www.cbaplan.com or call 1-312-559-8444 for assistance with registering.

Tom Tuohy is the founder and CEO of Comprehensive Benefits of America, LLC, and Tuohy Law Offices.

The information being provided is strictly as a courtesy. When you link to any of these websites provided herein, Comprehensive Benefits of America, LLC/ makes no representation of the completeness or accuracy of information provided at these sites. CBA does not provide professional financial, investment, tax, or legal advice. You should seek certified financial planners, CPAs, and attorneys for advice relative to your personal needs. See complete Disclosures and the CBA Security and Privacy policies.