How cybersecurity changed in the last decade; how will it change in the next
Much has changed in cybersecurity in the last decade.
But much has stayed the same.
Money is still the main motivation but so is data.
Large banks, financial institutions and corporations are still the main targets but so are small businesses.
There are still constant, continuously changing attacks, but even they have evolved.
“It used to be about going after infrastructure,” said Joe Ferrara, head of Wombat Security Technologies. “Now it's about going after people.”
Wombat turned 10 this month. A trio of Carnegie Mellon University researchers founded the company in June 2008. Ferrara was employee No. 4, joining three years later and growing the company to hundreds of employees with offices in Pittsburgh, Denver and London. In March, Proofpoint, a Silicon Valley cybersecurity company, bought Wombat for $225 million.
Ferrara has kept control of Wombat and kept his team in Pittsburgh, running the company as a business unit inside of Proofpoint.
Wombat provides training to help people avoid being victims of phishing and other cyberattacks. Wombat will even run simulated attacks on a company, testing its employees to see who clicks on that link or downloads that file.
“You see attacks going at every single industry,” Ferrara said, adding that companies big and small are targets. “It's not longer that you can hide.”
Ferrara said that 10 years ago, a bulk of attacks focused on defeating cyber infrastructure like firewalls, routers and anti-virus software. But over the last decade, the target of attacks shifted. People turned out to be more vulnerable than hardware or software.
Every employee, from the CEO to a new hire, is vulnerable to attacks, Ferrara said. And attackers have gotten clever, targeting and tailoring their scams to specific people. Phishing emails are filled with personal information scammers skim from the internet about their targets.
These tend to be more successful for the scammers.
“They're not stupid. They are trying to leverage whatever they can,” Ferrara said. “And unfortunately, we all tend to leave a lot of publicly available information out there.”
Ferrara said that Wombat can have training materials created around new attacks in about 24 hours. It's an arms race, Ferrara said.
Scammers are still mostly after money, Ferrara said, but they aren't siphoning off credit card numbers or bank account information like they used to. Some scammers seek to steal data, which is just as good as money in some circles. Many are looking for access.
Scammers seek to gain credentials, usernames and passwords, to email and social media accounts. Once they have access, they launch their attack.
On a social network, that could be the compromised account of a friend posting pleas for money to help him or her out. At a company, it could be the compromised account of the CFO directing payments or wire transfers.
“They are continually looking for different angles to stay one step ahead,” Ferrara said.
And that's what Ferrara doesn't see changing in the next decade. Attacks will change. Cybersecurity efforts will adapt. Attacks will change again. Ferrara doesn't see that changing for a while.
“It's just literally keeping up,” Ferrara said.