Marci McCarthy--CEO & Chairman, ISE Talent: CISOs and security leaders have come to recognize that while preventing breaches is the priority, they can and likely will happen. Therefore, the mindset is shifting from “how do we stop breaches from occurring?” to “how do we respond and recover when breaches do occur?” With the increased threat of cyber-attacks, well-publicized breaches and new regulations, a large influx of new companies that are looking to build security programs due to increased regulations and awareness. As a result, most face a steep learning curve regarding hiring best practices, understanding qualifications and offering competitive compensation packages. These organizations can directly impact their success by focusing on the unique aspects of this industry and by working with dedicated information security search professionals.
Jim Manico—CEO, Manicode: It can't get much worse than 2015, but it will. Buckle down; even the best teams, and best defensive efforts are getting popped.
Joseph Loomis—Founder & CEO, CyberSponse: The next boom is security automation and creating velocity with limited staffing resources. This orchestration craze is more out of necessity and desperation than choice or preference. Security is going to have to refactor how we manage people and machines compared to previous years. Adding more tools means adding more consoles to manage, all with the staff you cannot hire or retain long. All of this which creates a big problem in keeping security under management and ultimately sparked the automation and orchestration category in 2015.
Jay Chaudhry—CEO, Zscaler: Ransomware has managed to hit a sweet spot. Users are all too willing to begrudgingly pay an expensive but not excessive ransom, in exchange for the return of their precious data. Even the FBI are recommending that it’s easier to pay than fight. The wildly profitable CryptoLocker has attracted many clones since it was largely knocked offline following Operation Tovar.
Many of these clones including more popular variants such as CryptoWall and TorrentLocker largely followed the proven formula, but we’re starting to see variations such as mobile and Linux focused ransomware. The latter is especially important as it’s more likely to impact the websites and code repositories of enterprises, who in our experience are also very willing to pay up rather than risk losing critical intellectual property.
Expect ransomware to become increasingly corporate focused in 2016 and as it does, enterprises won’t get away with paying consumer rates. The criminals behind the ransomware campaigns are savvy and once they realize that they’ve locked up source code and financial documents that haven’t been properly backed up, you can expect prices to skyrocket…and be paid.
Tony Smales—CEO, Forticode: Cognitive authentication is going to make a big leap in 2016 – with traditional methods being systemically compromised from any number of known attack vectors, interpretive, non-concrete, non-algorithmic authentication will become the method of choice for accessing private information and creating trusted access.