It is impossible to read a newspaper or magazine without being overwhelmed by stories describing the profound effects new technology will have on the way people live and work. It is equally hard to miss stories of cyber attacks and information breaches, with attackers growing more capable and ruthless by the day.

Business leaders are left with a stark dilemma: should they rush to adopt new technology and risk major fallout if things go wrong; or wait and potentially lose ground to competitors? An organisation that is well informed about emerging technologies and corresponding threats will be best placed to make winning decisions.

Threat Horizon 2019 presents nine major threats organisations can expect to face over the next two to three years as a result of technology change. The threats are set out under three key themes that reflect the major impact should they materialise:

THEME 1 – DISRUPTION: from an over reliance on fragile connectivity.

THEME 2 – DISTORTION: as trust in the integrity of information is lost.

THEME 3 – DETERIORATION: when controls are eroded by regulations and technology.

The world in 2019 will be entirely dependent on technology and connectivity and an organisation must use every tool at its disposal to stay ahead. Navigating this world calls for a strong collaborative culture with the right people congregating at the right time to play their part in ensuring success.

Will a major organisation fail? Might it be yours?

THREAT HORIZON 2019DISRUPTION. DISTORTION. DETERIORATION.

2 0 1 81.1 The IoT leaks sensitive information1.2 Opaque algorithms compromise integrity1.3 Rogue governments use terrorist groups to launch cyber attacks

2.1 Unmet board expectations exposed by a major incident2.2 Researchers silenced to hide security vulnerabilities2.3 Cyber insurance safety net is pulled away

3.1 Disruptive companies provoke governments3.2 Regulations fragment the cloud3.3 Criminal capabilities expand gaps in international policing

2 0 1 71.1 Supercharged connectivity overwhelms defences1.2 Crime syndicates take a quantum leap1.3 Tech rejectionists cause chaos

2.1 Dependence on critical infrastructure becomes dangerous2.2 Systemic vulnerabilities are weaponised2.3 Legacy technology crumbles2.4 Death from disruption to digital services

3.1 Global consolidation endangers competition and security3.2 Impact of data breaches increases dramatically

2 0 1 91.1 Premeditated internet outages bring trade to its knees 1.2 Ransomware hijacks the Internet of Things1.3 Privileged insiders coerced into giving up the crown jewels

2.1 Automated misinformation gains instant credibility2.2 Falsified information compromises performance 2.3 Subverted blockchains shatter trust

3.1 Surveillance laws expose corporate secrets3.2 Privacy regulations impede the monitoring of insider threats3.3 A headlong rush to deploy AI leads to unexpected outcomes

T H R E A T H O R I Z O N 2 0 1 7 – 2 0 1 9 2

01

8

2 0 1 9

2 0 1 7

DISRUPTION: from an over reliance on

fragile connectivity

DISTORTION: as trust in the integrity of

informationis lost DETERIORATION: when

controls are eroded byregulations and technology

Technology adoption dramatically expands the threat landscape

Disruption divides and conquers

Ability to protect is progressivelycompromised

Complexity conceals fragility

Governments become increasingly interventionist

Complacencybites back

2 0 1 81.1 The IoT leaks sensitive information1.2 Opaque algorithms compromise integrity1.3 Rogue governments use terrorist groups to launch cyber attacks

2.1 Unmet board expectations exposed by a major incident2.2 Researchers silenced to hide security vulnerabilities2.3 Cyber insurance safety net is pulled away

3.1 Disruptive companies provoke governments3.2 Regulations fragment the cloud3.3 Criminal capabilities expand gaps in international policing

2 0 1 71.1 Supercharged connectivity overwhelms defences1.2 Crime syndicates take a quantum leap1.3 Tech rejectionists cause chaos

2.1 Dependence on critical infrastructure becomes dangerous2.2 Systemic vulnerabilities are weaponised2.3 Legacy technology crumbles2.4 Death from disruption to digital services

3.1 Global consolidation endangers competition and security3.2 Impact of data breaches increases dramatically

2 0 1 91.1 Premeditated internet outages bring trade to its knees 1.2 Ransomware hijacks the Internet of Things1.3 Privileged insiders coerced into giving up the crown jewels

2.1 Automated misinformation gains instant credibility2.2 Falsified information compromises performance 2.3 Subverted blockchains shatter trust

3.1 Surveillance laws expose corporate secrets3.2 Privacy regulations impede the monitoring of insider threats3.3 A headlong rush to deploy AI leads to unexpected outcomes

T H R E A T H O R I Z O N 2 0 1 7 – 2 0 1 9 2

01

8

2 0 1 9

2 0 1 7

DISRUPTION: from an over reliance on

fragile connectivity

DISTORTION: as trust in the integrity of

informationis lost DETERIORATION: when

controls are eroded byregulations and technology

Technology adoption dramatically expands the threat landscape

Disruption divides and conquers

Ability to protect is progressivelycompromised

Complexity conceals fragility

Governments become increasingly interventionist

Complacencybites back

THREAT HORIZON 2019DISRUPTION. DISTORTION. DETERIORATION.

THEME 2 – DISTORTION: as trust in the integrity of information is lost Recommendations

2.1 Automated misinformation gains instant credibility The practice of deliberately spreading misinformation will evolve to target commercial organisations, driven by advances in artificially intelligent personas.

Build scenarios covering the spread of misinformation into the organisation’s overall incident management process.

2.2 Falsified information compromises performance Attacks that compromise the integrity of an organisation’s internal information will increase in number, scale and complexity.

Monitor access and changes made to sensitive information, using tools such as a Federated Identity and Access Management (FIAM) systems and Content Management Systems (CMS).

2.3 Subverted blockchains shatter trust Blockchains will be subverted to commit fraud or launder money, shattering the trust on which they rely. This could result in abandoning the affected blockchain, along with the loss of process efficiencies.

Appoint a sponsor or steering committee to consult widely and take decisions concerning the adoption and use of blockchain throughout the organisation.

THEME 3 – DETERIORATION: when controls are eroded by regulations and technology Recommendations

3.1 Surveillance laws expose corporate secrets Organisations will not be able to define the security arrangements around reservoirs of data collected in bulk by communications providers. Attackers will exploit this.

Collaborate across the organisation, and conduct a risk assessment to understand the impact of metadata being lost by a communications provider.

3.2 Privacy regulations impede the monitoring of insider threats Restrictions on individual profiling will result in a conundrum for the organisation: either lose the ability to monitor the insider threat; or defy regulations. Both will have negative consequences.

Take legal advice on restrictions regarding user profiling in every jurisdiction in which the organisation operates.

3.3 A headlong rush to deploy AI leads to unexpected outcomes The use of artificial intelligence (AI) will produce outcomes that go beyond the understanding of business leaders, developers and system managers, creating new vulnerabilities.

Recruit, develop and retain talent with the skills to understand and manage AI systems.

THEME 1 – DISRUPTION: from an over reliance on fragile connectivity Recommendations

1.1 Premeditated internet outages bring trade to its knees In an environment of fractured international relations, core internet infrastructure will become a target as nation states and terrorist groups aim to inflict widespread economic damage on their adversaries.

Existing business continuity plans can no longer be relied upon. Engage with internal and external stakeholders to agree alternative methods of communication (e.g. telex, satellite, microwave).

1.2 Ransomware hijacks the Internet of Things Already one of the most prevalent ways to exploit the value that organisations place on digital information, ransomware will evolve to target connected smart physical devices, potentially putting lives in danger.

Engage with industry bodies to lobby for (and influence) regulation ensuring minimum security standards for Internet of Things (IoT) devices.

1.3 Privileged insiders coerced into giving up the crown jewels Soft human targets, with access to mission-critical information, will be subjected to various old-fashioned criminal techniques of coercion.

Identify the organisation’s mission-critical information assets, and the individuals who own and access them.

The themes and threats included in Threat Horizon 2019 are summarised below, along with recommendations arising from the full report.

Organisations must ready themselves for unprecedented levels of collaboration. To get the best results from this more collaborative culture, business leaders will need to ensure conversations are underpinned by proficiency. There has never been a greater organisational need to attract talent and retain knowledge.

Be prepared. Start today.

WHERE NEXT?

ABOUT THE ISFFounded in 1989, the Information Security Forum (ISF) is an independent, not-for-profit association of leading organisations from around the world. It is dedicated to investigating, clarifying and resolving key issues in cyber, information security and risk management by developing best practice methodologies, processes and solutions that meet the business needs of its Members.

ISF Members benefit from harnessing and sharing in-depth knowledge and practical experience drawn from within their organisations and developed through an extensive research and work programme. The ISF provides a confidential forum and framework, which ensures that Members adopt leading-edge information security strategies and solutions. And by working together, Members avoid the major expenditure required to reach the same goals on their own.

DISCLAIMERThis document has been published to provide general information only. It is not intended to provide advice of any kind. Neither the Information Security Forum nor the Information Security Forum Limited accept any responsibility for the consequences of any use you make of the information contained in this document.

Reference: ISF 17 01 02 | Copyright © 2017 Information Security Forum Limited | Classification: Public, no restrictions

CONTACTFor further information contact:

Steve Durbin, Managing Director US Tel: +1 (347) 767 6772UK Tel: +44 (0)20 3289 5884UK Mobile: +44 (0)7785 953 800Email: steve.durbin@securityforum.orgWeb: www.securityforum.org

Threat Horizon 2019 contains detailed descriptions of nine major threats along with details of potential business impacts, recommended actions and other ISF material which enable you to build your cyber resilience.

We recommend that ISF Members:– review the threats in the report, identifying those that are of high priority– use ISF Live to become familiar with the techniques ISF Members have used to implement Threat Horizon– consider how the contents of Threat Horizon can be adapted to work best within your organisational culture,

for example to:- develop a forward-looking cyber resilience strategy- enable threat analysis and formulation of potential impacts and responses- brainstorm risk treatments

– use the ISF Threat Radar with business leaders to help categorise and prioritise threats and actions: particularly when time and budgets are limited

– work with other organisations to collaborate on threat intelligence and strategies– give careful consideration to the ISF resources in this report including Information Risk Assessment

Methodology 2 (IRAM2), The Standard of Good Practice for Information Security, Protecting the Crown Jewels: How to secure mission-critical information assets, Security Architecture: Navigating complexity and Managing the Insider Threat: Improving trustworthiness.

Consultancy services from the ISF provide Members and Non-Members with the opportunity to purchase short-term, professional support activities to supplement the implementation of ISF products.

The report is available free of charge to ISF Members, and can be downloaded from the ISF Member website www.isflive.org. Non-Members interested in purchasing the report should contact Steve Durbin at steve.durbin@securityforum.org.