Year in Review: Breaches, Ransomware, MFA, IoT
Key Points
- Data breaches remain a huge financial threat, averaging over $4 million per incident, and are increasingly linked to ransomware attacks that cause extortion, data loss, and operational disruption.
- Ransomware continues to be a primary driver of breaches across individuals, corporations, and even nation‑states, highlighting the urgent need for stronger preventive measures.
- The adoption of multi‑factor authentication (MFA) has accelerated, offering a more secure and user‑friendly alternative to password‑only logins and representing one of the few positive trends in cybersecurity last year.
- Looking ahead, the same cycle of data‑breach and ransomware incidents is expected to persist, underscoring that current defenses remain insufficient.
- Attackers are likely to focus more on the expanding Internet of Things (IoT) ecosystem, exploiting the growing number of connected devices as new vulnerable entry points.
Full Transcript
# Year in Review: Breaches, Ransomware, MFA, IoT **Source:** [https://www.youtube.com/watch?v=uAHFNuDlcRw](https://www.youtube.com/watch?v=uAHFNuDlcRw) **Duration:** 00:09:42 ## Summary - Data breaches remain a huge financial threat, averaging over $4 million per incident, and are increasingly linked to ransomware attacks that cause extortion, data loss, and operational disruption. - Ransomware continues to be a primary driver of breaches across individuals, corporations, and even nation‑states, highlighting the urgent need for stronger preventive measures. - The adoption of multi‑factor authentication (MFA) has accelerated, offering a more secure and user‑friendly alternative to password‑only logins and representing one of the few positive trends in cybersecurity last year. - Looking ahead, the same cycle of data‑breach and ransomware incidents is expected to persist, underscoring that current defenses remain insufficient. - Attackers are likely to focus more on the expanding Internet of Things (IoT) ecosystem, exploiting the growing number of connected devices as new vulnerable entry points. ## Sections - [00:00:00](https://www.youtube.com/watch?v=uAHFNuDlcRw&t=0s) **Year in Review: Cyber Threats** - The speaker recaps the past year's cyber‑security landscape, highlighting persistent, costly data breaches—often driven by ransomware—and previews what to expect moving forward. ## Full Transcript
this year has been a tough one for cyber
security especially if you were one of
the folks that got hacked and even if
you weren't you might have been and you
just don't know it yet
that happens
so let's take a look at what kinds of
things have we seen overall Trends in
the past year in cyber security so we'll
take a look back
and then we'll take a look forward into
the future what can we look forward to
in cyber security threats as well as
hopefully good things that can occur I
think there will be a mixture of good
news and bad news with both
so first of all looking back one of the
things that continues to plague us is
this notion of data breach
that is the bad guys get into your
system they dump your customer database
they use it to mine for information that
they can later use identity fraud
scenarios with they steal the secret
sauce the plans this sort of stuff and
the business is compromised as a result
the IBM ponderman survey that we run
each year on the cost of a data breach
shows that the cost of a data breach
continues to be in excess of four
million dollars per incident
that has been the case for a number of
years and it continues to be the case
we've got to do a better job on this
it's almost become so commonplace that
we're numb to it and that can't be the
case
what's the cause of a lot of these data
breaches well it turns out ransomware
is at the core
of many of them not all but many and
ransomware is costing people individuals
all the way up to the large
organizations and even nation states as
its effect is resulting in data loss
it's resulting in extortion a lot of bad
things happen here so those are a couple
of bad trends that we see how about
something good A little bit of good news
for last year I'll say multi-factor
authentication is one it's not a new
idea but the idea that I can
authenticate prove my identity to the
system based upon something I know
something I have and something I am
those three things
put all of those together or some
combination maybe even get rid of the
something I know the password it's a
better user experience and it can lead
to better security and what we've seen
is more and more widespread adoption of
multi-factor authentication that's going
to be a good thing for us all and we've
seen that start to take more hold in the
past year now how about looking forward
what kind of things have can we expect
to see well I'm going to say it's going
to be a little bit of Groundhog Day what
we've seen in the past we're going to
keep seeing in the future until we learn
how to solve these problems data breach
ransomware multi-factor authentication
hopefully we'll continue to see more and
more widespread use of that
so the past continues to play into the
future and influence the future
but what are some other things that
we'll see I think we're going to see a
rise in attacks for Internet of Things
internet of things or iot is basically
the notion if you follow along with me
turn everything into a computer
your car becomes a computer that takes
you places your refrigerator is a
computer that keeps your food cold
your DVR is a computer that shows you
movies
and in the iot trend everything becomes
a computer and what we know from cyber
security is that every computer can be
hacked so if everything can be a
computer and every computer can be
hacked all of a sudden everything can be
hacked your car your refrigerator your
insulin pump your implantable
defibrillator these are things that are
going to be pretty scary when we start
thinking about the whole world around us
is potentially hackable that's an area
that we have got to give more attention
to
another one that could come back to
haunt us is the use of artificial
intelligence by the bad guys
on the positive side we've had the good
guys using AI for some number of years
we can use this to do a better job of
security analysis of root cause analysis
looking for what all of these indicators
of compromise ultimately mean and
figuring out what we need to do the good
guys are using this to analyze and
investigate the bad guys I think are
going to start using it more and more to
do things like develop attacks that are
specific to an AI an artificial
intelligence system would be able to
maybe design new types of attacks to get
into systems
we could also as our businesses become
more and more dependent upon artificial
intelligence we are dependent upon the
Corpus of knowledge that's in those
systems so therefore if someone were
able to poison the Corpus of knowledge
then the AI would be giving advice and
making decisions based on bad
information so that's a different type
of AI based attack all of these go into
what we refer to as adversarial AI
so there are a number of things that the
bad guys could be doing where they're
going to start using AI more which just
means the good guys are going to have to
start using our AI more still and
another one that is very new and will
continue to grow is the notion of a deep
fake that is an audio or video file
where we have a a person maybe a
well-known person saying something that
they never said and we tend to believe
what we see and if it goes out on social
media everyone will believe it before
anyone has a chance to refute it imagine
what happens if a video is leaked on
Election Day showing a candidate saying
something that they never said that was
terrible
it could be too late before we get the
news cycle the next news cycle to
correct the error
it could also move the stock market if
we had a CEO seeming to say certain
information that would look bad about
the company and cause the stock to crash
even though they never said those words
but we have an AI that can do that sort
of simulation we're going to have to get
smarter about how to detect a deep fake
from an authentic video as an example
other things that we'll see
quantum computers
are very useful in solving problems that
traditional computers have not been able
to do to do simulations and things of
that sort that we just don't have the
Computing capacity to process with a
conventional computer
so a Quantum system could solve those
problems in record time
also a Quantum system could potentially
attack the cryptography that we have the
asymmetric crypto algorithms that we
rely on every day for all of our secure
Communications could potentially be
broken in what we thought would have
taken decades or hundreds of years now
with a well-tuned Quantum system in the
future maybe being able to be broken in
a matter of minutes
so that means we're going to have to do
some good work to make Quantum safe
algorithms for cryptography and the good
news is we've got these things in fact
the National Institute of Standards uh
recently this year came out with four
algorithms that they published as being
Quantum safe these are the algorithms
that will protect against a quantum
computer trying to crack our encrypted
messages and databases and the like
and four of those algorithms that were
accepted of those four three of them in
fact had IBM contributions to them so
we're very proud of our work that we've
done in this space and trying to protect
people going forward into the future
and then another Trend that has
continued for a number of years and it
shows no signs of letting up is a skills
Gap in cyber security
there's one website called cyberseek.org
that says currently as I look at the
website there are about
770 million unfilled cyber security jobs
in the U.S alone
that's right now and there's only about
a million or so people working in the
field so it's almost one-to-one for
every job now there uh is an opening and
we can't make cyber Security Experts
that quickly with current technology we
can create a new human in about nine
months but if we're going to turn them
into a cyber security expert it's going
to take a few more years
there's not anything that looks like we
can suddenly start minting new Cyber
Security Experts to fill the Gap but we
can do some things to help and we can do
things by working smarter using AI that
I mentioned here to guide our security
efforts using good tools to automate the
responses that we have for security to
do better analysis and become Force
multipliers for the people that we do
have also we need to do a lot more
training for the people that are out
there not only our end users so that
they don't put us in such a bad place to
begin with but also Security
Professionals and create more Security
Professionals so it's going to be a
multi-pronged approach but these are the
things that I think we're going to be
able to see both on the positive and the
negative as we start looking forward to
the future of cyber security
foreign