
12 Oct 2017
GlobalSign’s 2018 Cybersecurity Predictions
2017 has certainly been a busy year for cybersecurity professionals. We’ve witnessed sensitive data leaks from the National Security Agency, the Wannacry ransomware scheme and of course the massive Equifax breach.
But what is in store for us in the next year? The cybersecurity experts here at GlobalSign have looked into their proverbial crystal balls. Here are some of their predictions for 2018.
Nadim Farah, Manager Digital Signing Services
2018 Will Bring More Legal Challenges to Simple Electronic Signatures
December 2016 marked the first successful legal challenge to simple electronic documents standing and as the world is moving more towards standardized and publicly trusted digital signatures, I believe that we could very well see more legal challenges to the standing of simple electronic signatures in 2018.
This is due to the fact that major US application providers for document management and signing continue to invest in creating integrated ecosystems between trust providers, identity verification services and application providers, including Adobe's Cloud Signature Consortium and DocuSign's Trust Service Provider programs.
Furthermore, expect trust program updates from providers such as Microsoft and Mozilla root trust, in addition to the announced Adobe Approved Trust List (AATL) program requirement updates in July, to drive a higher level of compliance requirements for these programs in line with Electronic Identification, Authentication, and Trust Services (eIDAS) in the EU for ID verification.
Facial Recognition May Play a Role in Identity Verification
The recently unveiled iPhone X by Apple has facial recognition capabilities with secure local storage for the data and similar technology has been announced to be in the works by Facebook as well.
While those technologies don't yet have the recognition of accuracy and assurance to be reliable for identity verification used to issue certificates for publicly trusted digital signing, it is still a possibility to use them in authentication for simple electronic signature in the first phase in 2018. As the technology continues to develop, especially the type that Apple is using which is supported by various hardware sensors and cameras, it could be potentially recognized as an equivalent of face-to-face identity verification in the next two to four years.
Doug Beattie, Vice President Certificate Services
By the End of 2018, 85% of All Web Pages Will Be Protected by HTTPS
We’ve seen strong growth in the number of HTTPS page loads and secure sites this year, primarily driven by Google and Mozilla, who have been encouraging the use of HTTPS. Chrome has been marking sites that collect passwords or credit cards as insecure since Chrome 56 and Chrome 62 now marks all sites with input fields (that are served over HTTP) as insecure. It’s just a matter of time until all HTTP sites are marked as insecure.
Now that free or low cost Domain Validation (DV) SSL Certificates are available, there is minimal financial impact to website operators so both Google and Mozilla are encouraging them to secure via the changing browser behavior based on site content. With Google and Mozilla continuing to add more warnings to HTTP pages and the eventual treatment of them with a prominent red exclamation mark in a triangle, we expect to see adoption rates continue to increase significantly. By the end of 2018, I’m predicting 85% of all web traffic will be protected by HTTPS.
TLS 1.0 and Earlier Protocols Will (Finally) Be History
Security is only as good as the weakest link. With the wide adoption of HTTPS, it’s time to say goodbye to outdated protocols - SSLv3 and earlier and TLS 1.0. These protocols have severe vulnerabilities and should be disabled on all websites.
With TLS 1.2 widely available and 1.3 on the way, the older protocols will be phased out in 2018. Given this, I predict that the majority of the sites will be supporting TLS 1.2, and virtually no use of TLS 1.0 and older protocols, by the end of 2018.
Lila Kee, General Manager, Chief Product Officer and NAESB Board Member
There Won’t Be a Major Attack on the US Electric Grid in 2018
Despite the increase of cyber-intrusion into the energy sector like Dragonfly, I am taking a contrarian stance and predicting there won’t be a “water-shed – 9-11” attack on the US electric grid in 2018.
Why?
First, we have a very resilient grid due to both increased federal coordination around cybersecurity support to the energy sector, and ongoing progress around building security by design into the smart grid.
Second, I also believe we greatly benefit by an increasing adoption and reliance on microgrids. Microgrids add much more resiliency to the grid by offering a faster and cleaner method to tap into renewal sources while the larger grid is restored. Municipalities should follow some of the early adopter models seen in California to mitigate outage issues due to natural disaster or cyber-attacks.
In addition, the very fact that Dragonfly did not cause major disruption served as further evidence (to me, anyway) that we are doing something right. Because if we weren’t, the outcome of that attack would have been severe.
Lancen Lachance, Vice President IoT Business Unit
Expect More Botnet IoT Attacks
In 2018, we will continue to see exploits of IoT devices with usage aimed at botnet activity. The scope of unsecured devices is still large, which makes low hanging fruit for hackers.
More Legislation, But Not Much Guidance
Regulation and legislation evolves, but will still lack teeth. We will see additional legislation and regulation aimed at cybersecurity for the IoT proposed and passed across verticals. However, due to the lack of IoT experience in the justice system and experience enforcing, the regulation and guidance still won’t have enough basis to truly guide the market yet.
Attackers Will Continue to Target Holes in Security Basics
We will also see more examples of basic security being overlooked and exploited by attackers. Successful IoT attacks will not be advanced, but rather exploit basic lapses in security by design for IoT devices, like shared passwords or unencrypted communications.
Dawn Illing, EMEA Regional Product Manager
Businesses Will Start to Get More Serious About Cyber-Insurance; Premiums Will Inflate
Cyber-insurance, despite the attacks throughout 2017, will continue to grow at a fairly steady pace despite the awareness being a not ‘if’ but ‘when’ an attack will take place. The catastrophic attacks in 2017 established that cyber-risk is now a prominent threat. The success of an attack can cause major damage not only to a company’s bottom line but to business reputation and consumer trust. However, despite the market awareness being significantly magnified, uptake on insurance continues to be slow as companies are slow to mitigate risk and understand how the appropriate resilience can be built into the business.
Moving Insurance from ‘Risk Protection’ to ‘Prevention’
Due to growing awareness of cyber-attacks throughout 2017, businesses’ will start to see security as a key commercial risk rather than an ‘IT issue’ that effects all parts of their business. A holistic process will begin to be adopted from the boardroom down, to change cultures and take company-wide positive steps to protect digital systems.
The Rate of Security Breaches Will Continue to Increase, Having a Knock-On Effect on Insurance and Claims Complexity
The variety of attacks and technologies and processes deployed to prevent them will also be noticeable, adding more confusion to businesses and therefore advice or guidance becomes sought after. Previously, a degree of blame has always been in place for the end-user when a breach takes place; however, companies will begin to adopt policies that make it easier to report breaches within the company and the focus will be more one of ‘how to detect’ rather than ‘how to respond’. In turn, reinsurance (insurance for insurance companies) support will grow in response to better data and tools, supporting the overall growth of the market.
Cybersecurity and Insurance Sector Opportunity
As high profile attacks continue, insurance companies’ direct sales and brokers have a compelling opportunity to become businesses’ trusted advisers. Therefore, although cyber-insurance take up remains slow, cyber-insurance premiums, will be increasing (due to increase in claims), which could result in a ‘rush’ in the second half of 2018. This will mean that as businesses seek advice, brokers and direct sales persons need to become more knowledgeable in the field. Therefore, both insurers and in many instances, brokers will become critical influencers in future buying decisions.
Richard Hancock, Technical Data Protection Officer and Security Specialist
The Impact of General Data Protection Regulation (GDPR) in the EU
2017 has seen the biggest shift in focus within information security for more than a decade: data protection. The EU’s General Data Protection Regulation (GDPR) has more than ruffled a few feathers, not just within the industry but across the board. Whilst, to this day, I still have not seen widespread advertising of the law change to the general public, it is a hot topic within a wide array of business communities. With only seven months to go, that clock is ticking!
2018 will witness a sharp increase in companies rushing to get their affairs in order as the reality dawns on them that after May 25, they could very well be writing a seven or eight figure check to the regulatory body. The way our data is collected, stored, handled, manipulated and reported on is never going to look the same again. We have never had more power and control over our personal information as we do now.
Europe is somewhat setting a trend for global data privacy. Over the coming year, we’re likely to see more and more countries striving to equate local laws with those of the EU. I would hope that the privacy shield becomes stable and its longevity is assured by the US government administration. I foresee many more organizations adopting binding corporate rules to enable them to freely move data around within their own borders and I think that the process for such accreditation will be streamlines to make it much more accessible than today.
Looking Ahead to 2018
What are your thoughts on these predictions? Are they spot-on, or do you have a differing opinion? Is there a topic you have like to have seen addressed? We would love your feedback here in the comments section, or via Twitter.
Share this Post
Write for Us
Apply NowSubscribe to our Blog
GlobalSign Privacy Policy Version 3.1
Updated June 5, 2018
GlobalSign respects your right to privacy. This privacy policy has been developed to inform you about the privacy practices followed by GlobalSign in connection with its websites, products and services. This privacy policy does not apply to GlobalSign services offered by or through our partners, resellers or other third parties, or other third party services or websites, and we encourage you to read the privacy policies of those parties.
This privacy policy will inform you about what data is collected, how we use such data, where data is processed, how you may opt out of your data being used, the security provisions around storing your data and how to correct, update or delete your data.
1. Data Controller
The data controller for personal data collected within the EU is GMO GlobalSign, Ltd., having its registered offices at Springfield House, Sandling Road, Maidstone, Kent, ME14 2LP, United Kingdom. All questions or requests regarding the processing of data may be addressed to: dpo@globalsign.com.
2. Collection of Personal Information
We collect information from you when you (i) place an order for a GlobalSign digital certificate product or other product or service, (ii) scan your servers for digital certificates using our Certificate Inventory Tool (CIT), (iii) apply for access to our managed service platforms, (iv) subscribe to our newsletter, (v) use our online chat service, (vi) download a white paper, (vii) register for a webinar, (viii) respond to a survey, (ix) fill out a form for pre/post sales assistance, (x) open a support ticket, or (xi) your use of social media.
GlobalSign is a Certification Authority and trusted third party. To fulfill requests for digital certificates or other products or services, you may be asked to enter your name, email address, physical address, phone number, credit card information and/or organizational details or other personal information.
- - Contact information such as your name, email address, physical address, and phone number.
- - Relationship information that helps us do business with you, such as the types of products and services that may interest you, contact and product preferences, languages, marketing preferences and demographic data.
- - Transactional information about how you interact with us, including purchases, inquiries, customer account information, billing and credit card information, organizational details, transaction and correspondence history, and information about how you use and interact with our website.
We may develop and acquire additional information about you using third-party (public and private) data sources such as third party databases and government agencies, as well as your browsing and purchasing history in order to process orders for certificates and to improve our services.
GlobalSign treats personal information as confidential, except for the information included in an issued digital certificate. Such information may be verified using third party commercial and government resources, and as such, is deemed to be public information.
3. Purpose of Processing
Your personal data will be used for the purposes specified below:
3.1 To process applications for GlobalSign products and services
Your information is used to provide our products and services and order processing as well as to conduct business transactions such as billing.
3.2 To improve customer service
Your information helps us to more effectively respond to your pre/post sales requests and provide technical support.
3.3 To send renewal notices
The email address you provide for order processing may be used to send you renewal notices for your expiring digital certificate.
3.4 To send service updates
In addition, subject to your consent where required, we may send you new service updates, security updates, related product or service information, and status updates on maintenance windows or service availability.
3.5 To tell you about our products and services
Subject to your consent where required, we may send you periodic company newsletters, information about our products and services that may be of interest to you based on your use of other GlobalSign products and services, your attendance at GlobalSign sponsored marketing events such as webinars, your requests for information about similar products and services, or your sharing of data with social media sites such as LinkedIn or Facebook.
4. Legal Basis for Processing Personal Data
We will process your data for the purpose of performance of our contract with you or the legitimate interest of GlobalSign, which are our usual business activities. In other cases, we will request your consent for the processing of the personal data you may submit.
Your refusal to provide personal data to us for certain products and services may hinder us from fulfilling your order for those products or services. Also, if you deny or withdraw your consent to use personal data or opt out of receiving information about GlobalSign products and services this may result in you not being made aware of renewal notices, periodic company newsletters, new service updates, security updates, related product or service information, and status updates on maintenance windows or service availability. See Section 10 below for how to withdraw your consent.
5. Use of Cookies and web beacons
The GlobalSign Certificate Center (GCC) uses cookies to enable the fulfillment of services. Cookies may be used when you log into the GCC, purchase products or use certain GCC functions.
In addition, like most online businesses, GlobalSign uses cookies and web beacons on our websites and through marketing related emails to gather and analyze some personal data such as the visitor's IP address, browser type, ISP, referring page, operating system, date/time and basic geographical information.
We use cookies and web beacons to compile aggregate data about site traffic and site interaction so that we can gauge the effectiveness of our communications and offer better site experiences and tools in the future. We may contract with third-party service providers to assist us in better understanding our site visitors. These service providers are not permitted to use the information collected on our behalf except to help us conduct and improve our business.
First time visitors may choose to not have any activity monitoring cookies set in their browser. We use an opt-out identification cookie to tag these users as having made this decision. Those cookies that pertain to site performance, experience improvement and marketing are programmed not to execute when an opt-out cookie is present in a visitor's browser. Opt-out cookies persist until a visitor clears their browser cookies, or until their expiration one year after the set date. A visitor is required to opt out again after one year in order to disable any activity monitoring cookies.
More details of GlobalSign's use of cookies can be found on our website at https://www.globalsign.com/en/repository/cookie-policy/
6. Use of application logs for diagnostics or to gather statistical information
Our servers automatically record information ("Application Log Data") created by your use of our services. Application Log Data may include information such as your IP address, browser type, operating system, the referring web page, pages visited, location, your mobile carrier, device and application IDs, search terms, and cookie information. We use this information to diagnose and improve our services. Except as stated in section 8 (Data Retention), we will either delete the Application Log Data or remove any account identifiers, such as your username, full IP address, or email address, after 12 months.
7. Sharing of Information and Transfers of Data
We do not sell or trade your personal information to outside parties.
Within GlobalSign: GlobalSign is a global organization with business processes and technical systems in various countries. As such, we may share information about you within our group company and transfer it to countries in the world where we do business in connection with the uses identified in section 3 above and in accordance with this Privacy Policy. In cases where your personal data is transferred to countries that do not provide an adequate level of protection according to the European Commission ('adequacy decision'), we ensure your data is protected by entering into agreements containing standard contractual clauses approved by the European Commission with each of our group companies. A copy of these agreements may be obtained by contacting us as outlined in section 15 below.
Third Parties: We may also transfer your personal data to trusted third parties and our partners in order to serve purposes that are specified in section 3 above. GlobalSign uses a third party to process credit card payments and provides credit card numbers and identifying financial data directly to the third party credit card processor.
In circumstances where data is shared with such third parties, they are required to comply with confidentiality terms included in our data processing agreements. This prohibits such third parties from selling, trading, using, marketing or otherwise distributing GlobalSign customer data.
As Required by Law: We may also release your information when we believe release is appropriate to comply with the law or protect our rights, property, or safety.
It is our policy to notify customers of requests for their data from law enforcement unless we are prohibited from doing so by statute or court order. Law enforcement officials who believe that notification would jeopardize an investigation should obtain an appropriate court order or other process that specifically precludes member notification, such as an order issued pursuant to 18 U.S.C. §2705(b).
Mergers & Acquisitions: We may also disclose your personal information to third parties who may take over the operation of our site or who may purchase any or all of our assets, including your personal information. We will contact you using the details you provide if there is any change in the person controlling your information.
8. International Transfers
The third parties, subsidiaries and affiliates to which your personal information can be disclosed may be located throughout the world. Therefore, information may be sent to countries having different privacy protection standards than your country of residence. In such cases, we take measures to ensure that your personal information receives an adequate level of protection, which includes the EU Standard Contractual Clauses to protect your personal information.
9. Data retention
The personal information we collect is retained for no longer than necessary to fulfil the stated purposes in section 2 above or for a period specifically required by law or regulation that GlobalSign is obligated to follow.
To meet public CA audit requirements as detailed in the GlobalSign Certification Practice Statement, personal data used to fulfill verification of certain types of digital certificate applications will be retained for a minimum of 10 years depending on the class of product or service and may be retained in either a physical or electronic format. Please refer to the GlobalSign Certification Practice Statement for full details.
After the retention period is over, GlobalSign securely disposes or anonymizes your personal information in order to prevent loss, theft, misuse, or unauthorized access.
10. Opting out; withdrawing consent
If at any time you would like to unsubscribe from receiving future emails, we include unsubscribe instructions at the bottom of each email.
Renewal notices may be cancelled on a per digital certificate basis by logging into your GlobalSign Certificate Center (GCC) account and disabling renewal notices.
Email preferences for CIT related/collected information can be updated and changed within CIT.
If GlobalSign is processing your personal data based on your consent, you may withdraw your consent at any time via the GlobalSign Preference Centre at https://downloads.globalsign.com/acton/media/2674/preference-center-login or by contacting us at one of the addresses shown in section 15 below.
11. Your Rights
You are responsible for providing GlobalSign with true, accurate, current and complete personal information. Also, you are responsible to maintain and promptly update the information to keep it true, accurate, current and complete.
You have the right to access and modify your personal data stored on GlobalSign systems. You can exercise your rights by contacting us in writing. We will require you to provide identification in order to verify the authenticity as the data subject. We will make reasonable efforts to respond to and process your request as required by law.
To the extent of applicable law, you may have the right to request erasure of your personal information, restriction of processing as it applies to you, object to processing and the right to data portability. You may also have the right to lodge a complaint with a supervisory authority.
If you provide any information that is untrue, inaccurate, not current or incomplete, or if we have reasonable grounds to suspect that such information is untrue, inaccurate, not current or incomplete, we have the right to suspend or terminate your account and refuse any and all current or future services.
12. How we protect your information
We implement a variety of security measures to maintain the safety of your personal information when you place an order or enter, submit, or access your personal information. All supplied sensitive/credit information is transmitted via Secure Socket Layer (SSL).
After a transaction, your transaction-related information will be kept on file to meet audit requirements and facilitate renewals. We do not retain any credit card details.
13. Relevant laws
GlobalSign commits itself to protect the personal information submitted by applicants and subscribers for its public certification services. GlobalSign declares to fully respect all rights established and laid out in European Union and Member States' laws and regulations:
- - European Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and as replaced by Regulation EU 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the EU General Data Protection Regulation); and
- - Provisions of the GlobalSign CPS.
14. Changes to our Privacy Policy
If we make material changes to our privacy policy, we will inform customers by emailing a notice of the availability of a new version with a link to the new version.
15. Contact Us
If you have any inquires, or questions regarding our privacy policy, please contact us at:
- We use the data you submit only for purposes identified in section 3 of this privacy policy.
- You have the right to review your personal data that GlobalSign holds and check it for accuracy.
- You have the right to correct data in the case that errors may be found in our records.
- You have the right to request that any of your personal data be erased. i.e. right to be forgotten.
- You have the right to obtain and reuse use your personal data for your own purposes
- You have the right to request that GlobalSign restrict the processing of your personal data under certain circumstances.
- You have the right to object to our processing of your personal data.
14. Changes to our Privacy Policy
If we make material changes to our privacy policy, we will inform customers by emailing a notice of the availability of a new version with a link to the new version.
15. Contact Us
If you have any inquires, or questions regarding our privacy policy, please contact us at:
https://support.globalsign.com/
https://www.globalsign.com/en/company/contact/support/
https://jp.globalsign.com/support/
or
Deputy Data Protection Officer
GMO GlobalSign, Ltd.
Springfield House Sandling Road
Maidstone, Kent ME 14 2LP
United Kingdom
dpo@globalsign.com
16. Our Office Locations
GMO GlobalSign K.K., Tokyo, Japan
GMO GlobalSign Ltd., Maidstone, Kent, UK
GMO GlobalSign N/V, Leuven, Belgium
GMO GlobalSign, Inc., Portsmouth, NH, USA
GMO GlobalSign Russia LLC , Moskva, Russia
GMO GlobalSign Pte. Ltd, Anson, Singapore
GMO GlobalSign Certificate Services Pvt. Ltd., Delhi, India
GlobalSign China Co., Ltd., Shanghai, China
GMO GlobalSign Inc., Manila, Philippines
GMO GlobalSign FZ-LLC, Dubai, UAE