Top 5 Cyber Security Skills Needed in 2018

As the frequency and severity of cyber attacks continues to rise, organizations are coming face to face with the looming danger of a data breach. However, boosting security budgets is not nearly enough to protect against today's increasingly sophisticated attacks. To truly combat the myriad threats in cyberspace, organizations must hire, train and retain cyber security professionals with the skills needed to stay ahead of the hackers.

Here are five skill sets that information security hiring managers are looking for in 2018, and beyond:

1. IoT Security

   Like any other rapidly evolving technology, Internet of Things (IoT) also has its many security loopholes, which, if left unprotected, can result in a wide-array of cyber-crime reports. IoT is especially vulnerable due to its massive number of interconnected devices and networks.

   The first ever IoT Botnet was discovered in 2013, by a researcher at Proofpoint, an enterprise security firm, who stumbled upon the realization that thousands of malicious emails had logged through a security gateway, originating from a botnet made of smart TVs, baby monitors, computers, and other household appliances.

   Since then, there have been even bigger IoT attacks, with the Mirai botnet, launched in 2016, becoming one of the biggest DDoS (Distributed Denial of Service) attacks ever recorded. This led to huge portions of the internet crashing, including Twitter, the Guardian, Netflix, Reddit, and CNN. By accessing a table of over 60 common and default usernames and passwords, the Mirai botnet was able to access accounts and infect them with the Mirai malware. These devices continued to function practically normally apart from occasionally becoming sluggish, removing “competing” malware for the system, and blocking remote administration ports. Upon rebooting, the malware re-infected the system, unless the password was changed almost instantly by the user.

   Despite the dangers, the Internet of Things has many benefits including increased productivity, enhanced decision-making, and better time management. IoT solutions are now being applied in nearly every industry including healthcare, energy, agriculture, business management, manufacturing, and even transportation, with many organizations moving towards digital transformation, stressing on the urgent importance of IoT security.

   Vital cyber security skills for the Internet of Things in 2018 include IoT hacking methodology, analyzing potential threats to IoT platforms, and IoT attack countermeasures.

   Module 18 of EC-Council’s Certified Ethical Hacker (C|EH) credential validates these skills and more, explores the IoT threat landscape, and provides directions on using IoT devices securely.

2. Vulnerability Assessments

   Protection of data has become vital in today’s world, especially with the enforcement of laws and regulations such as the EU’s General Data Protection Regulation (GDPR). Information collected by banks, businesses, manufacturers for financial transactions, research, personnel, and security often include personally identifiable information that, if compromised, can be used for a variety of malicious acts like identity theft and financial gain.

   Vulnerability assessments scan for security weaknesses in the organization’s network, communication infrastructure, and end-systems which are often used by an attacker to exploit the target.

   Vulnerability analyses can also play a huge role in preventing attacks; by identifying security loopholes, an organization can perform patch management, install proper antivirus software, troubleshoot hardware, and secure the network with a range of precautionary methods.

   Key vulnerability assessment skills in 2018 include choosing the right assessment tools, generating and analyzing reports, and patching vulnerabilities to prevent attacks before they happen.

   Module 5 of the C|EH covers the vulnerability management life cycle, and various approaches and tools used to perform the vulnerability assessment.

3. Artificial Intelligence & Machine Learning

   Artificial intelligence (AI) and machine learning (ML) can be used to strengthen your cyber security strategy by helping identify new weaknesses and exploits, which can be further used to avoid malicious attacks such as ransomware phishing and botnets.

   In fact, according to a report by Gartner, 10% of penetration tests will be conducted by machine-learning-based smart machines by 2020. This not only reduces the pressure faced by IT security professionals but is an automatic, faster approach to mitigating attacks.

   Using artificial intelligence and machine learning to identify vulnerabilities and security flaws is a faster solution to defending systems against various cyber-attacks that a normal anti-virus scan can not normally detect.

   But keep in mind that artificial intelligence is a double-edged sword, used as an advantage by both criminals and security professionals. This makes it even more imperative for security professionals to not only combine artificial intelligence and machine learning with cyber security, but also stresses the importance of analyzing the flaws in the system.

   Important info-sec skills around Artificial Intelligence and Machine Learning in 2018 include understanding and analyzing the emerging role of AI and ML in cyber security.

4. Cloud Security

   For organizations across the globe, cloud computing offers massive benefits such as scalable storage, better collaboration, and cheaper costs.

   However, cloud computing is the beginning of many emerging attack vectors that have been left unsecured for far too long. Despite there being an increase (300%) in the number of attacks on cloud-based accounts, a large percentage of businesses largely depend on these technology advancements to grow and compete.

   Basically, secure cloud computing ensures security and privacy, effective encryption, confidentiality, and privacy in the cloud. Key cloud security skills in 2018 include having a comprehensive knowledge of cloud computing threats, placement of security controls in the cloud, and cloud penetration testing.

   The C|EHv10 Module 19 focuses on emerging attack vectors in the cyberspace including AI/ML and cloud computing.

5. Malware Protection

   Attackers use malware techniques to steal personally identifiable information from individuals and groups and can spread from one system to another with ease. Malware includes Trojans, scareware, keyloggers, ransomware, botnets, worms, and viruses that delete, destroy, and tamper with files existing on a network. Some malware is even capable of stealing personal information and spamming others to achieve wider reach.

   In 2017, the most significant malware attacks were that of ransomware, where several “cryptoworm” variants multiplied across several unprotected systems around the world, such as WannaCry, which affected over 300,000 organizations, and Locky, which sent out 23 million spam messages in a 24-hour period.

   There are new variants of malware being produced every year, making it imperative for cyber security professionals to adopt the skills needed to protect organizations from malware attacks. Key malware protection skills include both static and dynamic malware analysis, countermeasures, and the deployment of anti-malware software. By performing malware analyses, the detailed information regarding the malware can be extracted and mitigated.

   Module 7 of the C|EH program focuses on malware threats and the importance of malware analysis — a process of reverse engineering a specific piece of malware to determine the origin, functionality, and potential impact of a given type of malware.

As EC-Council says, “To beat a hacker, you need to think like a hacker”. To determine how to protect a network, you must first identify the vulnerabilities, exploit them to understand the depth of damage caused by an intrusion, and then patch all loopholes in the system. The above cyber security skills cover the tools and technologies necessary to protect organizations through 2018 and beyond.

EC-Council recently launched an all-new learning track, compiled of five programs — Certified Ethical Hacker (C|EH), Certified Ethical Hacker (Practical), EC-Council Certified Security Analyst (ECSA), EC-Council Certified Security Analyst (Practical), and the Licensed Penetration Tester (Master). Through this learning track, you will be able to gauge your knowledge, information security skills, and abilities while addressing the pressing issue of exam sanctity, the importance of methodology, and practicality.