In today’s digital landscape, it is crucial for businesses to prioritize creating a secure organization by default. The rise in cyber attacks this year has been well-documented, but what is more important is understanding how cyber crime is evolving and how we can adapt to these changes.
Looking back at 2023, we have learned that many high-profile attacks can be attributed to simple and straightforward attack vectors. For example, the Optus breach, which compromised 10 million records, was caused by an exposed API. This indicates that basic security controls are not effective enough, prompting us to reevaluate the validation and efficacy of our existing controls. Regular testing is essential to ensure robust security measures.
The incident involving the Police Service of Northern Ireland further highlights the importance of educating individuals with legitimate access to sensitive information. They are often the first line of defense but can also be the weakest link. Implementing practical guard rails and providing comprehensive education on security fundamentals is crucial to prevent such situations.
An increasing trend in phishing attacks is the use of AI-generated messages, making them more believable and increasing click-through rates. Darktrace reported a 135% rise in “novel social engineering attacks” when ChatGPT gained widespread adoption. As a result, traditional phishing messages are becoming less obvious, posing challenges for users.
Data protection has become a significant challenge due to the combination of cloud technology and extended supply chains. For example, when transitioning from an on-prem CRM platform to Salesforce, it can be difficult for information security teams to monitor all data activities. Ensuring security is integrated into digital engineering processes is crucial. Organizations that have successfully achieved this collaboration between development and security teams have an advantage in maintaining strong security measures.
Board awareness of cyber risks is increasing, necessitating the provision of high-quality risk data in an easily understandable format. Technical jargon and control maturity-based reporting may not effectively communicate the impact of risks to senior leaders. The operational resilience agenda has helped in providing a holistic focus on key issues and accessible information for senior leaders in certain sectors.
Looking ahead to 2024, two noteworthy trends are emerging in security products and devices. Passwordless authentication, already adopted by major companies like Apple and Google, is gaining traction due to its ability to mitigate password thefts, phishing attempts, and replay attacks. Additionally, security products are increasingly being bundled with cloud IT services. While this eases implementation, there is a risk that unique security needs may be overlooked.
In terms of threats, the geopolitical climate is likely to contribute to an increase in attacks by nation states and hacktivists. Organizations should consider their headquarters, funding sources, and perceived affiliations when assessing their vulnerabilities. Attacks on the supply chain are also expected to rise, with compromises in supplier systems being exploited to gain access to customer environments. Ensuring suppliers adhere to strong cybersecurity measures and conducting thorough audits are crucial steps in mitigating these risks.
Looking further ahead, the year 2024 may see a consensus emerging on defense against AI-based attacks, particularly as these attacks become more prevalent. This will likely lead to a growing demand for experts who can navigate the intersection of AI and cybersecurity. Additionally, there is a growing awareness of the need for quantum-ready thinking, even though quantum computing does not pose an immediate threat. Cataloguing encryption algorithms used across an organization’s systems is a proactive step towards future readiness.
In planning for 2024 and beyond, organizations should prioritize integrating security into their systems, processes, and mindset. This will facilitate a better understanding of new technologies, such as AI and quantum, and enable organizations to harness their potential for digital growth.
Rasika Somasiri, a cybersecurity expert at PA Consulting, contributed to this article.
