From the rise of Artificial Intelligence (AI) in creating deep fakes, to using ChatGPT to make sense of the data captured during a breach, cybercriminals have upped the ante this year in terms of the sophistication of their attacks.
As we head into 2024, leading provider of managed services and cloud solutions, Intelliworx, reveals the trends expected to both help and hinder the role of the cyber security professional in the new year.
ChatGPT or AI? Expect to get cyberattacked
Social engineering through deep fakes, that make use of artificial intelligence (AI) to hide their threats in plain sight, is becoming more common. Both AI and ChatGPT can be used to better mask phishing emails as being from real friends or colleagues – thanks to their ability to replicate the more “human” elements of online interaction. Because of this, AI will continue to grant cyber attackers more successful access to a business’s online environment.
With that in mind, organisations need to tighten email security (as they should be doing most years) but also consider battening down the digital hatches on their collaborative online environments too. What’s more, cybersecurity teams need to be acutely aware of any AI and ChatGPT tools their own organisation is planning to implement in 2024 and make sure they don’t compromise their other digital assets.
In 2024, as AI and ChatGPT continue to evolve and become more prominent, expect cybercriminals to continue to diversify their mediums to reach their victims beyond just plain old email – but also phone, and online “help” chats, or whatever new vessel AI brings to the fore.
Security regulations will become even more watertight
Day-to-day, security regulation is as much of a help to cybersecurity professionals, as it is another weight around their neck. It’s, after all, another hurdle to navigate in an already complex environment. But, as we move into 2024, where cybercriminals are becoming increasingly proficient, cyber professionals will no doubt be grateful to hear there’s more to come in 2024. Australia’s introduction of a Cybersecurity Strategy will be coupled with increased data regulation in the UK and more consumer laws in the U.S.
Regulation provides clear guidelines on how to react to attacks so that there are no more blurred lines or misunderstandings around what should and shouldn’t be prioritised. It also offers an opportunity for organisations to identify areas needing improvement in their cybersecurity protections, where needed. And finally, it’s clear in pointing to which bodies certain incidents should be reported to. Which is useful not just for other would-be victims, but for protecting the critical national infrastructure.
In 2024, cybersecurity professionals will need to be adept at not just navigating these new regulations but also communicating the impact of not doing so to their bosses. In Australia, a single reporting portal on cyber.gov.au will be created to simplify compliance and fresh data retention requirements will come in. While there will be no introduction of further director duties, company leaders will have to demonstrate concrete steps to reduce risk if things go wrong.
There’ll be even more skills needed to adequately fight cybercrime in 2024
By the end of the coming year, the cost of cyber-attacks on the global economy is predicted to top $10.5 trillion. This staggering amount reflects the growing need for cyber security to be treated as a strategic priority on an individual, organisational, and governmental level. And with that, there’s never been more of a need for an influx of skills in the sector. Growing and professionalising a local cybersecurity workforce is one of the key recommendations from the Australian government’s Cybersecurity Strategy.
The truth of the matter is that the cybersecurity industry is evolving at a rate of knots – and we can expect more of the same next year. Unlike other job roles, it requires a constant, ever-evolving awareness of the most current and risky threats – not just across one’s own business, or even their own region, but across different regions around the world too.
To acquire that level of knowledge requires in-depth research and investigation in order to achieve optimal protection. Alongside it, there’s more need than ever before for cybersecurity professionals to be wonderful communicators. Because it’s not just about the technology that powers or stops a threat that takes up a big part of the job, it’s also a need to inform and reassure clients and leaders.
In 2024, cybersecurity leaders must keep a steady pipeline of news and threat intelligence moving from their department up to the very top (and the very bottom) of a business).
Supply chain attacks will continue to grow in volume and strength
Threat actors are increasingly targeting software supply chains to attack organisations on a global basis and becoming far more adept at doing so. So much so that, just recently, the UK’s National Cyber Security Centre was forced to issue a joint advisory with South Korea’s National Intelligence Service (NIS) to ward against them, while warning about supply chains was one of the most consistent features of the Australian government’s Cybersecurity Strategy when it came to forecasts of business disruption.
Furthermore, a number of threat actors are now leveraging more zero-day vulnerabilities and exploits in third-party software to gain access to specific targets, or indiscriminate organisations, through their suppliers. In an increasingly digital and interconnected world, we can expect software supply chain attacks to have an even greater impact in the new year and beyond.
Watch out for cloud-jacking
In recent months, there’s been a steep rise in cloud account hijacking the world over. Once a rarity, it’s now become commonplace. So much so that its increased prevalence should be front of mind for cybersecurity professionals in 2024.
Why? Well, once a cyber attack has made it into the cloud via one account – it’s likely not far away from accessing them all at the touch of the button. As more organisations move to the cloud, it becomes a much more attractive target for threat actors, and they’re spending more time and resources than ever before trying to get into that environment. What’s more, during traditional attacks targeting onsite servers, malicious hackers typically need their own port-scanning tools to detect what systems are in an enterprise, and where the weak exploitable spots are. But during cloud attacks, those port scanners aren’t needed.
In the new year, cybersecurity professionals should not just think about protecting individuals, their technology, or simply defending against particular threats, but focusing on protecting their cloud environment above all else. From 17-year-old tech whizzes, to the bigger players pitting attacks against countries’ national infrastructures, expect all cybercriminals to make a habit of cloud account-jacking next year.
Keep up to date with our stories on LinkedIn, Twitter, Facebook and Instagram.
