Darktrace Predicts Changing Role for CISO

Darktrace Predicts Changing Role for CISO

Looking forward, Darktrace is offering its 2023 Predictions, including where we can expect to see changes in MFA where accessibility and usability continue to dominate the discussion; continued Hactivism from non-state actors where ‘know thy enemy, CISOs lean in on more proactive security and crypto-jackers will get more savvy. CISOs will turn to AI-driven methods to understand attack paths.

Attacker Tradecraft Centers on Identity and MFA
At the core of the vast majority of cyber incidents is the theft and abuse of legitimate credentials, including the recent Uber attack. In this case, Uber experienced a Multi-factor Authentication attack, and we saw that MFA can be defeated, and with Okta, that the MFA companies themselves become targets - potentially as a mechanism to reduce its effectiveness in other customer environments.

Once considered a ‘silver bullet' in the fight against credential stuffing, it has not taken attackers long to find and exploit weaknesses in MFA and they will continue to do so in 2023. MFA will remain critical to basic cyber hygiene, but it will cease to be seen as a stand-alone ‘set and forget' solution. Questions around accessibility and usability continue to dominate the MFA discussion and only to be amplified by increases in cloud and SaaS along with the dissolution of traditional on-prem networks.

Today and in the future, MFA should be viewed as one component of a wider zero-trust architecture, one where behavior-based analytics are central to understanding employee behavior and authenticating the actions taken using certain credentials.

Continued ‘hacktivism' from Non-state Actors Complicates Cyber Attribution and Security Strategies
The so-called ‘vigilante' approach to cyber geopolitics is on the rise. Recent attacks launched by groups such as Killnet, though limited in their operational impact, have not failed in their aim to dominate global headlines in light of the Russo-Ukraine conflict, mounting concerns that these citizen-led operations could become more destructive or that states could use these groups as a deniable proxy.

Yet claims that ‘Russia' launched these attacks can be misleading and add fuel to an already complicated political fire. Cyber attribution and deciphering the extent of state-level tasking is difficult, with blurred lines between state-aligned, state-involved and state-directed increasing the risk of escalation, collateral and misattribution.

In 2023, ‘knowing thy enemy' in cyber will be more complicated than ever before - but it is critical that organizations remain aware of the realities of cyber risk and cease to focus on the ‘boogie man' of the internet that features in sensationalist reporting. Persistent, widely available, lower-sophistication malware and run-of-the-mill phishing campaigns statistically remain a greater global risk to corporations than the newest, most devious exploit kit or ransomware typically associated with APT groups. As it gets harder to name the enemy, we should see organizations moving away from the headlines and towards ensuring operational stability based on a bespoke understanding of their unique risk profile.

Crypto-jacking Neglect Gets Dangerous
The hijacking of computer resources to mine cryptocurrencies is one of the fastest growing types of cyber-threats globally. These attacks are often overlooked as unthreatening ‘background noise', but the reality is that any crypto-mining infection can turn into ransomware, data exfiltration or even an entry point for a human-driven attack at the snap of a finger.

To achieve the scale of deployment that crypto-jackers are looking for, illegitimate network access may use something relatively low-cost - a pervasive software vulnerability or default, weak or otherwise compromised credentials. Straying from the basics may well allow a ransomware actor from following the same path.

In 2023, crypto-jackers will get more perceptive and we might start to see the detrimental effects of what is inevitable or negligible. Security leaders need to ask themselves: "How did this person get in?" How was this person able to shore up the easiest points of entry into the organization? Companies should not live with rogue software and hackers siphoning off their resources - particularly as rising energy prices will mean a greater financial loss is incurred because of illicit crypto mining.

Ransomware Rushes to the Cloud
Ransomware attacks are ever evolving, and as cloud adoption and reliance continue to surge, attackers will continue to follow the data. In 2023, we are likely to see an increase in cloud-enabled data exfiltration in ransomware scenarios in lieu of encryption.

Third-party supply chains offer those with criminal intent with more places to hide and targeting cloud providers instead of a single organization gives attackers more bang for their buck. Attackers may even get creative by threatening third-party cloud providers - a tactic which already impacted the education sector in early October when the Vice Society ransomware gang blackmailed Los Angeles Unified School District (LAUSD), the second largest school district in the United States, and published highly sensitive information, including bank details and psychological health reports of students on the darknet.

Recession requires CISOs to get Serious with the Board about Proactive Security
Cyber security is a boardroom issue, but with growing economic uncertainty, organizations are forced to make tough decisions as they plan 2023 budgets. Rising cyber-insurance premiums are one thing, but as more underwriters introduce exclusions for cyber-attacks attributed to nation-states, organizations will struggle to see the value in such high premiums. Both insurance and compliance have long been seen as ways of ticking the ‘protection' checkbox without achieving true operational assurance, and we need look no further than Colonial Pipeline to see that insurance cannot compensate for long-term business disruption and reputational damage.

In 2023, CISOs will move beyond just insurance and checkbox compliance to opt for more proactive cyber security measures in order to maximize ROI in the face of budget cuts, shifting investment into tools and capabilities that continuously improve their cyber resilience. With human-driven means of ethical hacking, pen-testing and red teaming remaining scarce and expensive as a resource, CISOs will turn to AI-driven methods to proactively understand attack paths, augment red team efforts, harden environments and reduce attack surface vulnerability. Maturity models and end-to-end solutions will also be critical, as well as frank communication between CISOs and the board about the efficacy of continuously testing defenses in the background.

Featured

  • Live From ISC West: Day 2 Recap

    If it’s even possible, Day 2 of ISC West in Las Vegas, Nevada, was even busier than the first. Remember to keep tabs on our Live From ISC West page for news and updates from the show floor at the Venetian, because there’s more news coming out than anyone could be expected to keep track of. Our Live From sponsors—NAPCO Security, Alibi Security, Vistacom, RGB Spectrum, and DoorKing—kept the momentum from Day 1 going with packed booths, happy hours, giveaways, product demonstrations, and more. Read Now

    • Industry Events
    • ISC West
  • Visiting Sin City

    I’m a recovering alcoholic, ten years sober this June. I almost wrote “recovered alcoholic,” because it’s a problem I’ve long since put to bed in every practical sense. But anyone who’s dealt with addiction knows that that part of your brain never goes away. You just learn to tell the difference between that insidious voice in your head and your actual internal monologue, and you get better at telling the other guy to shut up. Read Now

  • On My Way Out the Door

    To answer that one question I always get, at every booth visit, I have seen amazing product technology, solutions and above all else, the people that make it all work. Read Now

    • Industry Events
    • ISC West
  • Return to Form

    My first security trade show was in 2021. At the time, I was awed by the sheer magnitude of the event and the spectacle of products on display. But this was the first major trade show coming out of the pandemic, and the only commentary I heard was how low the attendance was. Two representatives from one booth even spent the last morning playing catch in the aisle with their giveaway stress balls. Read Now

    • Industry Events
    • ISC West

Featured Cybersecurity

New Products

  • ABLOY IP54-rated Integrated Dust Cover

    ABLOY IP54-rated Integrated Dust Cover

    One of the things that keep security managers on high alert is the real possibility the security locks used to safeguard their properties may unexpectedly fail due to environmental conditions. 3

  • SecureAuth

    SecureAuth

    The acceleration of digital transformation initiatives as a result of COVID-19 has created a lasting impact on how businesses empower their workforce and engage customers. 3

  • ALTO Neoxx Electronic Padlock

    ALTO Neoxx Electronic Padlock

    Built to withstand all access control needs, the tough new SALTO Neoxx electronic padlock takes security beyond your expectations. 3