CVE-2024-3400: PAN-OS Command Injection Vulnerability in GlobalProtect Gateway. Learn More

CVE-2024-3400: PAN-OS Command Injection Vulnerability in GlobalProtect Gateway. Learn More

Services
Capture
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

twi-managed-portal-color
Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

twi-briefcase-color-svg
Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

tw-laptop-data
Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

twi-database-color-svg
Database Security

Prevent unauthorized access and exceed compliance requirements.

twi-email-color-svg
Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

tw-officer
Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

tw-network
Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

Trustwave 2023 Cybersecurity Predictions: Part 1

In predicting what will transpire in cybersecurity in 2023, the best method is to look at past experience. As with any security and criminal activity, threat actors tend to build upon what they have done in the past, adding new twists to keep their tactics fresh and effective.

So, taking this into consideration, it is no surprise that Trustwave's security experts see much of the same type of attacks that plagued 2022 continuing. Ransomware shows no signs of abating, attackers will target operational technology, and security teams will be forced to do more with less financial support.

The major differentiator from last year is the Russia-Ukraine War. The war has not only caused unmeasurable levels of human suffering but is the fulcrum on which a large cyberwar is being fought between the two opponents. This war has manifested itself through attacks centered on each nation and in some cases, striking targets in countries supporting their enemy.

So, let's dive into what Trustwave's experts are predicting for 2023 and don’t forget to come back tomorrow for Trustwave 2023 Cybersecurity Predictions: Part 2.

 

19419_ed-williams

Ed Williams, Vice President, SpiderLabs Pen Testing

When it comes to my 2023 predictions, little has changed since last year. Unfortunately, we continue to see organizations struggle with patching, password management, and robust, secure policy creation across large, complex organizations. This is evident with the continued success of ransomware.

Speaking of ransomware, which is something we often protect our clients against, a key factor is breaking down the common attack paths of ransomware. Once we accomplish this task, the ability to mitigate ransomware is far easier than trying to mitigate ransomware as a whole.

If I look forward to 2023 while wearing my pen-testing hat, which of course, is black, I'm still concerned that the basics are not an organization's primary concern. We know that threat actors are using known CVEs to gain a foothold into organizations, most of these CVEs are from 2020 and 2021 and should in fact already be fully mitigated/patched.

So, why are they not patched? All too often, we see organizations drowning in "spreadsheet hell" around their patching processes and are quite often trying to boil the ocean instead of really focusing on key vulnerabilities for key assets.

But it's not all bad news. Within Trustwave, we're using machine learning and AI to help our clients better understand the risks they are facing and helping with ransomware mitigation, ensuring that the basics are covered and increasing the cyber maturity of our clients, which is important to us. 

 

19420_spencer-ingram

Spencer Ingram, Senior Vice President, Operations

Looking ahead to 2023, I predict we will see an increase in attacks by threat actors using APIs as an attack vector. APIs cannot be treated the same way as one would treat web applications. Not only is secure-by-design coding required, ensuring design errors and misconfigurations are removed from the equation, but utilizing proactive cybersecurity solutions to test and validate the API is behaving correctly is necessary. Understanding how API calls react to various inputs, watching for brute force attacks or credential stuffing, and monitoring traffic flows are layered solutions to help ensure the API is hardened and secure. Akamai, Salt Security and analyst firm, Gartner, all agree, having released reports earlier this year highlighting the expanding attack surface and growth in API attacks.

Additionally, those organizations that rely on operational technology will have to be on guard as we expect threat actors using malware such as Industroyer2 and Trisis/TRITON to continue their attacks. The most likely reason behind these attacks is that these environments are often running legacy systems, in unpatched environments, and are ripe for well-known exploits while increasingly being connected to the IT network, allowing a bridge to Threat Actors. CISOs who gain responsibility for securing these legacy networks should ensure appropriate boundaries between environments are put in place, using the Purdue model as an example. This type of error will lead threat actors to create additional Metasploit-like toolsets such as PIPEDREAM. The Purdue Model is a structural model for industrial control system security focusing on the segmentation of physical processes, various sensors, supervisory controls, operations, and logistics and while access to the cloud does complicate OT/IoT/IoMT environments, the model is still relevant.

Another issue that will continue into 2023 is the general lack of funding afflicting so many security teams worldwide. An unfortunate outcome here is CISOs may know their organization is vulnerable but will not have the financial resources required to fix the problems. In a way, this is similar to the 'failure to patch' epidemic many suffer from today. CISOs should go on the attack, using limited budgets to proactively uncover weaknesses in their environment through cybersecurity controls such as vulnerability scanning and continuous threat hunting.

On the plus side, we think more companies will take the mature view of "assumption of breach," and although their security teams may already be overworked and overstressed, they will spend more time and money to understand their entire attack surface. This change will improve asset-based risk management based on easy-to-use-and-deploy configuration management databases (CMDBs), providing network and asset controls ensuring “shadow” systems are not stood-up within the environment, unknowingly. 

 

19421_jesse-emerson

Jesse Emerson, Vice President, Solution Architecture & Engineering

Ransomware and specifically ransomware-as-a-Service will continue to be top of mind, and to counter this threat, a plethora of ransomware-specific solutions will enter the market, and the capabilities of these solutions will quickly become features in broader platform XDR tools.

Managed Detection and Response (MDR) will become more tightly defined in the industry and will continue to be widely adopted across verticals and organizations of all sizes, often displacing or significantly altering the expectations of "traditional" SOC operations and tools, including SIEM. 

Due to economic pressures, many CISOs will be faced with cost-reduction or cost-optimization challenges, forcing them to consolidate products and service vendors while looking for ways to maintain their organization's security. This factor will also increase the "partnership" aspect of these relationships, moving from a detached "vendor management" approach to one with a more shared commitment to achieving outcomes. Hybrid and Co-Managed solution formats will be highly valued as a result.

The need for and investment in OT security solutions will continue to accelerate, with safety-impacting threats surfacing in multiple geographies. 

 

19424_nicke1

Nick Ellsmore, Senior Vice President, Worldwide Consulting & Professional Services

Almost every company will spin up a project to remove, delete, destroy, and otherwise reduce the amount of sensitive data they hold. We can expect the phrase "data is the new oil," to be replaced by "data is the new uranium." 

The weight of incoming data security regulations will crush some businesses. We will see companies leaving certain lines of business because they cannot afford the cybersecurity compliance burden. 

We are coming to the end of the 'de-centralization' period of cybersecurity in which everyone tries to do everything themselves, and we are shifting into a 're-centralization' phase where a small number of players will take on the heavy burden of protecting the majority of the market. We see this in things like "shared service hubs" in government and are heading towards shared Identity Service Providers in government to mitigate against ID breaches in private sector organizations. 

 

19432_picture1ffff

 

Latest Trustwave Blogs

The Power of Red and Purple Team Drills in Enhancing Offensive Security Programs

Despite investing in costly security solutions, keeping up with patches, and educating employees about suspicious emails, breaches still occur, leaving many organizations to wonder why they are...

Read More

Balancing Innovation and Security: How Offensive Security Can Help Navigate the Tech Industry’s Dual Challenges

Two of the greatest threats facing technology-focused organizations are their often-quick adoption of new technologies, such as artificial intelligence (AI), without taking security measures into...

Read More

Trustwave Government Solutions (TGS) Salutes New Mexico’s New Cybersecurity Executive Order

New Mexico Governor Michelle Lujan Grisham issued an Executive Order to shore up the state’s cybersecurity readiness and better safeguard sensitive data by conducting a state-wide security assessment...

Read More