Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Services
Capture
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

twi-managed-portal-color
Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

twi-briefcase-color-svg
Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

tw-laptop-data
Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

twi-database-color-svg
Database Security

Prevent unauthorized access and exceed compliance requirements.

twi-email-color-svg
Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

tw-officer
Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

tw-network
Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

Trustwave 2024 Predictions Part 2: Cyber Talent Shortage and the US Federal Government

There is every reason to believe that 2024 will be an interesting year in the cybersecurity space, making it difficult to foresee what might transpire. However, Trustwave’s leadership is up to the task.

 

In Trustwave 2024 Predictions Part 1, we looked at what might hold in store for the upcoming US election cycle and AI. Now, we will move on to some general thoughts on the cybersecurity talent shortage, cybersecurity plans by US federal government, and types of attacks most likely to take place.

  

Cybersecurity Talent Shortage

 

Ed Williams, VP of Trustwave SpiderLabs EMEA  

 

The need for technical and skilled cyber talent is critical; technology moves fast, and malicious threat actors move even quicker. 

 

I believe the shortage will increase, and the requirement for talented people will continue. Organizations can help close the gap by upskilling their current workforce; helping them make smart cybersecurity decisions in their day-to-day role is critical. The blend between security and common IT-related tasks is getting smaller, and there is an opportunity to ensure that the security gap is also being closed.

 

 

Kory Daniels, Trustwave CISO 

 

AI is also going to allow companies to hire people who otherwise might not quite have had the technical qualifications to be a high-level security analyst. What I see is the development of Large Language Models (LLMs) that will essentially fill the expertise gap that some new hires might have. 

 

When an analyst is confronted with an issue that they are not ready to handle, the AI can go into the company’s knowledge base and pull the required information.

 

There is also a role generative AI can play in managing a SIEM tool. A SIEM is an excellent alert tool, but not very good at investigations. Generative AI empowers investigation to bring more content to the analyst without the analyst having to pivot to either tools or more importantly bring in other people. They will be able to do their job without inundating the IT team with questions and requests.

 

General Thoughts on 2024

 

Bill Rucker, President Trustwave Government Solutions

 

I believe the US government will do more in 2024 to keep pace with technological innovations such as AI and quantum computing. The Executive Order on AI shows that this is a known concern that requires more investment. According to the recent roadmap announcement, CISA also has an AI investment focus.  AI has many great uses, but it also presents many risks, including the innovations it will give nation-states and bad actors to use it to improve their attack methods and adversarial planning.

 

Quantum computing has been a topic for several years due to its potential to change the threat landscape immediately and make things that had been previously impossible a reality. In fact, the US Department of Energy (DOE) is investing to further understand what has already been done in this area. What truly concerns me is how a threat actor could use quantum in adversarial actions.

 

I feel there is still MUCH blocking and tackling to do. The Executive Orders and Binding Operational Directives from OMB in cyber are reaching their two to three-year mark of being in effect, and actions that should have been taken or planned at this stage are still incomplete.

 

Then, there is the issue that many aspects like Zero Trust and other initiatives have only had a technology focus, often missing the people and process part. 

 

Public sector systems still have many legacy platforms that need innovation or additional protections to remain secure. 

 

This is reflected in the fact that more than 70% of our engagements in penetration testing, cyber assessments, or data protection discovery result in our teams finding an enormous number of previously existing issues. These include open remote desktops, cross-site scripting vulnerabilities, high-value assets, databases open to the Internet, and weak or insufficient credentials being used.

 

I hope to see a “refocus” on the basics, which should include third-party penetration testing, next-generation cyber operations with hybrid and third-party partner monitoring, support to ensure a fresh set of eyes on the situation. This will include moving past just conducting compliance or basic vulnerability scanning to a focus on the high-value assets and the users, critical systems, user rights reviews, and monitoring of those systems that should have a higher level of cyber mission importance. 

 

Ziv Mador, VP, Security Research, Trustwave SpiderLabs

 

We will continue to see large-scale ransomware attacks, and in all likelihood, these will continue to grow as they deliver a very high return on investment for threat actors. This is especially true when combined with double-extortion techniques (lock files/access and exfiltrate them for additional pressure). Ransomware attacks have become money machines for these threat groups.

 

Tools used by cybercriminals to conduct their business: underground forums, cryptocurrencies, Telegram, and other encrypted communications, will likely continue and grow because they provide anonymity and ease of use.

 

Supply chain attacks will likely continue and expand because of the ability to impact many organizations through a single breach.

 

Predict-AI-Blog-2Click the image to download the 2023 Manufacturing Threat Landscape report now!

 

Latest Trustwave Blogs

Defending Healthcare Databases: Strategies to Safeguard Critical Information

The healthcare sector continues to be a primary target for threat actors, with 2023 seeing a record number of data breaches and compromised records. While successful attacks are inevitable, it’s...

Read More

Trustwave SpiderLabs: Ransomware Gangs Dominate 2024 Education Threat Landscape

The security teams manning the defenses at the higher education and primary school system levels often find themselves being tested by threat actors taking advantage of the sector's inherent cyber...

Read More

LockBit Takedown: Law Enforcement Disrupts Operations, but Ransomware Threats Likely to Persist

The news that US, UK, and other international law enforcement agencies disrupted LockBit is welcome, as stopping any threat group activity is always a positive. The unfortunate aspect is this blow...

Read More