There is every reason to believe that 2024 will be an interesting year in the cybersecurity space, making it difficult to foresee what might transpire. However, Trustwave’s leadership is up to the task.
In Trustwave 2024 Predictions Part 1, we looked at what might hold in store for the upcoming US election cycle and AI. Now, we will move on to some general thoughts on the cybersecurity talent shortage, cybersecurity plans by US federal government, and types of attacks most likely to take place.
The need for technical and skilled cyber talent is critical; technology moves fast, and malicious threat actors move even quicker.
I believe the shortage will increase, and the requirement for talented people will continue. Organizations can help close the gap by upskilling their current workforce; helping them make smart cybersecurity decisions in their day-to-day role is critical. The blend between security and common IT-related tasks is getting smaller, and there is an opportunity to ensure that the security gap is also being closed.
AI is also going to allow companies to hire people who otherwise might not quite have had the technical qualifications to be a high-level security analyst. What I see is the development of Large Language Models (LLMs) that will essentially fill the expertise gap that some new hires might have.
When an analyst is confronted with an issue that they are not ready to handle, the AI can go into the company’s knowledge base and pull the required information.
There is also a role generative AI can play in managing a SIEM tool. A SIEM is an excellent alert tool, but not very good at investigations. Generative AI empowers investigation to bring more content to the analyst without the analyst having to pivot to either tools or more importantly bring in other people. They will be able to do their job without inundating the IT team with questions and requests.
I believe the US government will do more in 2024 to keep pace with technological innovations such as AI and quantum computing. The Executive Order on AI shows that this is a known concern that requires more investment. According to the recent roadmap announcement, CISA also has an AI investment focus. AI has many great uses, but it also presents many risks, including the innovations it will give nation-states and bad actors to use it to improve their attack methods and adversarial planning.
Quantum computing has been a topic for several years due to its potential to change the threat landscape immediately and make things that had been previously impossible a reality. In fact, the US Department of Energy (DOE) is investing to further understand what has already been done in this area. What truly concerns me is how a threat actor could use quantum in adversarial actions.
I feel there is still MUCH blocking and tackling to do. The Executive Orders and Binding Operational Directives from OMB in cyber are reaching their two to three-year mark of being in effect, and actions that should have been taken or planned at this stage are still incomplete.
Then, there is the issue that many aspects like Zero Trust and other initiatives have only had a technology focus, often missing the people and process part.
Public sector systems still have many legacy platforms that need innovation or additional protections to remain secure.
This is reflected in the fact that more than 70% of our engagements in penetration testing, cyber assessments, or data protection discovery result in our teams finding an enormous number of previously existing issues. These include open remote desktops, cross-site scripting vulnerabilities, high-value assets, databases open to the Internet, and weak or insufficient credentials being used.
I hope to see a “refocus” on the basics, which should include third-party penetration testing, next-generation cyber operations with hybrid and third-party partner monitoring, support to ensure a fresh set of eyes on the situation. This will include moving past just conducting compliance or basic vulnerability scanning to a focus on the high-value assets and the users, critical systems, user rights reviews, and monitoring of those systems that should have a higher level of cyber mission importance.
We will continue to see large-scale ransomware attacks, and in all likelihood, these will continue to grow as they deliver a very high return on investment for threat actors. This is especially true when combined with double-extortion techniques (lock files/access and exfiltrate them for additional pressure). Ransomware attacks have become money machines for these threat groups.
Tools used by cybercriminals to conduct their business: underground forums, cryptocurrencies, Telegram, and other encrypted communications, will likely continue and grow because they provide anonymity and ease of use.
Supply chain attacks will likely continue and expand because of the ability to impact many organizations through a single breach.