Freely subscribe to our NEWSLETTER

Here are five specific trends for 2023 that you need to be aware of:

• The business of cybercrime will be further professionalised. The return of malware strains like Emotet, Conti, and Trickbot indicates an expansion of cybercrime for hire. In particular, the growth of ransomware-as-a-service is enabling criminals without deep technical skills to make money, either by extorting a ransom for decryption keys or selling stolen data on the dark web or to a victim’s competitors. Accordingly, organisations should expect an increase in phishing campaigns. Vital defence strategies include timely patching and updating of software, as well as locking down network access with multifactor authentication (MFA) and privileged access management (PAM) solutions

• Supply chain attacks will intensify. Modern organisations rely on complex supply chains, including small and medium businesses (SMBs) and managed service providers (MSPs). Adversaries will increasingly target these suppliers rather than the larger enterprises knowing that they provide a path into multiple partners and customers. To address this threat, organisations of all sizes, while conducting a risk assessment, need to take into account the vulnerabilities of all third-party software or firmware

• Understaffing will increase the role of channel partners. Demand for cybersecurity professionals is far outpacing supply. This shortage of cybersecurity talent will increase risks for businesses as attacks become even more sophisticated. To overcome this challenge, organisations will rely more on their trusted security partners, such as channel partners, system integrators, MSPs and MSSPs

• The human factor will become a top security concern. Users have long been a weak link in IT security, prone to opening infected email attachments, clicking malicious links and other risky behaviour. Now, rapid advancements in social engineering and easy-to-use deep fake technology are enabling attackers to trick more users into falling for their schemes. Accordingly, comprehensive auditing of user activity will become even more crucial for spotting abnormal behaviour in time to prevent serious incidents. In addition, implementing a zero-standing privilege (ZSP) approach will help organisations prevent abuse of their most powerful accounts, either unintentionally by their owners or by adversaries who compromise them

• Vendor consolidation will continue gaining momentum. To combat cybercrime, organisations keep investing into IT security. But more tools don’t always mean better security — point solutions from different vendors operate separately, offer overlapping or conflicting functionality, and require organisations to deal with multiple support teams. To minimise the security gaps caused by this complexity, organisations are now looking to build a security architecture with a select, smaller group of trusted vendors, which offers the additional benefit of reduced costs from loyalty pricing. In turn, it leads to a faster return on investment (ROI) which is increasingly important in the current economic climate

“It’s not getting any easier for IT professionals to secure their environments. Indeed, cybercriminals keep inventing new attack tactics and techniques,” says Michael Paye. “To respond effectively, it is vital to identify what really matters and concentrate on protecting the most critical assets. Organisations should regularly reassess their risks to address the most likely and potentially damaging threats and focus on increasing their cyber resilience to be able to operate even under an ongoing attack.”