Cyber Security Predictions For 2023

Just a year ago, predictions for 2022 picked out the proliferation of ransomware as a deadly threat to business, alongside the vulnerability generated by new ways of remote working in the hybrid environment. Following the turbulence caused by Coronavirus, more organisations were negotiating the challenges of migrating their network infrastructures to the Cloud.

Another consistent theme was the chronic shortage of talent in the form of skilled cyber security professionals supported by a trained, security- aware workforce. What's the picture for 2023?

The predictions from one expert, Andy Harris, the CTO of security automation firm Osirium, repeat these themes, but with some unpleasant variations, as criminal hackers work together, evolve and become more capable, to target specific sectors victims, all sharpened by events in Ukraine. 

Hacker teams offering ‘Victims-as-a-Service’ will rise. 

For the last couple of years, threat actors have been team-based. Before cryptocurrency, they were lone wolves – or, occasionally, a loosely connected group who’d met online. Then they started working in teams, and because they were paid money those teams became tightly bonded. Over the next year we’ll see more teams divide out into skills-based groups.  
 
REvil demonstrated how successful the ransomware-as-a-service model could be, offering an end-to-end solution for attackers that included encryption software, access tools, helpdesks for victims, payment services and much more. But there’s still a market for smaller teams that focus on specific attack skills. For example, they may breach defences to acquire user or admin credentials, or even install malware to provide back door entry for use at a later date. They don’t have to take on the risk of executing the attack or handling payment; they can make good money just by selling the access on dark web marketplaces. 
 
Company intelligence may be another specialist service. For example, knowing what cyber insurance a potential victim has could reveal the kinds of defences they’ll have in place and even how much they’re insured for, so ransomware demands can be tailored. New details emerging around the MediBank breach story give an insight into just how much information and access is up for sale on the dark web. 
 
It will become more crucial than ever that organisations protect their endpoints to reduce the attack surface, and restrict access credentials – especially those that allow key changes to be made, or enable lateral movement across systems and networks – to only those individuals who need them and for only the time they’re needed.” 
 
Ransomware attacks will shift to smaller targets – and the education sector. 

Ransomware will always go where the maximum reward and minimum risk is. Attackers will target organisations that have the lowest defences, or the least resources to defend against or recover from an attack, as they’re most likely to pay. State actors will still go after large institutions like the NHS, which implement robust defences, but there are many small to mid-size companies that invest less in protection, have limited technical skills, and find cyber insurance expensive, all of which makes them easy targets.  
 
We can expect smaller scale attacks, for lower amounts of money, but which target a much broader base. The trend will probably hit education providers hard: education is already the sector most likely to be targeted by a malware, cryptojacking or encrypted attack, according to SonicWall’s 2022 Cyber Threat Report.  
 
For instance, every school in the UK is being asked to join a multi-academy trust, where groups of schools will be responsible for themselves. With that change comes great vulnerability. This ‘network’ of schools would be a prime target for ransomware attacks; they are connected, and they’re unlikely to have the resilience or capabilities to protect against attacks. They may have no choice but to reallocate their limited funds to pay ransom demands which, in turn, will affect their teaching.” 
 
Attackers will refocus on ransomware as the Ukraine conflict winds down. 

The rate of growth in ransomware attacks is currently slowing slightly – but this will prove to be a false dawn. Currently, the most successful teams of cyber-criminals are being focused on attacking Ukraine’s critical infrastructure. The second that conflict is over, all the technology, tools and resources will be redeployed back into ransomware attacks – so organisations and nation states alike must not become complacent.” 
 
Cyber insurance will become a board-level issue. 

Cyber insurance will get more expensive, and more difficult to acquire, with increasingly heavy requirements on clients to take all necessary and reasonable precautions before they can buy it. Insurers are also less likely to pay out – and the more claims there are, the more they’ll push back. 
 
As a result, more organisations may decide not to take out insurance at all, instead focusing on ploughing resources into protection. If this happens, we can expect to see insurance companies partnering with big consulting firms to offer joined up services. Rule no.1, insurance always wins! 
 
Pointless it may be, if insurers are never going to pay out…but buying cyber insurance may simply become a necessary cost of doing business – a box that must be ticked to demonstrate to shareholders that all steps are being taken to protect the business, and ensure resilience and continuity.  
 
Proof that privileged access credentials are being protected is one of the requirements increasingly being demanded by cyber insurers. Organisations should invest in solutions that will manage these powerful accounts, without impeding the productivity of their employees.” 

Andy Harris is Chief Technology Officer at Osirium

You Might Also Read: 

Privileged & Protected - Managing Access At The Endpoint:

 

« Ensure Your Organisation’s Staff Has Cyber Security Awareness For 2023
How to Combat Common Information & Collaboration Security Threats »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Skybox Security

Skybox Security

Skybox combines firewall and network device data with vulnerability and threat intelligence, putting security decisions in your unique network context.

Zurich

Zurich

Zurich is a leading multi-line insurer providing a wide range of property and casualty, and life insurance products and services in more than 210 countries and territories.

TSUNAMI

TSUNAMI

The TSUNAMi center focuses on software and system security and how trustworthy software can be built from COTS software components.

Salt Communications

Salt Communications

Salt communications is a global leader in secure communications. Our bespoke platform is the secure communications solution that uniquely gives complete control to our customers.

Computest

Computest

Computest security testing services include Mobile app security, Vulnerability assessments, Attack & penetration testing, Security awareness training, Network security assessments.

Tecnalia Research & Innovation

Tecnalia Research & Innovation

Tecnalia is the largest center of applied research and technological development in Spain, a benchmark in Europe and a member of the Basque Research and Technology Alliance.

Tangible Security

Tangible Security

Tangible employs the most sophisticated cyber security tools and techniques available to protect our clients’ sensitive data, infrastructure and competitive advantage.

Quantum Security Solutions (QSec)

Quantum Security Solutions (QSec)

QSec is an innovative information security consultancy based in Ghana. We can provide your organisation with information security products and services that assure against information risk.

KSOC Labs

KSOC Labs

KSOC is an event-driven SaaS platform built to automatically remediate Kubernetes security risks.

Data Protection Commission (DPC)

Data Protection Commission (DPC)

The Data Protection Commission (DPC) is the national independent authority responsible for upholding the fundamental right of individuals in the EU to have their personal data protected.

Nextgen Group

Nextgen Group

Nextgen Group is a pioneering technology services group with innovative and unique services across enterprise software, cloud, data management, and cybersecurity solutions.

Intelligent Technical Solutions (ITS)

Intelligent Technical Solutions (ITS)

We help businesses manage their technology. Intelligent Technical Solutions provide you with the right technical solution, so you can get back to running your business.

Utimaco

Utimaco

UTIMACO develops on-premises and cloud-based hardware security modules, solutions for key management, data protection and identity management as well as data intelligence solutions.

CyberXposure

CyberXposure

CyberXposure has been built by a team comprising of Cyber Security Professionals and SAAS experts in data backup, disaster recovery and cyber-security.

Entitle

Entitle

Entitle's SaaS-based platform automates how permissions are managed, enabling organizations to eliminate bottlenecks and implement robust cloud least privilege access.

SignPath

SignPath

SignPath provides leading-edge software and SaaS services that ensure code integrity from development to distribution.