Cyber Security Predictions For 2023

Just a year ago, predictions for 2022 picked out the proliferation of ransomware as a deadly threat to business, alongside the vulnerability generated by new ways of remote working in the hybrid environment. Following the turbulence caused by Coronavirus, more organisations were negotiating the challenges of migrating their network infrastructures to the Cloud.

Another consistent theme was the chronic shortage of talent in the form of skilled cyber security professionals supported by a trained, security- aware workforce. What's the picture for 2023?

The predictions from one expert, Andy Harris, the CTO of security automation firm Osirium, repeat these themes, but with some unpleasant variations, as criminal hackers work together, evolve and become more capable, to target specific sectors victims, all sharpened by events in Ukraine. 

Hacker teams offering ‘Victims-as-a-Service’ will rise. 

For the last couple of years, threat actors have been team-based. Before cryptocurrency, they were lone wolves – or, occasionally, a loosely connected group who’d met online. Then they started working in teams, and because they were paid money those teams became tightly bonded. Over the next year we’ll see more teams divide out into skills-based groups.  
 
REvil demonstrated how successful the ransomware-as-a-service model could be, offering an end-to-end solution for attackers that included encryption software, access tools, helpdesks for victims, payment services and much more. But there’s still a market for smaller teams that focus on specific attack skills. For example, they may breach defences to acquire user or admin credentials, or even install malware to provide back door entry for use at a later date. They don’t have to take on the risk of executing the attack or handling payment; they can make good money just by selling the access on dark web marketplaces. 
 
Company intelligence may be another specialist service. For example, knowing what cyber insurance a potential victim has could reveal the kinds of defences they’ll have in place and even how much they’re insured for, so ransomware demands can be tailored. New details emerging around the MediBank breach story give an insight into just how much information and access is up for sale on the dark web. 
 
It will become more crucial than ever that organisations protect their endpoints to reduce the attack surface, and restrict access credentials – especially those that allow key changes to be made, or enable lateral movement across systems and networks – to only those individuals who need them and for only the time they’re needed.” 
 
Ransomware attacks will shift to smaller targets – and the education sector. 

Ransomware will always go where the maximum reward and minimum risk is. Attackers will target organisations that have the lowest defences, or the least resources to defend against or recover from an attack, as they’re most likely to pay. State actors will still go after large institutions like the NHS, which implement robust defences, but there are many small to mid-size companies that invest less in protection, have limited technical skills, and find cyber insurance expensive, all of which makes them easy targets.  
 
We can expect smaller scale attacks, for lower amounts of money, but which target a much broader base. The trend will probably hit education providers hard: education is already the sector most likely to be targeted by a malware, cryptojacking or encrypted attack, according to SonicWall’s 2022 Cyber Threat Report.  
 
For instance, every school in the UK is being asked to join a multi-academy trust, where groups of schools will be responsible for themselves. With that change comes great vulnerability. This ‘network’ of schools would be a prime target for ransomware attacks; they are connected, and they’re unlikely to have the resilience or capabilities to protect against attacks. They may have no choice but to reallocate their limited funds to pay ransom demands which, in turn, will affect their teaching.” 
 
Attackers will refocus on ransomware as the Ukraine conflict winds down. 

The rate of growth in ransomware attacks is currently slowing slightly – but this will prove to be a false dawn. Currently, the most successful teams of cyber-criminals are being focused on attacking Ukraine’s critical infrastructure. The second that conflict is over, all the technology, tools and resources will be redeployed back into ransomware attacks – so organisations and nation states alike must not become complacent.” 
 
Cyber insurance will become a board-level issue. 

Cyber insurance will get more expensive, and more difficult to acquire, with increasingly heavy requirements on clients to take all necessary and reasonable precautions before they can buy it. Insurers are also less likely to pay out – and the more claims there are, the more they’ll push back. 
 
As a result, more organisations may decide not to take out insurance at all, instead focusing on ploughing resources into protection. If this happens, we can expect to see insurance companies partnering with big consulting firms to offer joined up services. Rule no.1, insurance always wins! 
 
Pointless it may be, if insurers are never going to pay out…but buying cyber insurance may simply become a necessary cost of doing business – a box that must be ticked to demonstrate to shareholders that all steps are being taken to protect the business, and ensure resilience and continuity.  
 
Proof that privileged access credentials are being protected is one of the requirements increasingly being demanded by cyber insurers. Organisations should invest in solutions that will manage these powerful accounts, without impeding the productivity of their employees.” 

Andy Harris is Chief Technology Officer at Osirium

You Might Also Read: 

Privileged & Protected - Managing Access At The Endpoint:

 

« Ensure Your Organisation’s Staff Has Cyber Security Awareness For 2023
How to Combat Common Information & Collaboration Security Threats »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

QTS

QTS

QTS Realty Trust, Inc. is a leading provider of secure, compliant data center, hybrid cloud and managed services.

Idaptive

Idaptive

Idaptive delivers Next-Gen Access through a zero trust approach. Idaptive secures access everywhere with single sign-on, adaptive MFA, EMM and analytics.

Corelight

Corelight

Corelight is the most powerful network visibility solution for information security professionals.

Mosaic 451

Mosaic 451

Mosaic451 is a bespoke IT managed services provider and consultancy specializing in information security, operations and design.

Startupbootcamp Fintech & Cybersecurity

Startupbootcamp Fintech & Cybersecurity

Startupbootcamp is the world’s largest network of multi-corporate backed accelerators helping startups scale internationally.

Fudo Security

Fudo Security

Fudo Security is a leading provider of privileged access management and privileged session monitoring solutions.

Protected Media

Protected Media

Protected Media’s advanced cybersecurity ad fraud solution guards you against current and emerging threats across Connected TV, Display and Video advertising.

National Cyber Safety and Security Standards (NCSSS) - India

National Cyber Safety and Security Standards (NCSSS) - India

National Cyber Safety and Security Standards has been started with a great vision to safeguard India from the current threats in the cyber space.

Flatt Security

Flatt Security

Flatt Security is a cyber security startup based in Japan providing security assessments and other cyber security services.

CyberUSA

CyberUSA

CyberUSA is a collaboration of leaders and states focused on a common mission purpose of enabling innovation, education, workforce development, enhanced cyber readiness and resilience.

HWG

HWG

HWG is a company specialized in providing cyber security solutions and consulting services.

Trustaira

Trustaira

Trustaira is the first deep tech solution and service company in Bangladesh.

SecurEnvoy

SecurEnvoy

SecurEnvoy are a leader in designing zero access trust solutions using the latest cutting-edge technologies, to protect your users, devices and data, whatever the location.

White Knight Labs

White Knight Labs

White Knight Labs is a cyber security consultancy that specializes in cybersecurity training.

Automotive Information Sharing & Analysis Center (Auto-ISAC)

Automotive Information Sharing & Analysis Center (Auto-ISAC)

Auto-ISAC provides a forum for companies to analyze and identify threats sooner and share solutions that enhance vehicle cybersecurity.

ZENDATA

ZENDATA

ZENDATA are an innovative provider of intelligent, tailored cybersecurity solutions to global companies and public sector institutions.