What Should CISO’s Look Out For In 2023?

As we look ahead to the New Year, CISOs should be quite rightly cautious about the threat landscape. With the effects of the pandemic largely behind us, it was hoped that 2022 would bring calm and composure, but instead it has brought more turbulence. 

From the Russian invasion of Ukraine to the growing cost of living crisis, it’s been another incredibly tough year for all – and has made the threat landscape precarious. 

Indeed, threat actors have continued to expand and evolve their attack methods, leveraging new techniques and exploiting a series of emerging vulnerabilities. 

Here, we look at four key emerging trends that we have observed this year and expect to grow throughout 2023. 

1.    HEAT Attacks 

Moves from threat actors to understand common technologies across the security stack and tailor attacks to bypass these tools is a pressing problem for enterprises. Indeed, modern threats are becoming increasingly advanced and evasive as adversaries come up with ways of getting around defences that are all too often inadequate or outdated.  

Throughout the last year, The Menlo Labs team has been tracking a distinct and notable rise in Highly Evasive Adaptive Threat (HEAT) techniques – a class of cyber threats that have been tailored to evade protective tools such as firewalls, secure web gateways, malware analysis including sandboxing, URL reputation and phishing detection technologies. 

Indeed, Menlo Labs identified a 224% increase in 2021, and we’re expecting a similarly alarming increase this year as attackers have further evolved their attack methods. If firms continue to lean heavily on traditional detect and respond security techniques, attackers will find success in HEAT-based endeavours.  

2.    Basic security Failures 

Unfortunately, basic security failures at even some of the most renowned organisations in the world continue to offer open doors for attackers to step through and begin to wreak havoc.  Take the attack on Uber in September 2022. Here, a lone threat actor was able to gain administrative control over the ride hailing giant’s IT systems and security tools owing to an exposed PowerShell script that contained admin credentials to the firm’s privileged access management (PAM) platform.  Indeed, it is a telling example. It doesn’t matter how extensive an organisation’s security investments might be, or how sophisticated their technologies are.

Often, threat actors can use simple and proven methods such as social engineering techniques to find ways around them.  

This example hasn’t just reiterated that there is simply no silver bullet or panacea to stopping attacks. Indeed, the Uber breach also showed multi-factor authentication (MFA) push notifications to be exploitable, causing widespread concern and a demand for the use of FIDO2 passkeys and hardware tokens in replace of passwords. This is something we might begin to see gather momentum in 2023. However, it will take a lot of work to implement it on a widespread basis, and even then, we foresee attackers simply finding the next weakest link in the chain. 

3.    Browser-based Attacks 

The third trend we see accelerating through 2023 is browser-based attacks. Undoubtedly the biggest attack surface available for threat actors to exploit today, it is critical that the security sector takes greater steps to protect this space. 

Indeed, several vendors are already looking at ways to add security controls directly inside the browser, moving away from traditional methods of improving protection with a separate endpoint agent or via the network edge where firewalls or secure web gateways are used.  

It’s pleasing to see major names such as Google and Microsoft making headway in this domain. Both organisations are developing and implementing built-in controls inside their respective Chrome and Edge browsers to secure at the browser level, rather than the network edge. 

However, threat actors seem to be determined to remain one step ahead. Browser attacks are increasing, with attackers exploiting new and old vulnerabilities, and developing new techniques such as HTTP Smuggling. 

As a result, remote browser isolation (RBI) is becoming an increasingly core principle of Zero Trust security that stipulates that no device or user – not even the browser – can be trusted. 

4.    One Size Doesn’t Fit All 

Fourthly, it is vital for organisations to remember that one size simply doesn’t fit all when it comes to security, and bespoke technology combinations and strategies are still the way to go. 

Recent reports from Gartner have suggested that many organisations are pursuing strategies focused on security vendor consolidation, cutting the number of providers they are working with for their security needs. This has been particularly prevalent in more complicated arenas such as secure access service edge (SASE) and extended detection and response (XDR).  

The motivation is less cost focused, and more about reducing complexity and improving risk management abilities. 

And while policies of continuous improvement are always going to be encouraged when it comes to security, it is important that organisations don’t discard best of breed solutions in the process.  

Adopting Zero Trust 

Policies such as Zero Trust will go a long way in improving security postures. Fortunately, this is a positive trend that we can expect to see in 2023, with many organisations already exploring Zero Trust as a policy in a more active manner. According to a survey from Verizon, presented in its 2022 Data Breach Investigations Report, 82% of respondents revealed that they had adopted or were considering adopting a Zero Trust approach to security.

What is the benefit of Zero Trust? Unlike outdated detect and respond solutions that weren’t built for cloud operating models and browser-based operations that now dominate our working world, Zero Trust has been designed to address risks in the current environment.

It recognises trust in a network as a vulnerability, demanding that all traffic (be it emails, documents, websites, videos or other) should always be scrutinised and verified. Equally, it advocates the ‘principle of least privilege’ where users are only given access to the enterprise resources and applications they truly need to carry out their daily tasks effectively. 

Together, these policies build resilience. Should attackers gain access to a network, they won’t be able to move freely, mitigating or limiting the potential damages of any attack.

Indeed, there are tools available to support organisations in achieving Zero Trust in the truest sense, with isolation technology being a prime example. Isolation works by moving the browser execution process away from the desktop and into the cloud, rendering only safe web content on the endpoint.

Resultantly, no active content from the internet – be it good or bad – is ever downloaded directly to the endpoint. Unlike other technologies, isolation isn’t ‘almost safe’. Rather, it can wholesale stop cyber attacks at source, 100% of the time by ensuring that attackers never have an opportunity to execute their payloads.
  
Jonathan Lee is a Senior Product Manager at Menlo Security.

You Might Also Read: 

Under Pressure - Can CISOs Avoid Burnout?:

 

« Fake Instagram Message Attacks Breach Email Security
Password Manager LastPass Gets Hacked »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Backup Technology

Backup Technology

Backup Technology is a world leader in the Online Cloud Backup, Disaster Recovery and Business Continuity market.

CloudPassage

CloudPassage

CloudPassage, a cloud security and compliance pioneer, safeguards cloud infrastructure for the world’s best-recognized brands.

HyTrust

HyTrust

HyTrust specialises in security, compliance and control software for virtualization and cloud environments.

Igloo Security

Igloo Security

Igloo Security is a leader and pioneer in SIEM (Security Information & Event Management), PSIM (Physical Security Information Management) and MSS (Managed Security Services).

Inky Technology Corp

Inky Technology Corp

Inky® Phish Fence is an email protection gateway that uses sophisticated AI, machine learning and computer vision algorithms to block deep sea phishing attacks that get through every other system.

Digittrade

Digittrade

Digittrade develop and produce external encrypted hard disks and secure communications apps.

Magix Security

Magix Security

Magix Security assesses the cyber threat, gives you visibility of how vulnerable your business is to attack, and provides cybercrime detection and prevention services.

Red Sift

Red Sift

Red Sift is the only integrated cloud email and brand protection platform, supporting organizations to secure their communications.

FraudWatch International

FraudWatch International

FraudWatch has been protecting client brands around the world since 2003, and are the leaders in online brand protection from phishing, malware, social media and mobile apps impersonation.

Inspira Enterprise

Inspira Enterprise

Inspira Enterprise is a leading digital transformation company with expertise in Cyber Security, Internet of Things (IOT), Blockchain, Big Data & Analytics, Intelligent Automation and Cloud Computing.

NetApp Excellerator

NetApp Excellerator

NetApp Excellerator is NetApp’s global start-up program that aims to fuel innovation by partnering with deep-tech start-ups.

Asimily

Asimily

Asimily’s IoMT risk remediation platform holistically secures the mission-critical healthcare devices that deliver safe and reliable care.

Sprocket Security

Sprocket Security

Sprocket Security protects your business by monitoring the cybersecurity landscape and performing continuous penetration testing services.

runZero

runZero

runZero delivers the most complete security visibility possible, providing you the ultimate foundation for successfully managing exposures and compliance.

Integrated Cyber Solutions (ICS)

Integrated Cyber Solutions (ICS)

Integrated Cyber Solutions is a managed security service provider that humanizes cybersecurity managed services to the Small-to-Medium Business (SMB) and Small-to-Medium Enterprise (SME) sectors.

Core42

Core42

Core42 provides a full-spectrum of AI enablement solutions covering cloud, data, cybersecurity and digital services designed for customer success.