Navigating the cyber security landscape: Trends to watch out for in the second half of 2023

John Mc Loughlin, CEO, J2 Software.

---

The second half of 2023 holds significant implications for businesses worldwide as the landscape of cyber security continues to evolve at an unprecedented pace. Gone are the days of gradual environmental changes and incremental adjustments.

Instead, we find ourselves living in a time of hyper-connectivity and rapidly shifting events that elude our control and defy prediction. Global crises like wars and pandemics, as well as local calamities such as flooding and rampant inflation, have created a perfect storm of uncertainty, intensifying the risks we face and expanding the attack surfaces vulnerable to cyber threats.

Amid this climate of uncertainty, cyber criminals seize the opportunity to exploit our fears and tempt trusted individuals to turn to the dark side. Insider-driven attacks have surged, encompassing both accidental or negligent actions and a growing number of compromises originating from trusted users. When viewed as victimless crimes, many individuals fall prey to these tactics and intentionally provide access. The era of the super malicious insider is upon us.

Lack of visibility and an understanding of intent render organisations unaware of ongoing threats until their names appear in the glaring lights of breach notifications. Needless to say, this is not the kind of shine most people aspire to. To tackle this challenge effectively, gaining insight from a comprehensive cyber resilience framework with a user-centric focus becomes a crucial element of any successful programme.

One aspect of such a programme entails obtaining visibility into user interactions with critical components of insider risk management, including user activity, e-mail, data, machines and the web.

By acquiring a comprehensive view, organisations can readily identify indicators of intent, enabling better decision-making to mitigate and prevent insider risks from manifesting into malicious insider threats.

The continuously evolving nature of the modern workplace has fuelled a persistent rise in successful cyber attacks launched from all corners of the globe. Cyber criminals are solely driven by profit and care little about the industry or the competence of targeted businesses. Therefore, even if you believe your organisation has nothing of value to steal, you are not exempt from their attacks.

If you are not actively working on improving visibility in your cyber security efforts, the second half of 2023 may become a time when your organisation shines in all the wrong ways – making headlines in articles, breach websites and having your sensitive data shared online. Still, you might dismiss this possibility, believing that it won't happen to you or that you have nothing worth stealing.

However, it is important to acknowledge a well-known adage in the cyber security realm: there are two kinds of businesses – those that have been compromised and those that are unaware they have been compromised. The reality is that cyber threats pose the most significant risk to modern businesses. These attacks continue to escalate both in volume and sophistication.

Cyber criminals exploit new vulnerabilities before they can be patched, consistently outpacing the efforts of vendors. Even when patches are available, most businesses lack formal programmes to implement them into their environments.

Regrettably, the modern business landscape struggles to keep up with the challenges of running day-to-day operations, rising costs and prevailing uncertainties. Consequently, many organisations are unaware of existing vulnerabilities or the presence of malicious actors within their digital environments.

Compromised and leaked information, as well as compromised accounts, are discovered on a daily basis across all industries and businesses of every size. No organisation is too small or too large to be affected.

The J2 CSC team constantly identify organisations that have open and accessible platforms and do zero monitoring to identify anomalies and detect compromise. This is the same as having an intruder in your home, but you do not see them because you do not bother to turn on the lights.

Without consistent management of your cyber resilience programme and the enforcement of basic controls, a single oversight can lead to a breach. Attackers effortlessly waltz through the front door when it is left wide open. Businesses of all sizes are often at fault, whether due to using default passwords or neglecting to address known breaches.

Accessing critical systems becomes a walk in the park when you possess the necessary information. All an attacker needs to do is ask, and then they can log in – no hacking required.

Shockingly, less than 28% of businesses enforce the use of multi-factor authentication (MFA), and even among those that do, many neglect to register MFA devices to their accounts. If it takes just one click for you to access your data, it is equally effortless for criminals.

Once cyber criminals gain access to your e-mail system, they effectively gain control over all your information. While perimeter and gateway security remain vital, the failure to recognise internal activities leaves organisations vulnerable to bleeding without ever witnessing the wound. An internal bleed can be just as fatal as an external attack.

You need visibility to give you the capability to identify problems when they occur and destroy the threat before you bleed out. We are hyper connected and it is pointless to throw more money at different solutions if they are not part of a combined cyber resilience programme. It is not effective to close all the windows, but leave the front door open.

In the cyber war, we cannot focus on only one area of the assault. Understand that you are not untouchable. Nobody is.

Stopping attacks is impossible – but you can reduce cyber risk with a structured cyber resilience programme that gives you defence in depth and provides the ability to detect when an attack starts. If you can be alerted at the start of the attack, you can take action before it is too late.

Using ongoing and consistent monitoring, vulnerability analysis and mapping real usage will let you know where you need to apply the bandages to stop the bleed.

Identify, neutralise, remediate and then investigate. Then start all over again. The number of threats will continue to increase – visibility and agility is the only way.

Or keep doing things the way you have always done it. Then you can be assured that the second half of 2023 will be your time to shine, but not necessarily in a good way.

Cyber threats are persistent and evolving. Adapting to the changing landscape and implementing robust cyber security measures is the only way to navigate the complexities of the modern digital world successfully.