Expert Predictions for the Cybersecurity Industry for 2024: Part I

 The experts of My1Login, i-confidential, and OSP Cyber Academy share their forecasts for the year ahead in the first section of our roundup.

As 2023 comes to an end, cybersecurity professionals should look into their crystal balls to see what the security industry might expect in the coming year. Experts from My1Login, i-confidential, and OSP Cyber Academy share their forecasts for the year ahead in the first section of our roundup.

CEO of My1Login Mike Newman: Cloud migration will increase attack surface

Organizations have been transforming over the past year, and more of their data and apps are now stored in the cloud. Although this has increased service availability and efficiency, it has also increased the corporate attack surface.

Simultaneously, companies are moving their whole corporate directory to the cloud, usually using Microsoft Entra ID platforms. Due to the requirement for manual, password-based authentication, many of the applications that were previously connected with the on-premise corporate directory for Single Sign-On will now require this, burdening users and expanding the attack surface for malevolent actors.

Microsoft Entra ID offers a Single Sign On experience for a limited number of enterprise apps, despite being widely used. Because cloud services cannot natively interact with Microsoft Entra ID, employees will have to rely on several passwords, maybe rising in the future. However, this puts employees—who are the least secure—in possession of login credentials and creates concerning security holes in the organization.

In the upcoming year, malicious actors will still take advantage of these holes, but their attacks will be enhanced by the strength of generative artificial intelligence.

They will design sophisticated phishing emails and utilize artificial intelligence (AI) to fake the login pages of genuine programs in an attempt to fool staff members into providing corporate login credentials. These login credentials can be used to get access to a variety of company resources, which can be exploited to steal confidential information or run ransomware.

With enterprise security weaknesses caused by the global shift to the cloud and tools like ChatGPT falling into the hands of criminals, it's safe to conclude that the odds are stacked in favor of malicious actors in the upcoming year.

I-confidential: The answer lies with people.

Defending Against Attacks

In the upcoming year, ransomware assaults will still be the most common threat, and organizations will need to rely more and more on their workforce to stay afloat in this digital warzone.

Investing in awareness campaigns and phishing simulation exercises is crucial to achieving this. These ought to be ongoing projects. To make sure they stay applicable as attacks change, they must be ongoing and updated often.

Whatever the method of phishing or ransomware assaults, organizations who treat their staff as their first line of defense and provide them with the necessary tools will be safe from such attacks. People will know to consider carefully before clicking, regardless of whether they employ the most recent developments in generative AI or revert to their more traditional methods of having Nigerian princes email you unexpectedly with an offer you can't turn down.

Maintaining Strong Foundations

Although foundational security is not a novel concept, its significance will only grow in the coming year, particularly in light of generative artificial intelligence.

Humans are the primary factor in ensuring security. To help prevent attackers from accessing their networks, organizations need to concentrate on adhering to the fundamentals. Complex supply chains must be considered by foundational controls as they have the potential to affect data. A few crucial areas to concentrate on are:

• keeping an accurate record of assets and knowing which ones are essential.
• maintaining a current third-party inventory.
• making certain that standards and policies are up to date, evaluated frequently, and tested.

Organizations will gain control over their security as a result. They'll be capable of making wise choices regarding investments, goals, and long-term planning. Additionally, they will have more rapid and efficient incident investigation capabilities.

It is inevitable that organizations facing vulnerabilities in their fundamental security will need to seek assistance from seasoned security professionals rather than artificial intelligence.

Once more, individuals have the greatest potential to impact the development of foundational controls that are tailored to the unique demands of businesses.

Not tools, but people are the gap.

Employers still have difficulty filling positions with qualified candidates who can address their security issues. Closing these gaps will be crucial in the next year as AI is expected to shift the threat landscape in attackers' favor.

It is not affordable for anyone to ignore these security issues. A new generation of cyber expertise will be produced via inventive university courses like ethical hacking and college apprenticeships, and reliance on "gig economy" workers and astute recruiters will become more crucial than ever.

Companies should look to these initiatives to strengthen their internal teams with fresh talent and fix their control deficiencies.

OSP Cyber Academy CEO Thomas McCarthy: The use of AI as a weapon by both attackers and defenders

"2024 will be the year that attackers weaponize AI, if 2023 was the year that tech companies revolutionized the technology."

AI has the potential to be used as a weapon by both attackers and defenders, sparking an uncontrolled and discordant "cyber arms race."

AI will be employed by cybercriminals as a weapon for mass cyberattacks in the upcoming year, enabling them to spread complex phishing schemes on a large scale. The spelling, typeface, and tone of these scams will all be quite authentic, so a large number of internet users will fall for them.

Conversations at the C-level are currently dominated by AI, as CEOs and CTOs seek to understand where their vulnerabilities lie and how threats will change over time.

There is a risk to the entire technology stack. Artificial Intelligence (AI) will be used to target individuals through social engineering and phishing, as well as to search for and exploit flaws in all IT systems and supply chains.

In order to combat the issue, more defenders will employ AI to identify assaults more quickly and educate themselves about phishing schemes created by AI, enabling them to block them before they reach user inboxes.

In 2024, artificial intelligence will rule the cyberspace in ways that few can foresee. They haven't seen anything yet, even if they thought this year was awful.