2023 saw organisations witness unprecedented levels of cybercrime. Palo Alto Networks’ State of Cybersecurity survey found that 67% of Indian government/essential services witnessed more than 50% increase in disruptive cyberattacks in 2022–2023. In October 2023, the firm received the most number of calls to their incident response team ever. Cybercriminals have used ransomware to target critical infrastructures and found novel techniques to exploit emerging technologies like generative AI to ill-effect. 

The State of Cybersecurity survey also found that 75% of Indian organisations have increased their cybersecurity budgets in 2023 compared to 2022. With Indian organisations investing more within cybersecurity, it’s critical this money be spent wisely.

Predicting cybersecurity trends for 2024 will be especially important if organisations want to get ahead of modern cyberattackers. With stakes higher than ever, organisations need to take a holistic approach – accounting for macroeconomic factors, emerging technologies, and cloud risks among others.

Ian Lim, Field Chief Security Officer, Palo Alto Networks, said, “In 2023, we’ve seen mature organisations, who invest heavily in cybersecurity, still falling victim to debilitating cyberattacks. This is due to the tenacity and ingenuity of attackers who exploit cyber hygiene issues or find novel ways to compromise legacy defences. Another key reason for these breaches lies in the complexity of security capabilities in most modern organisations. They use an average of 31.58 disparate security tools to protect their highly interconnected and innovative environments. The lack of correlation and the level of noise generated by these tools creates immense visibility gaps and dampens their ability for detection and response.”

He added, “Going into 2024, highly motivated cybercriminals, nation state attackers and hacktivists will continue to innovate, expand and exploit – not much we can do to slow that down. However, we could and should definitely address the complexity of our security capabilities with AI to make them more effective and cost efficient.”

Here are the five cybersecurity trends to watch out for in 2024:

1.        Hacktivism: the modern crusade 

2023 saw numerous instances of broadcast events being disrupted by climate activists. This year, this protest could take the shape of a cyber-first campaign. With significant events like the Olympics, the Euros, and regional elections coming up, hacktivists will look to further their cause to audiences in the millions. Previously, a high level of technical expertise was necessary, but the cybercrime-as-a-service model has lowered this threshold. Now, it only takes an extremely motivated activist with sufficient funds.

Tumultuous geopolitical climates will provide opportunities for hacktivists to gain notoriety for their group and sympathy for their cause. Most hacktivist activity is via Distributed-Denial-of-Service (DDoS) attacks. For example, during the G20 Summit in India, more than 30 groups of hacktivists from neighbouring countries attacked more than 600 websites of government and private entities through DDoS attacks, defacements, and data leaks.

In 2024, organisations should evaluate their risk profile according to the evolving threat landscape and ensure coverage not only for financially motivated attacks but also for hacktivism and nation-state attacks.

2.        AI’s role in cybersecurity will evolve, for good and bad

Since ChatGPT’s launch in October 2022, there have been concerns worldwide regarding its potential to democratise cybercrime. Despite having guardrails to prevent malicious applications, a few creative prompts can get ChatGPT to generate near flawless phishing emails that sound “weirdly human” at immense scale. We’ve seen attackers use Gen AI in novel ways like deepfake and voice technology to scam banks out of millions. Companies adopting Gen AI must be wary about the vulnerabilities of model poisoning, data leakage, prompt injection attacks, etc. Attackers will continue to exploit innovation gaps with the increased use of Gen AI for legitimate use cases.

Hence, one of the AI Cybersecurity trends expected in 2024 is the maturation on how organisations protect enterprise-level use of Gen AI. This involves making sure that security controls, vulnerability management and threat monitoring activities are embedded through the entire lifecycle of AI development projects. Gen AI will further embed itself into cybersecurity capabilities. Its ability to summarise, weed through noise, and give concise summaries of security events is far greater than a human analyst’s (especially at the scale a modern SOC operates). With LLMs getting better by the day, we are bound to see more sophisticated applications that move beyond just being a clever and occasionally-hallucinating chatbot.

3.        Operational technology will remain the low-hanging fruit

Operational Technology is the heart of any industrial organisation. As the primary generator of revenue, OT systems must have a high level of cyber maturity. Palo Alto Networks’ State of Cybersecurity survey found that 67% of Indian government/essential services witnessed more than 50% increase in disruptive cyberattacks in 2022–2023. As organisations scramble to resolve OT-related cybersecurity woes, they will face a lack of specialised solutions that cater to the specific and niche needs of OT professionals. Many organisations still believe OT environments are protected by an air gap, whereas IT/OT convergence has resulted in OT being more connected than ever to IT and, in many cases, to the cloud. This has expanded the attack surface and greatly increased the risk to OT networks, without the investment in cyber controls.

A breach of OT systems can not only result in lost revenue, but also potentially, injuries or loss of life. A cyber secure OT environment is also a safe and reliable OT environment. A Zero Trust architecture will protect the most critical OT systems from threats, while allowing organisations to focus on their digital transformation. 2024 will see organisations invest in OT cyber security maturity to protect their most important business systems and manage the increased risk to an acceptable level.

4.        Consolidation to enable the next frontier in cybersecurity

Unit 42’s Cloud Threat Report (Volume 7) found that on average, security teams take approximately 6 days to resolve a security alert, with 60% of organisations taking longer than 4 days. In a threat landscape where attackers only require a few hours to find and exploit vulnerabilities, 4-6 days is just way too long. Organisations with disparate security tools that are not well integrated have a harder time deploying automation and orchestration. This is a major setback to reducing the mean time to detect and the mean time to respond. 

In addition to the lacklustre threat response, organisations with siloed solutions are having a hard time securing their rapid digital transformation initiatives. Alongside macroeconomic headwinds and workforce challenges, enterprises are looking to consolidate their vendor spread and reduce complexities. Put simply, it is easier to manage the cybersecurity stack if there is one point of contact when a crisis inevitably strikes. Over the long term, it reduces costs and yields better results. This is thanks to the increased visibility and seamless integration that comes with a unified security offering. More organisations are waking up to these benefits and thus 2024 will see customers focus on reducing complexities and turning to consolidated cybersecurity stacks. 

5.        Securing the cloud will be high on the agenda 

Per the State of Cybersecurity survey, India leads APAC in cloud migration, with 80% of businesses already having a large proportion of infrastructure on the cloud, and 42% adjusting their cybersecurity strategy to adopt cloud security. Early adopters of cloud typically start with a single hyperscaler. Naturally, the single cloud model would adopt native security tools from their chosen Cloud Service Provider (CSP). Through the course of time, they experience issues and outages that can only be addressed by adopting a multi or hybrid cloud strategy. This multicloud journey would most likely necessitate a review on their existing cloud security paradigm as native CSP security tools do not seamlessly translate to different CSPs. 

In 2024, organisations that have to contend with multi or hybrid cloud projects would move to establishing a more unified approach to security when dealing with more than one cloud provider. Rationalising cloud security tools across the entire development lifecycle will also be a focus as this provides much higher visibility, correlation, and security monitoring.

The post Hacktivism to GenAI: Here are the top 5 cybersecurity predictions for 2024 appeared first on CIO Dimension.

By Lexi Croisdale, Content Marketing Manager, Varonis

Humans eat, sleep, and expose data.  

Just in the time it takes you to read this blog, your blast radius will expand meaningfully. As access to sensitive data expands in the cloud, so do the different ways it can be compromised. 

With some of your most crucial data living in the cloud environment, how can you keep it protected? Which threats should you be most concerned about? 

Let’s discuss it below:

Threat #1: Identity risk  

One of the challenges of using the cloud is the sprawl of applications that create a unique set of identities. As the cloud footprint increases, it’s a challenge for security teams to monitor and secure multiple identities in multiple spaces. 

Threat actors are also evolving and targeting users specifically through various tactics, like social engineering and compromising personal accounts. The LAPSUS$ group made headlines when they hacked major companies, including Microsoft, Okta, Samsung, Ubisoft, and Nvidia, using phone-based social engineering and SIM-swapping. The group would call IT departments and impersonate the target, bypass multifactor authentication or password resets, and gain access to the data.  

There are two steps to help determine the identities of users inside and outside of your organization who have access to your environment. Take stock of all the applications being used in your organization and understand the permissions involved within each of them.

Conduct reporting on a weekly, monthly, or quarterly basis. The metrics found in your report will identify areas that need attention, such as stale users, personal account use, a jump in external users, or more admin access being granted.

It’s also important to set parameters for offboarding employees, as stale user accounts could give former employees the ability to expose your sensitive data and give attackers an opportunity to access your environment. 

Threat #2: Configuration risk  

A multitude of cloud applications brings a multitude of configuration settings. When implementing new applications, it takes time to learn how specific settings are configured by default, what the best practices are, and to distinguish if the settings for production environments differ from sandbox or dev environments. 

Varonis Threat Labs discovered that anonymous users could exploit misconfigured Salesforce communities to potentially expose sensitive data — such as customer lists, support cases, email addresses, and more — to anyone on the internet.  At a minimum, malicious actors could exploit configurations to perform recon for spear-phishing campaigns, and at worst, they could steal sensitive information about the business, including its operations, clients, and partners. 

Many organizations don’t realize that Salesforce, or some of the other file-sharing collaboration platforms, are built by design to share data publicly and that it’s a feature, not a bug. Auditing your security configurations on a recurring basis can help minimise the amount of unwarranted access to your cloud environments. Some applications, such as Salesforce, also have built-in health checker tools that you can run manually.  

Threat #3: Third-party app risk  

Third-party apps connect to your SaaS or infrastructure applications, and this often happens without oversight from security teams because users can grant themselves permissions — often without thinking twice about the access they give these apps.   

Think of trying to sign up for the latest social networking app, and to bypass filling out a lengthy form, you can simply connect it to your Gmail account, thus opening up access to your information stored within this app.  It can be challenging to understand which apps are configured and what they have access to, which is similar to the identity risks covered in threat #1.  

You can assess how many employees are using the app and their activity levels with automation or through manual reporting. For example, users who haven’t opened a high-risk app in the last six months should have their permissions revoked to avoid breaches. You may want to disconnect the app altogether if it’s not being used.  

Continually monitoring and cleaning up your third-party app library will ease monitoring and maintaining what apps have access to your data. 

Threat #4: Cloud vulnerabilities  

Vulnerabilities in the cloud are usually not by design and could be bugs or holes in the code or application. In 2021, our research team identified a bug in Salesforce dubbed Einstein’s Wormhole, which exposed calendar events that could contain highly sensitive data such as attendee names, emails, meeting URLs, passwords, and replies being sent to organizers. Prior to the bug being patched, meeting information with potentially sensitive information was exposed to the entire internet.  

It’s important to monitor and see what’s happening inside applications, regardless of how much control you have over their coding and/or ability to fix bugs and patch appropriately. It’s also important to internally educate teams about the risks involved with applications that are beyond your security teams‘ control. 

Everyone owns a portion of the risk and should understand that the cloud is more accessible than ever. 

Threat #5: Link/permissions risks 

Most cloud applications are designed for collaboration and file sharing, which can allow end users to share data externally, organization-wide, or even create public links that could be accessible to anyone on the internet.  

While sharing links eases the ability to collaborate and distribute information, they also bring a higher risk of your data getting into the wrong hands and employees having access to information they don’t need. 

A classic example of excessive permissions mixed with an insider threat is the U.S. Pentagon document leak. A junior airman had access to classified information that he shouldn’t have had access to and while there were perimeter defenses in place to stop him from downloading the data to an external source, he was able to take pictures of the content and transcribe the information. The employee then hosted the information on a Discord server, spurring a diplomatic crisis. 

Having least privilege automation in place can help combat the risk involved with excessive permissions by revoking organization-wide, external, and public link access over time.  

The power of automation keeps your information secure and doesn’t require a heavy lift for security teams to constantly analyze link permissions for the thousands of users and files they create.  

This article was first published on Varonis website – https://www.varonis.com/blog/how-to-protect-your-cloud-environment-from-todays-top-5-threats

The post How to protect your Cloud environment from today’s top 5 threats appeared first on CIO Dimension.

The volume of sensitive data stored in the cloud has seen a dramatic increase in the last couple of years. A full 75% of businesses globally report that 40% or more of their data in the cloud is sensitive – a number that has seen over 50 percent growth as compared to the 2021 number (49%), according to the 2023 Thales Cloud Security Study. But are businesses doing enough to protect this sensitive data? 

Despite the reported increase in sensitive data in the cloud, the study found low levels of encryption being used. Only 19% of IT professionals in India (22% globally) reported that more than 60% of their sensitive data in the cloud is encrypted. According to the findings of the survey, on average, only 45% of cloud data is currently encrypted globally.

The study that surveyed more than 3,000 IT and security professionals across 18 countries throws some more unsettling facts about the state of cloud security. 

More than a third (35%) of respondents in India have experienced a data breach in their cloud environment last year with a significantly higher global average of 46%. 

Here are a few other findings from the survey: 

• Human error was reported as the leading cause of cloud data breaches by over half of those surveyed (52% in India, 55% globally 

• More than a third (38%) respondents globally ranked Software as a Service (SaaS) applications as the leading target for hackers, closely followed by cloud-based storage (36%).

• Only 16% of those surveyed in India and 14% globally stated that they controlled all of the keys to their encrypted data in their cloud environments.

• 44% of Indian organizations expressed that managing data in the cloud is more complex than in on-premises environments. 

• Globally, 83% expressed concerns over data sovereignty, and 55% agreed that data privacy and compliance in the cloud has become more difficult.

Pathways to Better Cloud Security

Identity and access management (IAM) is a crucial measure in mitigating data breaches, emphasising the significance of strong security practices. Encouragingly, the adoption of robust multi-factor authentication (MFA) has risen to 65% globally, indicating progress in fortifying access controls.

Surprisingly, only 41% of organisations worldwide have implemented zero trust controls in their cloud infrastructure, and an even smaller percentage (38%) utilise such controls within their cloud networks

“ Considering the rising cyberthreats in India and globally, treating cloud environments as an extension of existing infrastructure while maintaining exclusive control and security of data, especially sensitive data, is key to cloud security. Another essential aspect of cyber security is customer control of encryption keys, as it allows organisations to leverage the scalability, cost efficiency, and accessibility benefits of the cloud while ensuring the utmost integrity and confidentiality of their valuable information. This becomes more critical for Indian organizations as 68% of respondents in India reported over 40% of their cloud data as sensitive,” stated Ashish Saraf, VP & Country Director – India, Thales.

The post More and more sensitive data moves to Cloud, but encryption levels remain low appeared first on CIO Dimension.

A new research from SASE vendor Netskope, shows that over 400 distinct cloud applications delivered malware in 2022, nearly triple the amount seen in the prior year. Netskope researchers also found that 30% of all cloud malware downloads in 2022 originated from Microsoft OneDrive.

“Attackers are increasingly abusing business-critical cloud apps to deliver malware by bypassing inadequate security controls,” said Ray Canzanese, Threat Research Director, Netskope Threat Labs. “That is why it is imperative that more organizations inspect all HTTP and HTTPS traffic, including traffic for popular cloud apps, both company and personal instances, for malicious content.”

Rise in Uploads to Cloud Apps Means Rise in Malware-Delivered Downloads 

The most significant change in cloud application use in 2022, compared to 2021, was the marked increase in the percentage of users uploading content to the cloud. According to Netskope data, over 25% of users worldwide uploaded documents daily to Microsoft OneDrive, while 7% did so for Google Gmail and 5% for Microsoft Sharepoint. The drastic increase in active cloud users across a record number of cloud applications led to a sizable increase in cloud malware downloads in 2022 from 2021, after remaining close to flat in 2021 compared to 2020.

The correlation between uploads and downloads among the most popular apps is no coincidence. Nearly a third of all cloud malware downloads originated from Microsoft OneDrive, with Weebly and GitHub coming in the next closest among cloud apps at 8.6% and 7.6%, respectively. 

Cloud-delivered malware is more prevalent than web-delivered malware

Industries have increased their reliance on cloud applications and cloud infrastructure to support business operations over the last several years—a trend further accelerated by the COVID-19 pandemic and a worldwide shift toward hybrid work. As a result, cloud-delivered malware is now responsible for a much higher percentage of all malware delivery than ever before, especially in certain geographic regions and industries.

In 2022, several geographic regions saw significant increases in the overall percentage of cloud vs. web-delivered malware compared to 2021, including:

• Australia (50% in 2022 compared to 40% in 2021)
• Europe (42% in 2022 compared to 31% in 2021)
• Africa (42% in 2022 compared to 35% in 2021)
• Asia (45% in 2022 compared to 39% in 2021)

In certain industries, cloud-delivered malware also became more predominant globally, especially:

• Telecom (81% in 2022 compared to 59% in 2021)
• Manufacturing (36% in 2022 compared to 17% in 2021)
• Retail (57% in 2022 compared to 47% in 2021)
• Healthcare (54% in 2022 compared to 39% in 2021)

Cyber Preparedness: The Remote Workforce is Here to Stay

Companies have made considerable adjustments to enable remote and hybrid workplaces to flourish. While some industries sought to bring employees back to the office on a more frequent basis in 2022, remote work options appear to remain largely in place. According to Netskope data, user dispersion—the ratio of the number of users on the Netskope platform to the number of network locations from which those users’ traffic originates—is 66%, the same percentage it was at the start of the pandemic over two years ago.

Remote and hybrid work dynamics continue to pose multiple cybersecurity challenges, including how to securely provide users access to the company resources they need to do their jobs and how to scalably and securely provide users access to the internet.

The post Malware-Delivering Cloud Apps Nearly Tripled in 2022: Report appeared first on CIO Dimension.