DXC Technology has forecast five ways the digital security landscape will impact life and business in 2023 and beyond. Here’re the top 5 trends, according to the company. 

1. The cybersecurity arms race will accelerate

Cybercriminals and cybersecurity professionals will both use artificial intelligence (AI) in an increasingly sophisticated battle of wits. In the case of cybersecurity defense, AI has been mainly used to identify patterns of suspicious behavior. Due to the volume of suspect activity and the number of false positives, cybersecurity staff are often overwhelmed.

The good news is that in 2023 and beyond, we should be able to start automating AI-based security controls and response mechanisms – helping to react faster and more accurately to cyberattacks, reducing possible downtime and protecting personal and business critical data.

2. We’ll need to be cautious about who we think we’re talking to in the metaverse (while keeping a firm hold of our digital wallets)

2023 is set to be important year for the metaverse with Meta, Microsoft, Virbela and others counting on virtual worlds going mainstream. However, activity in the metaverse can raise questions around identity; how do you know that the person you think you are talking to is who they say they are? Digital certificates, perhaps built on the blockchain, could help. These certificates could also be used to secure virtual transactions in the metaverse. What is clear is that as the metaverse expands, so too will the risks.

3. Geo-political cybersecurity attacks will increase but also lead to innovation in defense

Russia’s attack on Ukraine has reminded us in the starkest way possible that warfare is now hybrid and the risks of geopolitically motivated cyberattacks are real. As a result, many cyber insurance policies are now being written to exclude acts of cyberwar, creating challenges for cyber risk mitigation.

With lingering geopolitical tensions, this threat is set to continue in 2023. In fact, with more than 70 countries due to hold government elections in 2023 (events frequently targeted by state-sponsored actors), it will be a challenging year for cybersecurity defenses. However, we can learn from case studies such as Ukraine’s ‘exemplary’ defense against Russian cyberattacks.

4. Cybersecurity attacks will target critical national infrastructure that supplies our homes

When the lights go out or the gas is cut, most people are unlikely to think it’s the result of an industrial cybersecurity breach. But Operational Technology (OT) is an emerging battleground for cyberattacks, with the systems that control and automate factories and civil infrastructure (including power stations and dams) becoming a target.

With ongoing geopolitical tensions, the OT cyber threat will grow in 2023 putting pressure on industries to ensure they stay one step ahead by baking in cybersecurity protection across their operations.

5. Career opportunities in cybersecurity will grow

There is an estimated global shortfall of around 3.4 million cybersecurity workers. With growing threats from advanced technologies, this number is likely to increase.

The cyber skills gap creates career opportunities for people of all ages and backgrounds. 

The post Top 5 cybersecurity trends in 2023 and beyond appeared first on CIO Dimension.

A survey conducted by Alloy revealed that 27% of respondents lost over $1M to fraud in the last 12 months. 70% of respondents reported losing over $500K to fraud, with fintech companies and regional banks being the most likely to report higher losses. 37% of fintech companies and 31% of regional banks estimated losing between $1-10M to fraud.

The Annual State of Fraud Benchmark Report surveyed over 250 decision-makers working at financial institutions including community banks, fintech, crypto, national banks, regional banks, and online lending institutions). The survey ran from September 8-20, 2022, and respondents came from roles across fraud, compliance, risk technology procurement, digital banking strategy, and account opening.

Fraud continues to plague financial institutions of all sizes and across all segments. One-third of respondents said they experienced between 1,000 and 10,000 fraud attacks in the last twelve months. 91% of respondents said fraud has increased year-over-year since 2021.

“Fraud is the highest it’s ever been,” said Tommy Nicholas, CEO and co-founder of Alloy. “Rapid digitization and an influx of cash from pandemic relief scams have created the perfect conditions for fraudsters to thrive. Regardless of sector or size, financial institutions must do more to keep their customers’ assets safe from fraud, but without compromising on the customer experience.”

The report also found that fraud prevention is a costly and time-consuming enterprise for financial institutions: two-thirds of respondents reported that over half of their workforce is working on fraud-related activities. 71% of respondents have increased their spending on fraud prevention YoY. Respondents were also concerned about additional ‘hidden’ costs of fraud such as legal repercussions, regulatory fines, reputational damage, and loss of clients.

Respondents reported that the main barrier to defending against fraud is automation. 46% of respondents cited a greater need for automation as the most common barrier to being prepared to combat fraud, followed by an absence of dedicated teams for fraud (41%) and the inability to adapt to new threats (39%).

The post Over two-thirds of financial institutions lost above $500K to fraud in 2022: Report appeared first on CIO Dimension.

A new survey has revealed some glaring gaps in enterprise security ecosystem in the new normal. Even when large majority of security leaders believe that they have been successful in inculcating a strong ‘security culture’ in their organization, there appears to be a growing disparity in how employees experience that culture. 

The recent research conducted by email security company Tessian reveals that a significant percentage of employees are not engaged in their organizations’ cybersecurity efforts and don’t understand their role in keeping their company secure. Nearly one in three (30%) employees do not think they personally play a role in maintaining their company’s cybersecurity posture. 

This is even though security teams, on average, rate their company’s security culture 8 out of 10. The survey indicates that the strong security culture, as perceived by IT and security leaders, does not guarantee fewer security incidents, which is evidenced by the alarming number of security incidents reported. In fact, 3 out of 4 organizations in the survey say they experienced a security incident in the last 12 month. And a significant portion of these breaches reported involved human error – such as employee downloading data on a personal storage device and employee falling for phishing attack. 

This widening gap, according to Tessian, is the result of employee disengagement across the board. And security leaders are not acknowledging this gap. In fact, when asked what has the most influence over a positive security culture, security leaders chose technology and training over engaged employees, communication channels, and senior exec buy-in. 

This seems to be the fundamental problem that leads cybersecurity programs that are largely ineffective. Drawing out comprehensive programs without employee engagement isn’t helping the cause. Imagine this: 36% employees find security awareness programs out-right boring. Worst still, there is a sharp divide between what security teams think they’re providing, and what employees are actually absorbing – 80% of security leaders said there’s a feedback loop for employees to report security incidents, still nearly half of employees don’t even know who to report security incidents to. 

In many cases, employees are not just disengaged, they have even had negative experiences, with 1 in 2 reporting negative experience with a phishing simulation. Often authoritarian approaches and virtual programs turn out to be futile as opposed to positive reinforcement. 

The need of the hour is to ensure that all employees take an active role in a company’s cybersec measures. As the survey rightly states: “cybersecurity is a team sport. The burden sits with everyone, across all levels and departments, from the Chief Finance Officer to a recently hired sales engineer.” 

The report also recommends that building touch points throughout the employee lifecycle, clear communication, and technology that helps build self-efficacy are all good places to start to drive employee engagement. Security teams should play an active role in not just employee onboarding, but in offboarding as well – 45% of IT leaders said that incidents of data exfiltration have increased in the last year, as people took data when they left their jobs. 

“To get people better engaged with the security needs of the business, education should be specific and actionable to an individual’s work. It is the security teams’ responsibility to create a culture of empathy and care, and they should back up their education with tools and procedures that make secure practices easy to integrate into people’s everyday workflows. Secure practices should be seen as part of productivity. When people can trust security teams have their best interest at heart, they can create true partnerships that strengthen security culture,” said Kim Burton, Head of Trust and Compliance at Tessian. 

The post Is Employee Disengagement the CISO’s biggest challenge appeared first on CIO Dimension.