An Optimist’s View in the Cybersecurity Crystal Ball of 2024

Introduction

Significant progress has been made in recent years in defending against cyber attacks. We now have robust measures to counteract the most common attacks, transforming this issue into one of education. It is essential to ensure that companies are equipped with the necessary knowledge and tools to mitigate risks and prevent attacks effectively. Consequently, we are optimistic about the future and in this post we will explore some of these positive developments that we anticipate in the coming year.

1. Ransomware Attacks Less Effective

Ransomware attacks have been extremely profitable for attack groups, leading to the surge in attacks. The business model of ransomware attacks is one of the better within cybercrime, where incentives are perfectly aligned towards paying the criminals for releasing the company’s files. However, because these attacks have been very common, companies became very aware of them and are becoming knowledgeable about the solutions. We see trends happening that make ransomware attacks less effective…

First, a large majority (+70%) of companies are reporting to have the majority of their infrastructure in the cloud (source: Pluralsight), which implies better protection against ransomware attacks because data in the cloud (e.g. OneDrive, Google Drive,...) is less prone to ransomware, and in case of a ransomware event you will benefit from built-in backups provided by your cloud provider. Moreover, there are more and more cloud-native companies, in particular among startup companies starting with a cloud-first approach, making them inherently less vulnerable to a full-on ransomware attack crippling their business. This has several reasons, including the fact that files within cloud storage often have a built-in backup strategy, and are not always automatically synchronized with the user’s device where ransomware attacks start.

In addition, companies start to recognize protections against ransomware and are implementing them across their workforce. As 80-90% of ransomware attacks are targeted at outdated devices (Source: Microsoft report 2023), this certainly includes focus on keeping devices up to date in order to close vulnerabilities that are used for ransomware to be effective and for it to spread across a company. Also, backup strategies are important to recover from an attack, more companies recognizing this and taking action.

TIPS:

• Make sure to keep your systems & devices fully up-to-date.
• Implement a thorough back-up strategy, or evaluate your cloud provider’s backup strategy.

2. Increased Cybersecurity Regulations Lead to Safer Companies

In the next year, the EU will start enforcing new legislation that includes clear cybersecurity measures upon companies. After GDPR leading the way for privacy regulation all over the world, we are hopeful we will see similar effect with broader cybersecurity regulations. Potential fines being quite high and often linked to a company’s revenue, the incentives to actually take appropriate action are high.

First, we see the Network and Information Security (NIS2) directive getting into effect, as EU member states are required to turn this directive into local law by 17th of October 2024. This specific directive targets all companies that deliver services or goods that are important, essential, or critical for our society to function. Moreover, any company that is part of the supply chain of such a company is required to comply with the directive. This spans a wide net over practically any company, forcing them to take cybersecurity measures into account.

Second, the Digital Operational Resilience Act (DORA) regulation, specifically targeted at financial institutions, is also adding some concrete cybersecurity measures for the financial world. This regulation has been in effect since 16th of January 2023, but applies from 17th of January 2025, making 2024 an important year for financial institutions to start complying with this law.

Overall, we believe these legislations to be important steps towards forcing companies to take cybersecurity seriously, and should eventually lead to a decline in attacks and improved cyber resiliency. We are optimistic that although there will be discussions and non-compliance among companies, in the end companies will also reap the benefits.

TIPS:

• Keep track of legislation that is important for your company, look specifically at NIS2, which a lot of companies will be subjected to. Use these laws to your advantage to get more secure.
• Pragmatic steps towards a more secure company are more beneficial than hastily adding new tooling. There is more value in adding real security step by step instead of rushing towards compliance.

3. Zero Trust Architecture Starting to Get Adopted

We see an increased adoption of zero trust strategies among companies, as now the majority (+66%) of companies are working on a Zero Trust strategy (Source: Forrester). Where focus moves from securing a corporate network towards securing identities, devices, and applications. Removing any trust in the network and assuming every network is basically the same as the public internet. The importance around application security and isolation between applications cannot be ignored, but with more and more cloud native applications, we already see this happening in practice.

In terms of identity, we see improved adoption of modern password policies, including the use of a password manager, focusing on length over complexity, no forced resets, and checking against previously breached passwords. We hear people complaining about MFA (Multi Factor Authentication) being enforced at their workplace, meaning companies are taking this seriously, unfortunate for the lack of user-friendliness. Although, improvements seem to be coming by means of passkeys and other promising technologies.

Also device security is getting more mature, with Zero Trust Application Access techniques being used to secure devices the moment a user tries to access company resources. Mobile devices are finally taken seriously into account by companies, covering these devices with such tools.

TIPS:

• Do not solve security issues at a network level, but focus on user identity, devices, and applications.

4. AI Attacks Countered by AI Defense

In 2024 we cannot ignore the further rise of AI. A little over a year ago openAI turned the AI landscape upside down by releasing their chatGPT tool, showing an impressively improved Language Learning Model (LLM) for the masses. Both offense and defense are using the AI tooling for their benefit. Better phishing mails, improved attacks, and better target information gathering are making the attackers stronger. On the flip side this is countered by cybersecurity tools using AI to better predict, prevent, and recover from cybersecurity incidents, such as Microsoft Security Copilot.

For companies, the hardest part of this process is going to be cutting through the weeds. Between the terrific solutions there are unavoidably going to be solutions trying to sell snake-oil. Nevertheless, the good solutions will become apparent and are going to be an enormous improvement in cyber defense for the companies utilizing them correctly.

TIPS:

• Get familiar with AI, because it is technology that is not going away and will only get more advanced over the coming years.
• Do not get blinded by the mere use of the AI hype, but evaluate products based on the value they promise to deliver and test them before you buy.

5. Security over Compliance

An interesting market of compliance automation tools is growing steadily, helping companies to get ISO 27001 or SOC2 certified in an automated fashion. Moving weight from check-the-box compliance to actually improving security. We believe this to be a huge improvement, that will help companies to truly use their compliance track as a way to improve their overall security. This has been tricky in the past, and used to be a track that took several months to years, and can now be done in months.

TIPS:

• When starting with a compliance track to get a security certificate, have a look at the certification automation tools in the market, they will make this track easier and faster. If you already hired consultants, talk with them about these innovations, and ask them the pros and cons of the use of such tools.
• When already certified and looking to further optimize you security level and approach towards compliance, it might be worth migrating, and benefiting from the upsides these tools deliver, as well as simplify your compliance efforts.

Conclusion

Cybersecurity is not only about fear and bad news, we do see tremendous improvements being made across the board. We are optimistic about the future, and although, cybersecurity is alway going to be somewhat of a cat-and-mouse game, more recently defense seems to start getting ahead. Still a long way to go, but let’s all work together in improving our overall security posture as a society, because we will all feel the benefits as a result.