Update On Risk: The Threat Is No Longer The Master Hacker
Our mental picture of a cybercriminal is shaped by popular culture: fiercely independent loners with an axe to grind and technically proficient beyond the scope of defenders. No doubt such people exist, but today you must adjust your preconceived notions to account for cyber risks that go beyond top-notch hackers.
As tools to carry out attacks become more accessible, here are the threats reshaping the landscape.
A Convenience Store Approach To Attacks
Think of novice, unskilled actors browsing a convenience store stocked with tools and step-by-step tutorials on sale at low cost. These amateurs select among packaged tools they want to deploy. This attack-enablement shopping experience is now standard practice, offering hackers do-it-yourself (DIY) options.
One response is to experiment with exotic defensive tools to counter this shift. As attacks become commoditized and launched at scale, established cybersecurity basics still apply. Avoid default credentials, close exposed admin panels, patch software regularly and address the weaknesses these DIY kits are configured to exploit.
AI Is The Attack Multiplier
The power of AI as a great leveler is bolstering a growing army of unskilled attackers to scan environments, flag exploits that can help infiltrate these environments and walk them through a map of potential intrusions in real time.
The natural response to AI-fueled tactics is defensive AI, but I think that is largely reactive. An ideal approach is to configure your risk model to account for volume and persistence. Assume attempts will be frequent and AI-assisted. Firmly focus on basic cyber discipline and ramp up defensive AI strategies, some of which learn only after an attack succeeds. Conduct post-incident analysis and turn these findings into new detection rules, indicators, signatures, and known behavioral patterns. This can help shorten the learning cycle.
The Rise Of Proxy Cyber Warfare
Nations are weaponizing cyberattacks to knock out critical infrastructure, from power grids to communications networks. With the rise of AI and cybercrime-as-a-service, states can recruit criminals and simply provide the means to facilitate attacks. The payoff is plausible deniability. Even when an attack is traced back to its country of origin, the state can point to a criminal proxy rather than its own hand.
Thus, the line between financially motivated crime and state-backed activity is getting blurred. On the surface, an attacker can appear to be an ordinary criminal group but may still be acting with state support, direction or protection. Organizations should avoid relying too heavily on attacker labels as these can be misleading. Instead, they should assess capability, intent, likely targets and the potential impact on critical assets.
Most Attacks Still Exploit Known Weaknesses
For all the attention zero-day threats receive, the nature of cyberattacks is often less Mission: Impossible, which portrays attackers using highly innovative and novel exploits, and more Groundhog Day: well-known weaknesses being exploited over and over again. More than 80% of known exploits over the past four years were “N-day” vulnerabilities; that is, flaws that had already been publicly disclosed.
The danger isn’t the door nobody knew existed, but the one left open. Identify your crown jewels, including indispensable assets and processes. Ask yourself two important questions: What does an attacker want most, and what must direly remain protected and recoverable should a breach occur? Reduce ways to identify these assets and secure them. Test recovery methods rather than documenting the recovery process. Assign clear lines of ownership should protection fall short.
People Are Manipulated, Not Just Systems
Phishing and social engineering attacks are launched against potential victims and work by imbuing fear, urgency, greed and curiosity. These emotional triggers push people to act before they think, clicking malicious links they otherwise may have avoided.
While security awareness training is mandatory in many organizations, such practices should be designed to test employee reactions under pressure. It is also imperative to show how crafty social engineering tactics can manipulate users in a variety of ways, including deepfakes, imparting a sense of what can transpire if an employee is not on alert.
A Shift In The Economics Of Crime
Any discussion about the changing threat landscape is incomplete without knowing the economics behind a breach. A breach will not deliver value if the criminal cannot convert it to capital. As financial institutions become better at blocking money laundering, criminal networks respond by branching out into discrete functions like any enterprise: One group takes ownership of breaching systems, another conducts ransomware negotiations, another manages the finances, etc.
Groups combine each skill set and target the weakest financial institution from a security perspective, hunting victims that already bank there. Use of an existing account to transfer stolen funds will avoid setting off automated fraud detection checks when opening a new account. Mainstream cryptocurrencies further complicate fund tracking.
Organizations shouldn’t treat the specter of breach monetization as separate from the threat model. It should be taken as seriously as the intrusion path, and organizations must work with financial providers on anomaly detection at cash-out.
Final Thoughts
One of the common themes running through many of these threats is that often there is an individual who knows about a vulnerability but fails to report it. Bad things happen because good people stay silent. Maybe they had a conflict with the time required to resolve the problem, or they had trouble with an untested recovery plan but ignored it.
Beyond adhering to cybersecurity fundamentals, the focus should also account for employee complacency. Organizations best positioned for this generation of threats are those that stay disciplined no matter how far the threat landscape evolves.