Outlook

Fortinet Lists 2023 Threat Predictions

Published

2 years ago

November 8, 2022

Fortinet has today unveiled predictions from the FortiGuard Labs global threat intelligence and research team about the cyber threat landscape for the next 12 months and beyond. From quickly evolving Cybercrime-as-a-Service (CaaS)-fueled attacks to new exploits on nontraditional targets like edge devices or online worlds, the volume, variety, and scale of cyber threats will keep security teams on high alert in 2023 and beyond.

Derek Manky, Chief Security Strategist and VP of Global Threat Intelligence, FortiGuard Labs, said, “As cybercrime converges with advanced persistent threat methods, cybercriminals are finding ways to weaponize new technologies at scale to enable more disruption and destruction. They are not just targeting the traditional attack surface but also beneath it, meaning both outside and inside traditional network environments. At the same time, they are spending more time on reconnaissance to attempt to evade detection, intelligence, and controls. All of this means cyber risk continues to escalate, and CISOs need to be just as nimble and methodical as the adversary. Organizations will be better positioned to protect against these attacks with a cybersecurity platform integrated across networks, endpoints, and clouds to enable automated and actionable threat intelligence, coupled with advanced behavioral-based detection and response capabilities.”

Success of RaaS is a Preview of What Is to Come with CaaS
Given cybercriminal success with Ransomware-as-a-Service (RaaS), a growing number of additional attack vectors will be made available as a service through the dark web to fuel a significant expansion of Cybercrime-as-a-Service. Beyond the sale of ransomware and other Malware-as-a-Service offerings, new a la carte services will emerge. CaaS presents an attractive business model for threat actors. With varying skill levels they can easily take advantage of turnkey offerings without investing the time and resources upfront to craft their own unique attack plan.

And for seasoned cybercriminals, creating and selling attack portfolios as-a-service offers a simple, quick, and repeatable payday. Going forward, subscription-based CaaS offerings could potentially provide additional revenue streams. In addition, threat actors will also begin to leverage emerging attack vectors such as deepfakes, offering these videos and audio recordings, and related algorithms more broadly for purchase.

One of the most important methods to defend against these developments is cybersecurity awareness education and training. While many organizations offer basic security training programs for employees, organizations should consider adding new modules that provide education on spotting evolving methods such as AI-enabled threats.

Reconnaissance-as-a-Service Models Could Make Attacks More Effective
Another aspect of how the organized nature of cybercrime will enable more effective attack strategies involves the future of reconnaissance. As attacks become more targeted, threat actors will likely hire “detectives” on the dark web to gather intelligence on a particular target before launching an attack. Like the insights one might gain from hiring a private investigator, Reconnaissance-as-a-Service offerings may serve up attack blueprints to include an organization’s security schema, key cybersecurity personnel, the number of servers they have, known external vulnerabilities, and even compromised credentials for sale, or more, to help a cybercriminal carry out a highly targeted and effective attack.

Attacks fueled by CaaS models mean stopping adversaries earlier during reconnaissance will be important. Luring cybercriminals with deception technology will be a helpful way to not only counter RaaS but also CaaS at the reconnaissance phase. Cybersecurity deception coupled with a digital risk protection (DRP) service can help organizations know the enemy and gain an advantage.

Money Laundering Gets a Boost from Automation to Create LaaS
To grow cybercriminal organizations, leaders, and affiliate programs employ money mules who are knowingly or unknowingly used to help launder money. The money shuffling is typically done through anonymous wire transfer services or through crypto exchanges to avoid detection. Setting up money mule recruitment campaigns has historically been a time-consuming process, as cybercrime leaders go to great lengths to create websites for fake organizations and subsequent job listings to make their businesses seem legitimate.

Cybercriminals will soon start using machine learning (ML) for recruitment targeting, helping them to better identify potential mules while reducing the time it takes to find these recruits. Manual mule campaigns will be replaced with automated services that move money through layers of crypto exchanges, making the process faster and more challenging to trace. Money Laundering-as-a-Service (LaaS) could quickly become mainstream as part of the growing CaaS portfolio. And for the organizations or individuals that fall victim to this type of cybercrime, the move to automation means that money laundering will be harder to trace, decreasing the chances of recovering stolen funds.

Looking outside an organization for clues about future attack methods will be more important than ever, to help prepare before attacks take place. DRP services are critical for external threat surface assessments, to find and remediate security issues, and help gain contextual insights on current and imminent threats before an attack takes place.

Virtual Cities and Online Worlds Are New Attack Surfaces to Fuel Cybercrime
The metaverse is giving rise to new, fully immersive experiences in the online world, and virtual cities are some of the first to foray into this new version of the internet-driven by augmented reality technologies. Retailers are even launching digital goods available for purchase in these virtual worlds. While these new online destinations open a world of possibilities, they also open the door to an unprecedented increase in cybercrime in unchartered territory.

For example, an individual’s avatar is essentially a gateway to personally identifiable information (PII), making them prime targets for attackers. Because individuals can purchase goods and services in virtual cities, digital wallets, crypto exchanges, NFTs, and any currencies used to transact offer threat actors yet another emerging attack surface. Biometric hacking could also become a real possibility because of the AR and VR-driven components of virtual cities, making it easier for a cybercriminal to steal fingerprint mapping, facial recognition data, or retina scans and then use them for malicious purposes. In addition, the applications, protocols, and transactions within these environments are also possible targets for adversaries.

Regardless of work-from-anywhere, learning-from-anywhere, or immersive experiences-from-anywhere, real-time visibility, protection, and mitigation is essential with advanced endpoint detection and response (EDR) to enable real-time analysis, protection, and remediation.

Commoditization of Wiper Malware Will Enable More Destructive Attacks
Wiper malware has made a dramatic comeback in 2022, with attackers introducing new variants of this decade-old attack method. According to the 1H 2022 FortiGuard Labs Global Threat Landscape report, there was an increase in disk-wiping malware in conjunction with the war in Ukraine, but it was also detected in 24 additional countries, not just in Europe. Its growth in prevalence is alarming because this could be just the start of something more destructive.

Beyond the existing reality of threat actors combining a computer worm with wiper malware, and even ransomware for maximum impact, the concern going forward is the commoditization of wiper malware for cybercriminals. Malware that may have been developed and deployed by nation-state actors could be picked up and re-used by criminal groups and used throughout the CaaS model. Given its broader availability combined with the right exploit, wiper malware could cause massive destruction in a short period of time given the organized nature of cybercrime today. This makes time for detection and the speed at which security teams can remediate paramountly.

Using AI-powered inline sandboxing is a good starting point to protect against sophisticated ransomware and wiper malware threats. It allows real-time protection against evolving attacks because it can ensure only benign files will be delivered to endpoints if integrated with a cybersecurity platform.

What These Attack Trends Mean for Cybersecurity Professionals
The world of cybercrime and the attack methods of cyber adversaries, in general, continue to scale at great speed. The good news is that many of the tactics they are using to execute these attacks are familiar, which better positions security teams to protect against them. Security solutions should be enhanced with machine learning (ML) and artificial intelligence (AI) so they can detect attack patterns and stop threats in real-time. However, a collection of point security solutions is not effective in today’s landscape. A broad, integrated, and automated cybersecurity mesh platform is essential for reducing complexity and increasing security resiliency. It can enable tighter integration, improved visibility, and more rapid, coordinated, and effective response to threats across the network.

News

Tenable Forecasts Cloud Data Security to Lead as AI Accelerates in 2025

Published

2 days ago

December 9, 2024

Prarthana Mary

As 2025 approaches, Tenable is highlighting the critical need for organisations to prioritise data security in the cloud amid the rapid rise of AI adoption. In the coming year, companies will face mounting pressure to secure AI initiatives at scale while safeguarding a growing range of data assets from cyber threats. Here are Tenable’s key predictions for the future of cloud security:

AI adoption and increased security scrutiny
In 2025 and beyond, we’ll see more organisations incorporating AI into their infrastructure and products as the technology becomes more accessible. This widespread adoption will lead to data being distributed across a more complex landscape of locations, accounts and applications, creating new security and infrastructure challenges. In response, CISOs will prioritise the development of AI-specific policies and security measures tailored to these evolving needs. Expect heightened scrutiny over vendor practices, with a focus on responsible and secure AI usage that aligns with organisational security standards. As AI adoption accelerates, ensuring secure, compliant implementation will become a top priority for all industries.

The growth of distributed data will be a boon for cybercriminals
As data volumes grow and become more distributed across multi-cloud environments, the risk of data breaches will rise significantly. With AI tools relying on vast amounts of customer data, cybercriminals will have more opportunities to target these systems, making data exfiltration and unauthorised access easier. Organisations will face an escalating risk as attackers exploit these expanding data environments to achieve malicious goals.

AI-powered attacks will outpace traditional security measures
Despite the best efforts of companies like OpenAI, Google and Microsoft to implement robust security protocols, cybercriminals now have powerful tools at their disposal, including AI-driven virtual assistants that can streamline and amplify their attacks. As data volumes continue to surge and become more accessible, the appeal and ease of targeting sensitive information will grow. This convergence of advanced attack tools and abundant data will make it increasingly difficult for organisations to stay ahead of evolving cyber threats.

Data is business fuel but secure AI adoption is critical
These predictions should not deter organisations from embracing AI. Instead, they underscore the importance of developing robust strategies for secure and responsible AI adoption. Organisations must focus on integrating AI into their systems securely rather than viewing it as a risky proposition.

“Organisations must understand that data is the fuel driving their business—it enables insights, fosters collaboration, and powers innovation,” said Liat Hayun, VP of Product Management and Cloud Security Research at Tenable. “As AI adoption skyrockets and data storage demands grow, safeguarding distributed data has never been more critical. As we head into 2025, business leaders and security teams must strike a careful balance between innovation and security, ensuring that AI initiatives do not inadvertently open new doors for cyber attackers.”

Cyber Security

Check Point Software’s 2025 Cyber Security Predictions: Emerging Tech and Advanced Criminal Tactics to Redefine Global Threats

Published

3 weeks ago

November 19, 2024

Chris Fernando

Check Point Software Technologies has announced its cyber security predictions for 2025, outlining key security challenges that organisations will face in the coming year. As businesses embrace new technologies, AI-driven attacks, quantum threats, and cloud vulnerabilities will redefine the digital threat landscape.

Key highlights from the 2025 global cyber security predictions report include:

The Rise of AI-Powered Attacks: AI will become a core enabler of cybercrime in 2025. Threat actors will use AI to generate highly personalised phishing attacks and adaptive malware that can learn from real-time data to avoid detection. Smaller hacker groups will also use AI tools to launch large-scale operations without needing advanced expertise, democratising cybercrime.
Ransomware Hits Supply Chains Hard: Ransomware will grow even more targeted and automated, with attacks on critical supply chains, with possibly large-scale attacks becoming more common, affecting entire industries, with attackers using AI-enhanced phishing emails and deepfake impersonations to bypass defences.
Improper AI Usage Increases Data Breaches: With AI tools like ChatGPT becoming integral to business processes, accidental data exposure will become a key concern. Employees may inadvertently share sensitive data with external AI platforms, causing unintentional breaches. Organisations will need to establish governance frameworks to monitor AI usage and ensure data privacy.
Quantum Computing Poses New Threats to Encryption: Quantum computing will soon challenge existing encryption methods. Although large-scale quantum attacks are still years away, industries like finance and healthcare must begin adopting quantum-safe encryption to stay ahead of this looming threat.
Social Media Exploitation and Deepfakes Become Commonplace: Cybercriminals will increasingly target social media platforms, using personal data for targeted scams and impersonations. AI-powered deepfakes will become more convincing, posing threats to financial transactions and corporate security. Detecting and countering these sophisticated attacks will require real-time AI defences.
AI-Driven SOC Co-Pilots Revolutionise Security Operations: Security Operations Centers (SOCs) will use AI co-pilots to process large volumes of data and prioritise threats, enabling faster response times. These AI-driven tools will help automate threat detection and reduce false positives, boosting the efficiency of security teams.
CIO and CISO Roles Converge as AI Adoption Grows: As businesses adopt AI and hybrid-cloud environments, the roles of CIO and CISO will converge, shifting towards integrated risk management. The report predicts that CIOs will increasingly oversee cybersecurity operations, fostering tighter alignment between IT and security functions.
Cloud Security Platforms Dominate the Landscape: Organisations will migrate towards integrated cloud security platforms, leveraging tools like CNAPP to monitor and secure multi-cloud environments. AI will play a crucial role in automating threat prevention, shifting the focus from reactive security to proactive defences.
IoT Expansion Increases Attack Surface: With 32 billion IoT devices expected by 2025, securing these interconnected systems will become critical. Attackers will exploit poorly secured IoT devices to breach cloud networks. To mitigate these risks, organisations must adopt zero-trust architectures and AI-powered threat detection tools.

“In 2025, AI will drive both attacks and protections. Security teams will rely on AI-powered tools tailored to their unique environments, but adversaries will respond with increasingly sophisticated, AI-driven phishing and deepfake campaigns,” said Dr. Dorit Dor, Chief Technology Officer at Check Point.

“Meanwhile, attackers will exploit overlooked vulnerabilities as well as service accounts and machine-to-machine access keys for lateral movement within networks, further complicating defences. As cyber conflicts extend to social platforms and even the battlefield, organisations must use more preventative methods and adapt quickly to safeguard their operations from emerging threats.”

Expert Speak

Vectra AI Outs Cybersecurity Predictions for 2024

Published

11 months ago

January 12, 2024

Prarthana Mary

Vectra AI has announced its annual threat predictions for cybersecurity stakeholders in the United Arab Emirates. Company experts Oliver Tavakoli, CTO, and Christian Borst, CTO EMEA, coauthored the predictions, which examine changes in the threat landscape, expansion in the attack surface, and the changing behaviours of digital estate owners, users, and attackers.

Prediction 1: Security endpoint breaches will decline as downstream defences get stronger
In 2024, more than half of the region’s security incidents will not involve compromised endpoints, predicts Tavakoli. “This will mark a new era of threats that primarily target federated identity systems, public clouds, and business email compromise [BEC],” Tavakoli explained. “These new breeds of attack will exploit the vulnerabilities and relative immaturity of security practices related to cloud, identity, and SaaS applications.”

Prediction 2: Generative AI will erode the effectiveness of email security
Tavakoli also predicted that, as the adoption of generative AI continues, attackers will use it in social engineering campaigns. He believes this will serve as a wake-up call to security leaders that their current defence capabilities are inadequate. “Consequently, I expect organizations to pivot towards downstream security approaches such as zero trust, micro-segmentation, and detection and response mechanisms,” Tavakoli said.

Prediction 3: Threat actors will mix and match digital identities to cause high-profile breaches
Borst predicts that 2024 will see a surge in credential-harvesting attacks such as that seen in the Citrix NetScaler flaw and others, which have left cybercriminal groups sitting on millions of potential logins. He believes such stolen credentials will be used to compromise digital identities and breach enterprises more successfully than ever before.

“In the past, stolen credentials may have gotten threat actors into a handful of corporate accounts,” Borst said. “But most wouldn’t give them admin rights or privileged access to steal sensitive data. However, as enterprises use more cloud services, third-party software, and open APIs in 2024, each account will give users varying degrees of privilege. Each source on its own may not seem like a big deal, but we will see cybercriminals mix and match their stolen access to get hold of sensitive data and breach organizations.” Borst also warned that to protect against a flood of cloud-based account hijacks, regional organizations will have to improve their visibility into cloud environments to bolster resilience and identify attacks before they become breaches.

Prediction 4: Widespread LLM usage will fade away, but the incidence of deep fakes will skyrocket
“Many organizations are exploring ways to use large language models (LLMs) following the initial wave of hype this past year,” Borst noted. “But when you scratch beneath the surface, it’s clear the novelty factor will soon evaporate.” Borst believes the complexity of the technology and the realization that LLM does not come with human-like intelligence beyond its communication capabilities will see businesses scale back their use of the technology.

He thinks this trend will extend to threat cabals who will abandon trying to use the models to generate malicious code. Instead, cybercriminals will harness generative AI to create more realistic and sophisticated deep fakes. “This will give them a better chance of tricking users into giving up sensitive data or clicking on something malicious through more convincing audio or visual phishing lures,” Borst warned.

Prediction 5: The cost-of-living crunch will push cybercriminals to do more with less
Borst foresees 2024 in which slowing economic growth and the region’s persistent cybersecurity skills shortage will continue to impact not just cyber defenders but their adversaries. “Both sides will be focusing on how to do more with less,” Borst said. “Many cyber defenders will look to harness AI to reduce strain on staff and increase resilience. At the same time, we will see attackers consolidate their operations to target low-hanging fruit.”

Borst surmised that phishing will remain a primary method of attack, but that cybercriminals will also automate processes where possible to save on time and resources, whether by using pre-packaged cybercrime tools or harnessing generative AI as support with crafting phishing lures.

A bumpy ride
“The threat landscape is one faced by UAE public sector organizations and private sector businesses alike,” said Tavakoli. “It transcends scale and spans industries. But while we can never know where and when the next attack will occur, the threat landscape — its actors, methods, and trends, is predictable to an extent. Let 2024 be the year we fight back with our sophisticated arsenal of cybersecurity tools and methods to protect our clouds, containers, workloads, and data.”