2022 Security Challenges and 2023 Security Predictions

With the end of the year approaching, experts reviewed one of the worst years on record for cybersecurity and concluded that: cyberattacks and breaches continue to rise with no end in sight; organizations continue to invest in technology at record speeds, yet remain at risk. In 2022, more than 65% of organizations expected security budgets to expand. Gartner estimates $172 billion will be spent this year, up from $155 billion in 2021. As spending increases, attacks continue to occur at an exponential rate. According to Check Point, global cyberattacks increased by 42% by mid-year. From supply chain vulnerabilities to ransomware, organizations are still trying to avoid becoming part of the eventual attack statistics.

Looking ahead to 2023, there are many emerging trends that are top-of-mind security areas for executives.

▌User Awareness

User awareness remains the top area where organizations must continue to invest. Theft of credentials to gain access remains the number one threat to organizations. According to the Ponemon Institute, more than 54% of security incidents are caused by credential theft. This report notes that 59% of organizations fail to maintain strict user account lifecycle management, leaving credentials that are no longer needed in the environment vulnerable to compromise. Attackers exploit this exact breakdown in credential management to access accounts and data. Organizations must improve identity lifecycle management to avoid such breaches. This area will continue to be a challenge for organizations in 2023.

▌Ransomware

Ransomware is predicted to continue to be the primary way attackers leverage control over victims, steal data, and monetize hacking groups. According to the SonicWall Cyber Threat Report, the volume of global ransomware grew by 98%. While this figure is down from 2021's 105% growth rate, the frequency and amount of payouts continue to grow. Globally, the frequency of attacks in healthcare, financial services, manufacturing, and state and local governments continues to rise. What is interesting about these attacks is that, according to data from Veeam in the 2022 Ransomware Trends Report, 76% of those who participated in the study had experienced an attack. Among those who paid the ransom, only 69% were able to recover their data. A growing trend in this cat-and-mouse game is that you might pay the ransom and still be unable to escape the control of hackers.

▌Third-Party/Supply Chain Risk

From internet providers to manufacturers, this remains a concern. In 2022, we witnessed several third-party supply chain breaches. Forbes outlined early in the year how this topic is taking prime time in boardrooms and continues to plague businesses. Accenture also highlighted this area of concern, noting that supply chain disruption is also part of the risk. This is not only a vulnerability caused by third parties, but actual supply disruptions associated with technology disruptions. This challenge will continue in 2023, and we expect double-digit growth in this area.

▌IoT and DoS

IoT/OT and DoS attack vectors were key areas of attacks in 2022. Organizations are still trying to understand what is on their networks and where devices are vulnerable. Meanwhile, attackers are finding ways to exploit internet-connected devices at record speeds. As organizations accelerate adoption, security has unfortunately become an afterthought. Attackers will continue to exploit the weak security posture in this area to leverage security vulnerabilities and breach secure networks.

▌Mobile Device Attack Vectors

Issues in this area just exploded in 2022. These issues range from application security to personal data privacy. Organizations writing applications must protect code, keys, and personal data. Few take the necessary precautions to verify that all of these areas are covered at a comprehensive level. Another challenge is applications intentionally sharing users' personal data. From locator service information to text messages, users are kept in the dark about exactly what data is collected from mobile devices and then shared or sold on the open market. This area will explode in 2023, and users are now beginning to be much more aware of these risks.

▌Phishing Targeted Attacks

This vector remains the premier way for attackers to enter a network. Phishing, smishing, and social engineering remain highly popular, and attackers are increasingly sophisticated in their methods, pathways, and techniques for obtaining information and credentials to gain access to systems and data. F5 released news last year that from 2020-2021, the volume of phishing emails increased by 45%. The number of phishing emails is expected to increase again when this report is released for 2022. Attackers are now using automated tools to execute these attacks; with these tools, they can send millions of phishing messages with a single click. The trend for 2023 is that smishing and mobile device attacks are growing as users abandon standard email and turn to text and SMS.

▌Other Trends for 2023

Depending on how the market and economy develop, there are a few other items to consider among the trends for 2023. Resources will continue to be very difficult to retain, attract, and find. With the changes in remote work brought about by the pandemic and high demand for a small pool of resources, retaining and attracting talent has been difficult this year. Practitioners want higher salaries and work flexibility in terms of location and hours. Organizations trying to return to the office are finding that some of their best resources do not support this move. Resource constraints will continue to exist in 2023, with security and cloud leading the way in highly sought-after talent.

Data security will be a major focus in 2023. Organizations have begun to realize that they have data everywhere and lack the security controls to protect, encrypt, and manage it. This challenge, combined with the complexity of third-party access and risk, keeps boards and CIOs awake at night. 2023 will be the year when some organizations begin to acknowledge their own internal weaknesses and start the process of identifying where data resides, how it is secured, who has access, and full lifecycle management.

The next area of trends for 2023 is application security. Often, the CI/CD pipeline and security surrounding application development is an area of concern. This combined with Dev/Sec/Ops has been in "WE DEVELOPERS WILL TAKE CARE OF SECURITY" mode for years. This is a Pandora's box within organizations. Often, it is found that continuous controls exist, while at the same time audit and identity lifecycle management are virtually non-existent. For example, contractors who worked on development projects last year still have administrative access to code and systems.

The final crystal ball item for next year is the rise of FINOPS. This is the realization that security, development, and cloud computing all cost money, and FINOPS is the next big bet to analyze spending, trends, baselines, and look for cost optimization, reduction, waste, and abuse. Businesses have been spending wildly, from cloud overspending to shelving, and as the economy and budgets tighten, CIO/CISOs will look for every penny of budget savings or cuts.

2022 is not over yet, but it's already time to start looking forward to your 2023 strategy and how your organization can improve its security. How organizations prepare for some of these trends is critical, and without a more effective defense strategy, they could become the next headline in cyberattack news.

According to the current opinions of many security agencies and experts, organizations will only face more severe tests in the future than they do now. The best practice to control and resist risks is to be prepared for active defense. PyxVerify provides organizations with realistic APT attack techniques to verify in advance whether your defense system can effectively resist when an attack arrives. In the long-term trend of a shortage of security talent, PyxVerify can also significantly improve human efficiency, helping organizations allocate limited security budgets more reasonably with less manpower input and a higher level of automation.

| Reference Source

https://www.cybersecurity-insiders.com/2022-security-challenges-and-2023-security-predictions/