Industry executives and experts share their predictions for 2024. Read them in this 16th annual VMblog.com series exclusive.
Navigating Threat Actors’ Use of AI
By Avani Desai, CEO of Schellman
As 2023 wraps and we look ahead to 2024, I’m keeping tabs on the continued evolution of artificial intelligence (AI) and how bad actors are leveraging it in attacks. Given the rise of AI over the past year, its continued growth is to be expected, but as it becomes more sophisticated, we need to be prepared to differentiate between genuine and fake communications to remain secure. With that, I’m expecting that generative AI will end up as a top security threat in the new year because of its highly convincing content.
On the flip side, and a more optimistic outlook, AI will also provide security, IT, compliance, and accounting teams a more fulfilling, efficient professional experience and better work-life balance by reducing mundane and time-consuming activities.
In addition to following the AI revolution and evolution, these are the three themes I’ll be keeping a close eye on:
Supply Chain Cyberattacks
In the year ahead, the prevalence of cyberattacks through third party vendors, specifically supply chains, will increase. In 2023, we saw the MOVEit Transfer breach wreak havoc on over 1,000 organizations and 60 million individuals, including organizations like the U.S. Department of Energy, Shell, First National Bankers Bank, British Airways, and various universities across the United States. The impact of this breach prompts bad actors to make further attempts at exploiting supply chains to access sensitive company data and personally identifiable information (PII) from employees, customers, and partners.
To prepare for the continuation of this trend, companies should leverage System and Organization Controls (SOC) reporting for supply chains. A SOC for supply chain report is entirely focused on the production, manufacturing, and distribution systems within a supply chain process to ensure controls exist to mitigate risks to those systems. Specifically, these assessments provide organizations assurances for the security, availability, confidentiality, processing integrity, and privacy of products and information from suppliers within the supply chain.
Importance of Soft Skills
The rise of AI and constant regulatory updates for privacy, security, and technology use has reshaped and honed our technical skills, but within the cybersecurity industry, soft skills have fallen to the wayside. To best serve clients as they implement more and more AI tools and integrations, employees must be consistent, good listeners, empathetic, proactive, and trustworthy. These arm employees with the ability to effectively communicate complex AI topics and regulatory changes to others in the organization who don’t have the same technical know-how, while maintaining strong interpersonal relationships and building trust. Further, as AI systems provide more data and insight than ever before, human judgment has become crucial to ensure that final decisions are ethical, appropriate, and productive. And, with generative AI used more frequently in cyberattacks, the importance of human judgment is elevated so each employee can discern between genuine and fake communications to keep the organization secure.
State-Sponsored Attacks Continue to Threaten
In 2024, I anticipate state-sponsored cyberattacks will remain a significant threat, especially in the midst of major elections, namely, the United States Presidential Election taking place in November. Key tactics used will be distributed denial of service (DDoS) attacks and phishing. DDoS attacks are more threatening than ever because bad actors are leveraging AI to fully automate attacks, enabling quicker and more accurate decision-making, faster problem-solving, and a better understanding of defensive strategies. DDoS attacks can be defended against by attack surface reduction, real-time threat monitoring, or rate limiting.
Phishing attacks have also grown in sophistication due to AI’s human-like ability, which has prompted a 1,265% increase in malicious phishing attacks since the fourth quarter of 2022 (and the launch of ChatGPT), according to SlashNext. To defend against phishing attacks, organizations should implement an employee awareness program that includes anti-fraud training, updates on threat trends, regular phishing tests, and guidance on what company information employees can and cannot share on social media, over email, or via the phone.
With Gartner predicting that worldwide end-user spending on security and risk management will increase 14.3% in 2024, compared to 2023, the time is now for organizations to invest in SOC for Supply Chain, employee soft skills training, and preparations for state-sponsored attacks.
##
ABOUT THE AUTHOR
Avani Desai, CEO of Schellman
Avani Desai is a Chief Executive Officer at Schellman, the largest niche cybersecurity assessment firm in the world that focuses on technology assessments. Avani is an accomplished executive with domestic and international experience in information security, operations, P&L, oversight, and marketing involving both start-up and growth organizations.
Also passionate about strategic philanthropy, Avani sits on the board of Arnold Palmer Medical Center, Philanos, Audit Committee chairwoman at the Central Florida Foundation, and is the co-chair of 100 Women Strong, a female-only venture capitalist based giving circle that focuses on solving community-based problems specific to women and children by using data analytics and big data. Avani is also an avid runner, always looking to sign up for the next Disney marathon.
