Industry executives and experts share their predictions for 2023. Read them in this 15th annual VMblog.com series exclusive.
Control failure will continue to be the leading cause of breaches and losses
By Nik Whitfield, founder and chairman at Panaseer
As technologies and threat have evolved over the past three years, so has the way we practice cybersecurity. In this article I’ll give an overview of the trends that I think will have the biggest impact on the way we manage cybersecurity risk in 2023.
It includes a look at how the CISO role will evolve, why oversight will increase, and why control failures will continue to be the biggest cause of breaches.
1. Control failure will continue to be the leading cause of breaches and losses
Security control failure is the biggest challenge in cybersecurity today and will be again in 2023.
79% of enterprises have suffered cyber incidents that should have been prevented with safeguards they’d already bought. We’ll see more breaches due to control failures next year. As attackers increasingly use automation and AI to find and exploit the gaps, companies will suffer if they assume their security controls are operating effectively, rather than automatically checking they’re operating effectively.
The truth is enterprises have a giant gap between their perceived residual cyber risk – the risk they think they’re carrying after they’ve invested in controls – and the actual residual cyber risk. This is because of a variety of control failures that companies aren’t aware of. This perception gap means boards will make decisions with a mistaken confidence in their cyber risk, leading to breaches that should have been prevented.
To overcome this problem, we’ll see a continued move towards security controls automation. Expect to hear more about Controls as Code, Continuous Controls Monitoring and other processes and technologies that increase assurance and understanding of cyber posture.
2. Increase in oversight
The increase in oversight will continue through 2023. Initiatives like DORA will pose new challenges for financial institutions and the NIS2 directive will affect new sectors that are now considered critical national infrastructure.
The number of bodies performing oversight will increase, the breadth and depth of the oversight will increase, and more organizations will be subject to oversight. The scale and complexity of responding to oversight requirements will increasingly drown our CISOs and their teams, who tell me this is already more than 50% of their role.
Prepare for this increase in oversight with automation, better security posture measurement, and solid processes for collecting and disseminating this information.
3. CISO roles will evolve towards risk-oriented business executives
The CISO role has been and will continue to evolve away from a focus on technical cybersecurity knowledge towards executive and risk domain expertise.
The starting point for understanding risk is understanding what is at risk, i.e. the business. In cybersecurity, we haven’t always appreciated this and focused too heavily on the technical aspects of security. As the risk continues to grow, boards will increasingly expect CISOs to operate as executives who are knowledgeable about the business and able to engage with and influence around the organization as other senior leaders do.
With 3.4 million or so open roles in security we have a real challenge in taking technical security leaders and helping develop their business risk management and executive skills. And on the other hand, taking business risk executives and educating them in cybersecurity.
Given recent events in the US, CISOs are increasingly considering the personal liability they take on in performing the role. Let’s hope this additional burden doesn’t deter people from taking on those highly accountable positions.
4. Business leaders will take more accountability for cybersecurity risk
As businesses are increasingly leveraging new technologies, building new applications and exploring technical innovations, they take on increasing and varied technology risk. Cybersecurity risk, in particular.
This means business stakeholders will increasingly be required to understand the security posture of the business operations they’re responsible for, including applications and customer interactions. Companies that are successful in both business innovation and cybersecurity will have strong relationships between business stakeholders and the security team. In particular, they will converse around clear, high-quality data which articulates the security posture of the business, and how that changes with business decisions they make.
Organizations using point in time, manual processes to produce security metrics as the basis of the conversation between the business and security will suffer either slow business change or increased chances of breach. Those with automated, high-quality measurements, easily interpreted by the business, will move faster and more securely.
Expect to see business stakeholders with more cybersecurity accountability, and increased automation in security KPIs.
5. Ransomware will increase, along with other threats
Ransomware is a concern for all organizations. Microsoft’s latest Digital Defense Report calls it a “nation-level threat”, while other ransomware research highlights the considerable increases in frequency and cost since 2019.
So yes, I expect ransomware to continue increasing, but organizations shouldn’t ignore other risks from threat actors. Geopolitical tensions are rising. Rather than outsourcing, repatriation of critical services is on national agendas. In 2023 I expect to see more stories of cyber-attacks affecting physical infrastructure and more incidents of intellectual property theft, some of which may have occurred several years ago but will only just come to light. If geopolitical tensions continue to rise, expect to see more cyber-attacks on critical infrastructure and more brazen attacks on consumer services.
A Lloyd’s report from this year said: “Thankfully, the world is yet to experience a truly catastrophic cyber physical attack. But the potential impacts of such an attack could be significant, crippling entire systems and societies.” Unfortunately, the likelihood of that will surely be linked to geopolitical tensions.
Final word
A number of these predictions are based around a fundamental challenge that continues to plague security teams: many breaches are preventable with the tools and controls we already have in place.
I think the industry is waking up to this challenge, though. Some are building programs to measure their security posture that will help them to understand whether their security tools and controls are working as expected. But it’s a big challenge. Even some of the largest security teams with deep pockets aren’t successful.
It’s difficult from many points of view: technology, data, stakeholders. More people need to know about security. We have more security tools, which give us more data. We need to harness it all as best we can to make the best decisions to reduce business risk.
To do it properly, you need to combine high levels of automation with the knowledge and skills of many different people.
You need someone with vision, usually a CISO, who understands the mission. The business analysis skills to interact with different stakeholders. The security technology skills, to understand the technologies involved. The data science skills to bring that data together in a way that makes sense to the end users. And obviously, the technical skills to build a system like that.
In 2023, we need to recognize the increasing importance of the CISO role and the personal impact of working in such a stressful environment. And give these people the support they need to do the job without burning themselves out.
##
ABOUT THE AUTHOR
Nik Whitfield, Founder and Chairman, Panaseer
Nik is Chairman and Chief Seer at Panaseer. He founded the company in 2014 with the mission to protect the services and data that we all rely on. Panaseer provides the first enterprise Continuous Controls Monitoring platform, designed to prevent control failures and cyber security breaches, by providing high quality, automated metrics and measurements.
Prior to founding Panaseer, Nik developed trading and risk management systems for the banking sector. Through his time as an entrepreneur and leader, Nik has developed a passionate interest in personal well-being.
