In 2024, the cybersecurity landscape is expected to undergo significant changes. We asked Next CEO Connie Stack and Head of Product John Stringer about what they foresee in the coming year. But before we dive into their predictions, here are a few to get things rolling.
We predict one major trend will be the adoption of passwordless authentication. SMS-based Multi-Factor Authentication (MFA) will decline in favor of more secure options such as time-based one-time passwords (TOTP) generated by authenticator apps. This shift will reduce reliance on traditional passwords and instead use methods like passkeys, biometrics, hardware tokens, or public-key cryptography for accessing accounts and systems.
Given the increasing number of data breaches they have experienced, we expect to see more law firms prioritizing cybersecurity. In doing so, law firms will improve threat detection coverage and reduce system vulnerabilities specific to their business.
Additionally, phishing attacks will become more sophisticated, incorporating AI to create highly personalized social engineering attacks. The rise of 3D attacks, including voice and video, will be the new frontier of phishing.
Finally, we anticipate 2024 to continue the broadening acceptance of AI tools in the workplace. As more workers embrace Generative AI tools, sanctioned and unsanctioned, threat actors will focus on targeting AI systems to exploit vulnerabilities and blind spots these new technologies will introduce.
These are just a few of the cybersecurity predictions for 2024. Continue reading to learn more about the upcoming trends and developments according to top thought leaders in cybersecurity.
Connie Stack, CEO, Next DLP
Predictions from Connie Stack on Cybersecurity in 2024
"In 2024, organizations will be pressured to consolidate their security stack. Driven by a continued shortage of cybersecurity talent and cost-saving initiatives, in 2024, we will continue to see CISOs pressured by non-security-focused peers and executives to adopt some of Big Tech’s solutions as the single source of data protection.
"Consolidation is here to stay, but putting all your eggs in one basket is never a good strategy - in life or cybersecurity. There's a long list of pros and cons.
"Cost savings is the core pro for a “good-enough” broad platform, but CISOs must consider the cons seriously. From solution gaps to narrow OS and app coverage to additional staff or consultants required to manage complex implementations, software subscriptions' widely touted cost-savings can quickly be eaten up by supplemental point solutions and consulting fees. Additionally, more red flags become apparent when considering how challenging it is to get resolution on support tickets and feature requests. "
"As we start this year, I would remind anyone looking to consolidate in 2024 to evaluate their current stack, identify which tools can be replaced, and develop a roadmap tailored to your specific security goals. Consolidation involves more than adopting new technology or embracing an aggressively discounted license that finance teams adore; it's about reshaping your security strategy, leveraging Big Tech and other specialist solution providers, quantifying the total cost of ownership, understanding your gaps, and aligning them with your organization's goals and security needs."
John Stringer, Head of Product, Next DLP
Predictions from John Stringer on Cybersecurity in 2024
"In 2024, AI will better inform cybersecurity risk prevention decision-making. I also predict we'll continue to see rising data security risk from insiders in response to return-to-office policies and more strict work-from-home controls.
"With AI estimated to grow more than 35% annually until 2030, businesses have swiftly adopted the technology to streamline processes across a variety of departments. We already see organizations using AI to identify high-risk data, monitor potential insider threat activity, detect unauthorized usage, and enforce policies for data handling. Over the next year, AI will power data loss prevention (DLP) and Insider Risk Management (IRM) efforts by detecting risky activity and then alerting IT teams who can analyze their movements and respond accordingly, preventing further cybersecurity issues from arising.
"Insider threats will manifest in other ways in the new year, too. As companies implement more strict policies about office working and fewer days at home, disgruntled staff - particularly younger employees who have only experienced a “post-Covid” working environment - may lash out at policies perceived as unfair. Frustrated employees could turn to stealing data and leaking sensitive company information, leading to wider security concerns that may impact brand reputation."
Additional Reading: Others on Cybersecurity Trends in 2024
Forecasting 2024 Cybersecurity Threats: IoT, Supply Chain, and AI Issues
Spiceworks and Forbes predict greater threats for IoT, supply chain, and AI.
In 2024, the increasing vulnerabilities of IoT devices and the persistence of supply chain attacks will require prioritizing security features, updates, and stringent measures to detect threats.
Manufacturers and consumers will prioritize security features, firmware updates, and robust authentication mechanisms to protect against IoT-related threats.
Supply chain attacks will persist, with threat actors focusing on compromising software and hardware providers to infiltrate downstream targets.
Businesses must implement stringent supply chain security measures, conduct thorough vendor assessments, and adopt a proactive approach to detecting and mitigating potential threats.
Organizations' inability to identify the lineage of AI will lead to an increase in software supply chain attacks.
2024 Cybersecurity Threats: Ransomware, AI, and Cryptocurrency Risks
Government Technology and Forbes both predict increased ransomware attacks, cryptocurrency risks, and enhanced attacks from and through AI platforms.
Phishing and Business Email Compromise (BEC) attacks are becoming more sophisticated, using personal information from the Dark Web, LinkedIn, and other internet sources to create highly detailed and convincing targeted profiles.
Attackers will use trusted services like Outlook.com or Gmail to increase credibility and legitimacy.
Cybercriminals are employing multi-stage attacks, starting with email engagement and then convincing victims to communicate over the phone to establish verbal trust and a sense of urgency.
AI is being used to generate these attacks, to get victims on the phone with a live person.
The rise of 3D attacks, including voice and video, is expected in phishing attempts.
Deep fakes and video impersonations of celebrities and executives are already being used, and this technology will become more accessible and affordable for criminals to impersonate trusted contacts.
Generative AI will create highly personalized social engineering attacks at scale, making phishing lures harder to detect.
Once attackers gain access to an email account, they can automatically scan threads for important contacts and conversations, sending back updated versions of documents with malware implanted.
Cyberattacks are expected to increase, targeting vendors, government agencies, and critical infrastructure in the United States.
AI, particularly generative AI, will help attackers refine their techniques and fabricate convincing phishing emails and messages to gain initial organizational access.
AI can also assist organizational cyber defense by automating preventative measures and specialized testing of AI applications to assess their security and find potential vulnerabilities within networks.
2024 Predictions: AI and Machine Learning in Cybersecurity
Security Magazine and Spiceworks predict the use of AI and ML to improve cybersecurity.
AI and machine learning will enhance endpoint and vulnerability management.
Attackers will use generative AI to make phishing lures harder to detect, leading to more endpoint compromise.
"AI PCs" will revolutionize how people interact with their endpoint devices.
AI PCs will enable the use of "local Large Language Models (LLMs)" and act as personalized assistants.
AI-driven tools will scrutinize code for potential security flaws during development and ensure secure configurations during deployment.
This enhanced scrutiny is vital for deploying software with greater efficacy, identifying and mitigating vulnerabilities before they become threats.
AI can facilitate rapid actions such as wiping and rebuilding affected systems or reconfiguring settings to eliminate threats and restore security in the event of a breach.
Rapid response minimizes downtime and mitigates the risk of further exploitation.
AI and ML in 2024 Cyberattacks: Predictions and Countermeasures
Forbes further weighs in on AI and ML - although, as attackers may use them. Recap from [forbes.com].
In 2024, cybercriminals are expected to utilize artificial intelligence (AI) and machine learning (ML) to automate and enhance their cyberattacks .
AI and ML will enable cybercriminals to create more sophisticated and adaptive attacks, making it harder for traditional security measures to detect and mitigate them.
By leveraging AI and ML, cybercriminals can automate various stages of the attack process, such as reconnaissance, vulnerability scanning, and even the execution of the attack itself.
These technologies can also be used to analyze large amounts of data and identify vulnerabilities in target systems, allowing cybercriminals to exploit them more effectively.
AI-powered attacks can also adapt and evolve in real-time, making it challenging for security systems to keep up with the constantly changing threat landscape.
To combat these evolving threats, cybersecurity professionals need to harness the power of AI themselves and develop advanced defense mechanisms that can detect and respond to AI-driven attacks.
This requires developing AI-based security solutions that can analyze and interpret vast amounts of data to identify potential threats and take proactive measures to prevent them.
Additionally, organizations need to invest in AI and ML technologies to augment their cybersecurity teams and enable them to detect and respond to AI-driven attacks effectively.
2024 Cybersecurity Advancements: Quantum Computing, AI, and ML
Splashtop weighed in on how they see quantum computing working with AI and ML to chance cybersecurity in 2024.
Quantum computing has the potential to strengthen cybersecurity measures by enhancing encryption methods, developing more sophisticated algorithms for detecting cyber threats, and efficiently managing large-scale, secure data operations. However, it also poses significant threats to current cybersecurity protocols, as its immense processing power can quickly break traditional encryption methods, leaving existing security systems vulnerable.
AI's advanced data analysis capabilities are increasingly used for identifying and predicting cyber threats, enhancing early detection systems. ML algorithms are evolving to better recognize and respond to new threats, improving defensive measures over time.
AI algorithms are expected to provide real-time threat analysis in 2024, enabling faster and more accurate responses to cyber incidents.
ML will likely advance to adapt and update cybersecurity protocols autonomously, reducing reliance on manual updates.
The emergence of AI-driven security bots, programmed to independently identify and neutralize cyber threats, is expected, making network security more proactive and less reactive.
These developments signify a shift towards more intelligent and autonomous cybersecurity systems, driven by the advancements in AI and ML.
Quantum Computing's Impact on Cybersecurity and CISOs' Evolving Role in 2024
Forbes and Spiceworks predict quantum computing's impact on cybersecurity as well as the evolving role of CISOs.
Advancements in quantum computing will significantly impact cybersecurity in 2024.
Quantum computers possess immense computational power that could potentially break existing encryption algorithms.
This necessitates the development of new encryption and security measures to protect sensitive data.
Organizations should stay informed about the latest developments in quantum computing and consider investing in quantum-resistant cryptography.
CISOs (Chief Information Security Officers) will have an elevated position in the boardroom in 2024.
Cybersecurity will become a fiduciary responsibility for CISOs, highlighting the importance of their role in protecting the organization's assets and reputation.
CISOs will be responsible for ensuring that the organization's cybersecurity strategy aligns with its overall business objectives.
They will also play a crucial role in educating the board and senior management about the potential risks and impact of cyber threats.
The elevated position of CISOs in the boardroom reflects the growing recognition of cybersecurity as a critical aspect of business operations.
Blockchain Technology's Role in Enhancing 2024 Cybersecurity
Splashtop predicts an increase in blockchain technology adoption for securing IoT devices and digital contracts.
Blockchain technology is recognized for its potential to enhance cybersecurity measures thanks to its inherent security features like immutability, transparency, and resistance to tampering.
Blockchain prevents data tampering by recording data on a decentralized ledger, making it nearly impossible for hackers to manipulate.
Blockchain is being used to create more secure and decentralized identity management systems, reducing the risk of identity theft and fraud.
In 2024, blockchain is predicted to play a more integral role in securing Internet of Things (IoT) devices by integrating it into IoT networks, making the entire network more resilient to attacks.
Blockchain-based smart contracts are expected to see increased use in automating and securing digital agreements, enhancing security in various online transactions. The use of blockchain technology in cybersecurity is expected to expand, offering innovative solutions to secure digital data, manage identities, and protect IoT networks.
Zero Trust Principles in 2024 Cybersecurity: Adoption and Impact
Forbes and FTI Consulting predicted a wider adoption of zero trust principles across distributed organizations seeking to secure data.
Zero Trust principles will be widely adopted in 2024 as organizations recognize the need to enhance network security and protect sensitive data, especially in an era of remote work and distributed computing.
Zero Trust architecture refers to the security practice where all internal and external parties must be verified before accessing resources, replacing traditional cybersecurity strategies like network security.
The adoption of Zero Trust is expected to expand further in 2024 as organizations prioritize investments in enhanced cybersecurity models due to the increasing sophistication of threat actors.
This shift from traditional perimeter-based security to Zero Trust reflects the importance of modern cybersecurity strategies in mitigating cyber threats.
Zero Trust principles focus on continuous verification and authentication, ensuring that only authorized users and devices can access resources.
By implementing Zero Trust, organizations can reduce the risk of unauthorized access, data breaches, and lateral movement within their networks.
Zero Trust also gives organizations better visibility and control over their network traffic, allowing them to detect and respond to potential threats more effectively.
The adoption of Zero Trust principles aligns with the evolving cybersecurity landscape and the need for organizations to adapt to new threats and vulnerabilities.
Passwordless Authentication's Impact on 2024 Cybersecurity
Security Magazine shared their prediction about how authentication methods will change in the coming year.
Passwordless authentication will become a standard requirement for most online services and applications.
Traditional methods like SMS-based MFA will decline in favor of more secure options, such as time-based one-time passwords (TOTP) generated by authenticator apps.
Passkeys, biometrics, hardware tokens, and public-key cryptography will replace or supplement passwords for access to accounts and systems.
Enterprises and consumers are increasingly adopting passwordless solutions across various sectors.
Passkeys offer advantages such as eliminating the need to remember passwords and simplifying the login process through biometric verification.
Passkeys allow users to employ the same biometric verification method across multiple devices and accounts, creating a seamless and efficient means of accessing various accounts with ease.
Transitioning to a passwordless mindset may require users to change their habits, but the enhanced security and seamless experience make the transition more user-friendly.
Prioritizing Supply Chain Risk Management in 2024 Cybersecurity
FTI Consulting predicts a more significant role in cybersecurity in ensuring the resilience of supply chains.
Supply chain risk management will become a top priority for organizations in 2024.
Organizations will recognize the importance of a well-prepared and adaptable supply chain in ensuring business continuity and overall resilience in a rapidly evolving global landscape.
There will be heavy investments in evaluating the resilience of supply chains, scrutinizing suppliers' cybersecurity practices, and developing contingency plans to respond to unforeseen challenges effectively.
Organizations will pay closer attention to the cybersecurity practices of their suppliers, especially when relying on Original Equipment Manufacturers (OEMs) for components of their products.
Recent incidents in 2023 will catalyze organizations to carefully scrutinize the cybersecurity practices of their suppliers to prevent unknown supply chain cybersecurity issues from impacting their final products.
2024 Strategies for Mitigating Insider Threats and Enhancing Cybersecurity Training
Security Magazine shared some strategies for two things near and dear to us at Next: mitigating insider threats and improving cybersecurity training.
Insider threats are a significant problem for IT/security teams, with many attacks originating from internal stakeholders who exploit sensitive data.
IT leaders will need to help teams understand their responsibilities and how to prevent credential and data exploitation.
Management should assess their identity management strategies to secure credentials from theft, whether from publicly hosted code repositories or internal applications and systems.
End users need to be educated on protecting themselves from common targeted methods of attack, such as business email compromise, social engineering, and phishing attacks.
Collaboration with other departments within the organization is crucial for effective internal security training.
Security teams should prioritize understanding the mindset of people outside their department to create more impactful and engaging security training.
Techniques like humor, memorable tropes, and simple examples can be used to improve the effectiveness of security training.
Insufficient and ineffective security training can be addressed by creating a better line of defense against insider threats.
2024 Data Privacy Regulations and Compliance Strategies in Cybersecurity
Forbes predicts that remaining compliant with more stringent data privacy regulations will become increasingly important in 2024.
Stricter data privacy regulations in 2024 will require organizations to prioritize the security of customer and user data.
Non-compliance with these regulations can lead to significant fines and damage to the organization's reputation.
To comply with the regulations, companies should invest in robust data protection mechanisms.
Encryption is an essential component of data protection, as it ensures that sensitive information is unreadable to unauthorized individuals.
Access controls should be implemented to restrict access to data only to authorized personnel.
Privacy-aware data management practices should be adopted to ensure that data is handled in a way that respects user privacy.
Organizations should stay updated with evolving legislation to ensure ongoing compliance.
2024 Regulatory Changes and Executive Accountability in Cybersecurity
Along similar lines, FTI Consulting predicts that executives will increasingly be held accountable for maintaining cybersecurity compliance standards in 2024.
Regulatory agencies such as the Security and Exchange Commission (SEC) and the New York Department of Financial Services (NYDFS) are enhancing cybersecurity requirements for organizations.
The SEC has introduced new disclosure rules, while the NYDFS has implemented an annual board reporting requirement for Chief Information Security Officers (CISOs).
Executives, including CISOs and Chief Executive Officers (CEOs), have faced increased scrutiny and even fraud charges in high-profile cybersecurity attacks.
As a result of these regulatory changes and the growing importance of cybersecurity, more executives will be held accountable for insufficient cybersecurity protection for their company and clients.
This accountability may lead to legal trouble for executives who fail to adequately protect their organizations from cyber threats.
Projected Cybercrime Costs and Impacts for 2024 and 2025
Finally, Spiceworks and Government Technology shared predictions for the financial impact of cybercrime in the coming 24 months.
Cybercriminal activities are projected to cost organizations $9.5 trillion in 2024 and $10.5 trillion in 2025.
The estimated losses from cybercrime in 2015 were $3 trillion.
The cost estimates include damage and destruction of data, stolen money, lost productivity, theft of intellectual property, theft of personal and financial data, embezzlement, fraud, post-attack disruption to the normal course of business, forensic investigation, restoration and deletion of hacked data and systems, reputational harm, legal costs, and potentially, regulatory fines.
Cybersecurity spending is projected to continue to grow, with global cybersecurity and risk management spending estimated to reach $215 billion in 2024.
The US is expected to have the highest data breach cost at $5.09 million in 2024.
The cost of global cybercrime is expected to increase 15 percent over the next five years, reaching $10.5 trillion per year by 2025 [govtech.com]. In conclusion, the cybersecurity landscape in 2024 is set to face numerous challenges and advancements. From IoT vulnerabilities to ransomware attacks, the threats are becoming more sophisticated. However, with the rise of AI and machine learning, there is hope for effective countermeasures. Quantum computing and blockchain technology are also expected to play a significant role in enhancing cybersecurity. As we navigate these changes, it is crucial for organizations to prioritize supply chain risk management, insider threat mitigation, and compliance with data privacy regulations. To stay ahead of the curve, talk to us and ensure your business is prepared for the cybersecurity challenges of 2024.
