CS Nov-Dec 2022

2023 predictions
PaaS, such as containers. Next generation
XDR can take telemetry from assets like
containers into a more modern Security
Orchestration, Automation and Response
(SOAR) platform. Tools such as these are
becoming an increasingly critical function
to support, secure and ultimately keep up
with digital transformation."
STEPHANIE BEST, DIRECTOR OF
PRODUCT MARKETING, SALT SECURITY
"2023 will be the year of API security. API
traffic has increased 168% over the past year,
with malicious traffic growing 117% in
the same period. As business infrastructure
increasingly moves towards digitalisation,
API traffic, malicious and otherwise, will
only continue to increase through 2023. If
businesses are to protect themselves from
the torrent of attacks coming their way,
they must recognise the uniqueness of API
security. Traditional security solutions, such
as WAFs, API gateways and bot mitigation,
simply aren't effective at protecting from
most attacks aimed at APIs.
"Attacks on APIs are typically 'low and slow',
with attackers searching for unique business
logic flaws for weeks or even months before
they succeed. As these attacks aren't as overt
as more traditional methods, they cannot be
detected by security tools that are not APIspecific.
What's more, basic security tools
such as authentication, authorisation and
encryption fail to meet the challenge of
contemporary API security.
"Businesses require deep, detailed context to
understand and protect their API ecosystems
- that means being able to distinguish
normal API activity from anomalies amidst
millions of API calls. Basic security tools just
don't provide that context, leaving businesses
at risk.
"While it's not certain that businesses will
wise up to the importance of API security,
attacks on APIs will certainly increase.
Just this year, Australian telco giant Optus
suffered an API security incident with
catastrophic results. The breach resulted
directly from broken user authentication, the
second biggest API vulnerability, according to
the OWASP API Security Top 10.
"Attackers know that they can easily exfiltrate
data from unauthenticated APIs. With an API
security platform able to provide continuous
visibility in runtime and show the normal
behaviours of APIs versus anomalies, this
threat could have been identified before
the attacker accessed the user data. If
organisations don't learn from Optus's
mistakes, 2023 will be riddled with major
API security failures. In short, 2023 is either
going to be the year of API security or API
security incidents. The end result will be
determined by whether businesses wise up
to the need for API-specific security or
continue to rely on old security solutions for
a very modern problem.
JOHN GOODACRE, DIRECTOR OF THE
UKRI'S DIGITAL SECURITY BY DESIGN
CHALLENGE AND PROFESSOR OF
COMPUTER ARCHITECTURES AT
MANCHESTER UNIVERSITY
"As we head into 2023, the financial impact
of cybercrime is heading towards the $10
trillion mark, with no signs of slowing. As
our world becomes ever more connected
and dependent on technology, the
traditional approach to cyber security
of cleanliness and the rush to patch will
continue to struggle to keep up. The
doom-and-gloom headlines will continue
to be written about data loss and a lack of
resilience or trust from an ever-increasing
breadth of cyber-attack across the digital
world.
"IT teams and users alike are already
stretched to the limit, many acknowledging
that they do not have the skills or time to
keep up with the almost weekly attempted
attacks and zero-day patches. Simply
monitoring for and patching vulnerabilities
that are discovered at the user level is not
a battle that can be won by the defenders,
especially when attackers only need to be
right once to exploit a vulnerability.
"The UK is seeking to do something about
this to balance responsibility across the
supply chain. Already in 2022, we have seen
the Government's PSTI Bill looking to ensure
that consumer products are shipped more
securely by default, placing more
responsibility on the product manufacturer.
"The UK Government is not stopping here,
though. As part of the UK's National Cyber
Strategy, there is now a focus on the underlying
technology that our digital world is
built upon, ensuring products are not only
secured by default to help reduce the
number of vulnerabilities, but also secured
by design of the components and enabling
technologies to help protect against the
inevitable remaining vulnerabilities.
"UK Research and Innovation's Digital
Security by Design Programme, part of
the National Cyber Strategy, has been
redesigning from the ground up the way
software interacts with hardware, so it can
block the exploitation of around 70% of
the ongoing discovered vulnerabilities
by design, while also enabling software
development new ways to maintain
resilience and integrity. Working across
government, industry and academia, the
£300m programme has been distributing a
prototype, with developers and researchers
finding more ways to protect everything
digital from cyber and operational incidents.
"As we move into 2023, we will really start
to see early examples for sectors where this
innovative technology can reduce threats
and block exploitation of vulnerabilities.
Developers and IT teams will become more
vocal, pressing for the day they can benefit
from new hardware that can actively block
exploitation of vulnerabilities and their need
to chase the ever-increasing number
of patches."
14
computing security Nov/Dec 2022 @CSMagAndAwards www.computingsecurity.co.uk