CS Jan-Feb 2024

2024 predictions
Aaron Kiemele, Jamf: smaller businesses
in the supply chain or partner ecosystem
will increasingly be attacked as vectors to
the true targets.
Simon Hodgkinson, Semperis: Businesses
are finally starting to understand that cyber
is an enterprise risk.
features in Active Directory. It is good to see
that there is a bigger focus placed on identity
protection.
Zscaler
AI and machine learning (ML) will resurface
the data privacy debate. We are starting
to see customers asking about how best to
protect their own data when working with
third-party providers. There is a growing
concern that, as cloud providers and other
vendors have access to an organisation's
data, they are more likely to become a
target of bad actors to acquire a company's
data using AI and ML solutions.
Additionally, there is also a legislation
discussion to be had, as GDPR currently
puts AI models in jeopardy. As models are
trained on datasets, organisations need
a stable and consistent set of data, in
order to be as accurate as possible. GDPR
currently says that companies should only
keep data for as long as it is necessary
to process it, which could have serious
implications for AI models moving forward.
In 2024, we expect companies to revisit
their data privacy statutes and strive to
enforce more bespoke data loss prevention
(DLP) tools to secure their datasets and
ensure data privacy is at the top of the
cybersecurity agenda.
Organisations will need to learn to hide
their attack surface at a data level. The
influx of generative AI, such as ChatGPT,
has forced businesses to realise that, if their
data is available on the internet, then it
can be used by generative AI and therefore
competitors, no matter if it is an owned IP
or not. So, if organisations want to avoid
their IP getting utilised by AI tools, then
they will need to ensure their attack surface
is now hidden on a data level, rather than
just at an application level. Based on this
trend, we predict we will see initiatives
to classify data into risk categories and
implement security measurements
accordingly to prevent leakage of IP.
Amit Sinha, CEO, DigiCert
AI may be a coup for defenders, but in 2024
attackers are going to use it to develop new
tactics and launch ever-more sophisticated
attacks. At the most basic level, they'll be
able to use generative AIs like ChatGPT or
malicious versions like FraudGPT to educate
themselves on how to plan and perpetrate
cyberattacks, with little pre-existing technical
knowledge or coding experience. Even fledgling
attackers will be able to use AI capabilities
to scrape key information about potential
victims, harvesting crucial data from
around the internet to enable social engineering
attacks and perpetrate identity fraud.
Generative AIs will be increasingly used to
create sophisticated malware that can avoid
detection by using advanced techniques like
Steganography. Indeed, examples of this
have already emerged. These 'intelligent'
malware strains will be harder to anticipate
and many legacy detection systems will
struggle to keep up against these new
threats.
Just as AI technologies will grant the ability
to create websites quickly, it will allow attackers
to create fake websites, watering holes
and phishing websites like never before -
because of AI's ability to write, build and
render a page as fast as a search result can
be delivered.
Generative AIs are also capable of impersonating
others by learning their writing style
and tone of voice. This sets the stage for
advanced phishing attacks that can better
impersonate a victim's colleagues, friends or
family than a real human can. This will give
spear-phishing and highly targeted phishing
attacks a much greater degree of authenticity,
especially because they'll emanate from
trusted accounts that the intended victim
supposedly knows well. Better and more
realistic Deepfakes will also emerge, which
will fuel social engineering and
12
computing security Jan/Feb 2024 @CSMagAndAwards www.computingsecurity.co.uk