Cyber security awareness is at an all-time high after an incident occurs. Times and times again, statistics and news headlines indicate that companies still tend to react rather than prevent threats. In early 2024 alone, there were around 30 billion records breached in publicly disclosed incidents. And most don't actually feel confident in their ability to defend against cyber attacks. Not to mention the broader context of accelerated cloud technology adoption, generative AI, and challenges such as conflicts that extend to the digital world through cyberwarfare.
This shows us that preventive measures are no longer enough to contain cyber security threats in 2024. Is your organisation ready? What is the best approach? Read on to find out more!
In this article, I will discuss this year’s 9 most important cyber security trends and shed some light on what to do to safeguard your organisation.
The evolution of generative AI brings both threats and opportunities. Attacks are getting increasingly sophisticated, with next-level phishing attacks, automated malware and deepfakes.
Companies have to strengthen their capacity to detect and neutralise these challenges. Advantages include real-time anomaly detection, identifying suspicious emails, and analysing vast amounts of data in a short amount of time.
Of course, best practices include updating your company’s cyber security guidelines frequently to keep up with new advancements. For instance, at Qubiz, we have teams that are working with AI, analysing its potential and how we can reduce potential risks.
Not everyone who has access to security-related information will also apply that knowledge. I usually give examples and numbers to raise awareness and for people to truly internalise this message. Negative examples show that it can happen to anyone, regardless of company size and industry.
Another important aspect is the soft skills security professionals need to navigate threats. Security is mostly about behaviour - threat actors prey on our fears, such as our fear of missing out on an opportunity. A deepfake video can seem very convincing to the average person.
Or, they count on the fact that people have decision fatigue and are too tired at the end of the workday to scan for threats before clicking on a link. Security professionals need the technical know-how and people skills to raise awareness in the organisation and understand the security threats associated with each role.
For us, awareness is interconnected: people, tech and processes. Even if it takes considerable effort, our priority is implementing proactive measures.
Internet of things (IoT) adoption is on the rise, which brings many benefits from a business standpoint. However, without proper security measures, IoT attacks will also increase.
Globally, the most common example is increased attacks due to improper work-from-home infrastructures. Home-owned devices don’t have the same level of security protection as company-owned ones. In 2024, the probability of attacks increases as AI gets more sophisticated and people are eager to have more IoT devices in their homes.
To counteract this, companies must be very careful about their work-from-home guidelines, have solid training programs, and provide regular software updates.
Although we are seeing the widespread adoption of new technology, there’s a significant skill gap in security. It’s estimated that around 4 million cyber security professionals are needed worldwide- almost double the current workforce.
Conversely, it’s not just about attracting talent but also training professionals in cyber security analysis, incident response and management, compliance, network security, cloud computing, etc. The good news is that this area has plenty of opportunities for people who want to make a career switch or upskill.
However, organisations have to find a balance between adopting new technology, such as AI and the risks associated with it.
Adopting a new tool or technology usually comes with a skills gap. Our strategy is to close the skills gap through training programs and workshops. We also run frequent simulations to test our abilities to detect and report threats.
In 2024, as threats accelerate, so does the importance of CSOs and CISOs collaborating more closely with management. Their strategic input and influence will set organisations on the right path towards enhanced security.
The added value of a CSO is acting as a liaison between departments. I think of my role as a facilitator, ensuring that things go according to plan. I’m here to offer help and come up with ideas.
Ideally, a CSO should have a broad knowledge of everything related to security, including physical security, cyber security, IT management, software development, etc.
Previously, I was an IT manager for a couple of companies, so I'm always in the background, keeping an eye on our processes and overall security. But I couldn’t do so without a good team to back me up. My CSO deputy is an experienced system and network engineer.
However, we have around 20 people working in their respective areas to ensure compliance, including IT staff (Dan Gabor is one of the best system engineers in Cluj-Napoca), legal, marketing, management, development, QA, BI, finance, HR, and administration. Also, consistently contributing to the big security picture and supporting security efforts are our DPO and the direct top management, Tibor Laszlo.
With the rise of AI, the top threat that security professionals worry about is social engineering or the human factor. The truth is that we’re all prone to errors. Social engineering attacks exploit this weakness, manipulating employees into sharing sensitive data.
Phishing is also a top threat. They are very diverse and getting “better” every day. Aside from spear phishing, whaling, smishing, etc., there has been a surge in deep fake phishing attacks boosted by AI and machine learning advancements. All companies should be concerned about this as more diversity in this area is the last thing we need.
Ransomware is also very prevalent, as it has increased by a staggering 72% in 2023. This is very concerning as ransomware had actually declined in previous years. Although the types of threats are not new, technological evolution makes them more dangerous than ever before.
Cyber attacks have a wider implication as they pose a risk to national security, economic, political, health and education systems. Recently, a ransomware attack has impacted 100 hospitals across Romania, forcing them to go offline. The implications are immense, especially for patient care and the healthcare system’s ability to avoid sensitive medical data breaches.
For enterprises, this means more regulations and laws to navigate. They will have to constantly maintain their security standards, as well as demonstrate that they can be trusted vendors.
Ar Qubiz, we’re ISO 27001:2013 certified and plan to obtain the ISO 27001:2022 certification. We’re also expecting more regulations around IT management, cloud management, asset management, QA, and software development - to name a few.
A security system cannot be independent of the business reality. With frameworks such as ISO 27001:2013, you benefit from an internationally recognised standard. But you have the freedom to choose your internal compliance procedures. Why?
One of the biggest traps that a company can fall into is separating security from business goals. Security has to be more complex and integrated into the business strategy. Less than zero trust states that threats extend beyond the company offices - remote working, third-party vendors, etc. are also a part of the security ecosystem.
A dedicated security team knows how the organisation works, its vulnerabilities and its strengths.
For example, most Qubiz roles are in software development, but you also have HR, marketing, legal, finance – that is more than 20 people working together. The threats associated with each job are different, so we consider that when we do risk assessments.
Generally speaking, building trust in a brand or company takes years, which is challenging to restore, so prevention has been a top priority for many years.
In reality, there is no 100% security guarantee, so we are now seeing a paradigm shift from cyber security to cyber security resilience.
So, the added value of security is ensuring business continuity or the organisation’s ability to bounce back with minimum data loss and downtime. For this to happen, you need an effective business continuity plan, an incident response plan and a disaster recovery plan that considers all potential scenarios and adapts to new developments in an agile manner.
Sure, adopting new tools and updating guidelines is great. However, the biggest challenge for CSOs and companies will be creating a security culture.
From my perspective, I see a stronger culture starting to form at Qubiz. My colleagues, whether we’re talking about development, testing, delivery management, or technical management, are very interested in this area.
We’re also proud that we’ve hit all of our security targets and have prioritised awareness and ownership. The latter is important since everyone has a role to play in an organisation’s security efforts.
