Page 25 - Cyber Defense eMagazine April 2023

We saw several predictions come to fruition in 2022:

Continued proliferation of identities: The complexity of digitally transformed enterprise environments
– including a diverse set of endpoints, identities and internal and third-party access points – have created
more vulnerabilities and opportunities for threat actors. Identity compromise continues to be adversaries’
primary mode of attack.

Increasingly sophisticated attack techniques: From big game hunting (BGH) to the growth of
ransomware-as-a-service (RaaS) and data leak sites (DLS), data extortion threat actors continue to
innovate and evolve their tactics. New tactics such as Exmatter, discovered last year by the Cyderes
special operations team, indicate that threat actors are actively in the process of staging and developing
the capability to outright destroy rather than encrypt data.

An overwhelming amount of security alerts and talent challenges: Increased sophistication and
frequency of cyber-attacks has created an unmanageable deluge of alerts. Coupled with the continued
talent shortage, more enterprises are turning to outside providers to manage these alerts, and those
providers are consolidating to provide more comprehensive cybersecurity support for their customers.

Then there are some events in 2022 that simply could not have been predicted. For instance, the Russian
invasion of Ukraine placed cybersecurity at the forefront of global conversations as concerns of cyber
warfare and attacks on critical infrastructure spread across Europe and beyond. Business leaders also
began to speculate whether threat actors would be emboldened to attack targets with greater force and
frequency amid the chaos.

Later in the year when Joe Sullivan, former CSO of Uber, was found guilty of obstruction of justice and
concealment of a felony, there was a new precedent set for security leaders. Suddenly, CISOs faced the
added consequence that they could be held personally responsible for breaches.

In fact, there is an increasing number of laws coming out that aim to add extra layers of governance and
oversight of cyber risk. For example, the SEC proposed last year that it would require public companies
to disclose a breach within four days. And the White House is doubling down on regulation for industries
considered critical to national security.
We were already starting to see the perception of cybersecurity shift at enterprises of all sizes, with
leaders embracing security initiatives at the board level rather than confining them to IT. But the events
of 2022 and increased governance has expedited this shift. In fact, the National Association of Corporate
Directors (NACD) now recommends that boards of directors include at least one member with an
information technology background.

The reality is that security leaders are no longer siloed — they now have a very important seat at the
table. But to truly drive impact within their organization, they must evolve to take a security-oriented
approach to the business, focus resources more strategically, and make it a priority to connect with
leaders from across the organization.

25