As shared in part one of this installment, the global marketplace faces an increasingly destructive cyber risk landscape each year, and 2024 is set to confirm this trend. The cost of data breaches alone is expected to reach $5 trillion, a growth of 11% from 2023. As technology advances, attackers continue to develop new, more sophisticated methods for infiltrating systems and exploiting vulnerabilities.
Among cyber experts, it is now widely acknowledged that the question of an attack is not “if” but “when.” Preparing for this imminent event with proactive cyber risk management measures has become more critical than ever for organizations to reduce overall loss, minimize downtime, and remain resilient.
While we may not yet possess the power to predict the future with absolute certainty, we do have the ability to make highly calibrated projections. As we approach 2024, it’s paramount that cybersecurity leaders and organizational executives alike work together, leveraging these projections, emerging industry patterns, and global threat-intelligent insights to develop data-driven risk mitigation programs.
In this second part of the top trends driving 2024, here are top remaining three:
Cyber Risk Management Trend 5: Heightened Adoption of a CTEM Approach with CRQ Models
In 2022, Gartner introduced their continuous threat exposure management (CTEM) program for cybersecurity. Their approach is structured to address the dynamic nature of cyber threats, advocating that a continuous evaluation of the accessibility, exposure, and exploitability of an organization’s digital assets is crucial for cyber resilience.
Gartner’s CTEM program outlines five straightforward steps to achieve such resiliency:
- Scope for existing cybersecurity exposure
- Develop a discovery process for hidden vulnerabilities
- Prioritize threats according to exploitation likelihood
- Validate and assess various attack scenarios
- Mobilize the employees at all organizational levels
With the risk landscape evolving at an unprecedented rate, more organizations will implement the CTEM framework into their overall governance practices. To facilitate this ongoing cyber risk management method, CISOs will also gravitate toward CRQ solutions that can give them a granular understanding of where their organizations’ most significant threats are present.
Tip: Incorporate an On-Demand CRQ Solution as a CTEM Enabler
Financial CRQ models incorporate a corporation’s internal threat data and external information like global threat intelligence, insurance loss intelligence, and technological footprints to produce highly accurate, granular risk assessments. With these insights, CISOs can create highly targeted cyber risk mitigation strategies that address the organization’s most pressing vulnerabilities.
However, to fully adopt CTEM, cybersecurity professionals must choose a CRQ tool that can run quantifications on-demand, accounting for the volatility of the cyber risk landscape. Other assessment models can be highly time-consuming and resource-intensive, rendering results obsolete by the time of conclusion. The realm of cybersecurity evolves quickly, and tools need to be able to make the necessary adjustments.
As opposed to other types of CRQ solutions, financially oriented ones are also particularly applicable to the CTEM framework, as they will enable broader business collaboration. As step 5 in the program highlights, employee mobilization leads to high-end resiliency. By translating cyber risk into likelihoods and monetary impact, non-technical colleagues can join cybersecurity discussions and appreciate the value of cyber initiatives.
Cyber Risk Management Trend 6: Enterprises Will Dispute Redundant Terms and Explore Self-Insurance
Cyber insurance is a relatively new market, so unlike home or auto coverage calculations, underwriters lack a standardized approach to potential parametric solutions. Combined with the fact that cyber events have the potential to cause global catastrophes, insurance providers have become increasingly weary as the scale of attacks grows, projecting their trepidations into policy costs.
Although we should not expect the high cost of premiums to rise any further, the exorbitant costs, coupled with policy restrictions regarding third-party service provider events, will lead to more enterprises investigating self-insurance options with CRQ models.
Financial CRQ models can accurately calculate an organization’s unique risk exposure landscape and illuminate the potential financial damage caused by a cyber event. CISOs can compare these insights with their current policy, discovering how likely the company is to exceed the deductible.
Tip: Use Granular Insights to Optimize Coverage
As budgets continue to decrease, it’s paramount that CISOs make the most financially sound decisions regarding self-insurance. To navigate this landscape, organizations can leverage a financial CRQ model that can break down policies according to specific business impact scenarios. This capability reveals granular details, helping organizations identify the areas in which self-insurance may be more cost-effective.
For instance, a CISO may discover that there is a high likelihood of experiencing an event due to a third-party service provider failure but a relatively low chance of a ransomware or extortion event. Armed with these insights, organizations can negotiate more favorable terms aligned with their unique cyber risks, factoring in the expected financial damage calculated for each specific scenario.
While research shows that companies that invest in cyber insurance policies tend to have shorter attack detection and response times, this result is more indicative of an in-depth risk assessment that factors in an organization’s specific cyber environment. Only after this knowledge is obtained can cybersecurity teams devise the most economical mitigation strategy, whether it involves transfer or potentially opting for self-insurance.
Cyber Risk Management Trend 7: Continued Exploitation of Credentials as Initial Attack Vector
Across all industries, there is an astonishing amount of compromised credentials, which bad actors will leverage to exploit vulnerabilities and internet-exposed assets, which can be reached without any internal access.
Cybersecurity leaders need to pay closer attention to this risk in the upcoming year. Compromised credentials are an elementary, and therefore attractive, means of gaining entrance to a system. It’s also a highly effective initial attack vector because it requires so little effort but has the potential to cause material damage.
To harvest these credentials, cyber attackers will typically initiate data breaches of service providers, prepare massive phishing campaigns, or install malware that steals login information. Once the information is obtained, the attackers usually sell it to another malicious group, which then initiates an attack on a specific organization.
Cybersecurity experts also need to keep compromised credentials in mind due to the human element. Weak passwords, often a product of lax password policies that don’t require minimum complexities or regular updates, create a susceptible attack entrance point. Employees also typically reuse passwords across multiple accounts, further exacerbating their vulnerability.
Tip: Implement MFA Now and Manage Access Permissions
If your organization doesn’t employ multi-factor authentication (MFA), tell your head of cybersecurity or CISO to institute this practice now! Even if credentials are harvested, MFA significantly reduces the likelihood of the attacker gaining entrance to the system. Likewise, if not already in place, there should be mandatory password resets every few months.
Managing permissions for internet-exposed assets is equally vital. Restricting access based on specific IPs, locations, or administrative roles helps to control who can interact with the company’s systems. Ultimately, this granular approach minimized the attack surface, making it more challenging for malicious actors to exploit the vulnerabilities.
Customizing Cybersecurity in 2024: Tailored, Continuous Risk Assessments
While the cyber risk landscape is constantly evolving, the end of the year offers a valuable reflection point to project where it’s headed. The estimated global financial damage caused by cyber-attacks, increasingly sophisticated entry methods, and greater boardroom involvement all accentuate the urgency for organizations to adopt proactive approaches to fortify their digital defenses.
Amid these trends, the importance of in-depth risk CRQ assessments tailored to a company’s specific cyber postures arises. Cybersecurity teams need granular insights to prioritize initiatives and formulate the most cost-effective data-driven mitigation strategies. Plans should be easily adaptable to incorporate the latest internal and external threat intelligence data.
Ultimately, no one knows what the cyber future brings. The best we can do is prepare for what we know, harnessing the most calibrated insights available.
This article was originally published on the author’s blog and reprinted with permission.