RSA Blog | By Bob Ackerman

Cybersecurity hackers are inexorably persistent and effective. New hackers keep cropping up, veterans keep improving, and both often manage to penetrate corporations and other organizations that boast strong cyber protection.

The data supporting this is widespread. Verizon’s latest 12-month Data Breach Investigation Report states there were a record 10,626 confirmed data breaches in this period globally, almost a third of them in the US. Separately, a recently published Wall Street Journal survey of 300 US and Canadian compliance professionals over the past year reported that 9 of 10 companies found cybersecurity risks rose over the past year, often substantially.

Organizations need to attack potential digital threats from many angles. One way for them to stay relatively protected is to remain up-to-date on industry trends and the latest hacker tactics, techniques, and procedures. But they also need to know what they are up against. In this spirit, here are the newest threats today or on the horizon, as well as updates on more mature threats.

Among the new threats is a sharp increase in artificial intelligence employed by hackers. The FBI has told the media that criminals are using technology such as generative AI to launch attacks that heretofore had only been instigated by sophisticated threat groups. These have included spear-phishing, social-engineering attacks, and the deployment of deep fakes to confuse targeted individuals.

There are also pending threats on the outer space front and the fear that supply chain products, like electric cars, made for the US in China and other foreign countries may pose cybersecurity risks.

According to a recent study by California Polytechnic State University, potential space attacks could easily cause problems on the ground. If GPS systems are disrupted, for instance, that interferes with transportation. Telecommunications relies heavily on satellites in other ways as well, as does weather forecasting and disaster recovery. To that end, The Pentagon has sponsored a satellite hacking contest to determine hacker ability to compromise a satellite. 

Regarding electric vehicles, small automotive technology suppliers, and major car manufacturers, including Volkswagen and Ford, are working to shape pending rules from the US Commerce Department that could limit how the US auto sector uses technology from Chinese companies. The initiative stems from an order President Biden gave the Commerce Department in February to investigate potential national security risks from foreign-made software in cars, given worries that Chinese car technology could collect sensitive data, such as drivers’ locations or biometric data, allowing cars to be remotely hacked.

Currently, Chinese technology isn’t prevalent in cars available in the US, but the goal is to stop electric vehicle cyber risks from becoming pervasive. On a separate but related front, the Biden administration is already investing in domestic manufacturing of cargo cranes to replace widely used Chinese-built cranes at US ports, which have been found to contain components with cellular modems not requested at select ports.

There are also growing issues in the defensive sector of cybersecurity. The government is prodding board directors at critical infrastructure companies to improve cybersecurity oversight amid intense hacking campaigns. The vast majority (88%) of S&P 500 companies have been have been shown not to have any board directors with specialized cybersecurity backgrounds. Accordingly, the Cybersecurity and Infrastructure Security Agency (CISA) and other entities last month delivered a one-day course in Maryland to 16 such directors to enhance their cybersecurity knowledge – a training plan likely to grow.

Here is a brief look at the current standing of more mature cyber threats.

+ Organizational Vulnerabilities: The number of actively exploited vulnerabilities assigned to the National Vulnerabilities Database grew by more than 1,500 last year for a total of 26,447 known vulnerabilities. One of the most prominent examples was the growth of vulnerabilities found in Microsoft Exchange servers. Another major area of vulnerability is Internet of Things (IoT) devices with inherent vulnerabilities that cybercriminals can exploit.

+ Supply Chain Attacks: Supply chain attacks are a relatively new cybercrime innovation that continues to grow in scope and frequency. Hackers infiltrate supply chain technology as conduits for distributing malware into supply systems. Preventing supply chain attacks is challenging because of increased reliance on open-source platforms and APIs. But organizations can mitigate hacks by staying current with system patches and updates and by using endpoint monitoring tools to spot and stop suspicious activity.

+ Crime-as-a-Service: This growing threat allows cybercriminals to outsource the technical aspects of their operations to other cybercriminals with more expertise. These services are typically provided via a paid subscription model. This increases cyberattacks because it lowers the barrier to entry for would-be criminals.

+ Cloud-Based Attacks: With so many businesses relying on the cloud and with cloud networks becoming more intricate, cloud infrastructure offers plenty of low-hanging fruit for digital threat actors, including misconfigurations of settings and installs. Because cloud-based applications shoulder most of the modern corporate workload, a focus on airtight cybersecurity practices is the best step – one that always includes implementation of a sound data backup plan.

Best Practices for Cybersecurity Professionals

As usual, cyber professionals need to do the best they can, recognizing they’re not infallible. They’re probably best off broadly embracing the aforementioned suggestions regarding supply chain attack protection. In addition, they should also make a point of implementing audits, employing the adoption of enterprise-class software, staying proactive in client system updates, and continuously training the staff in cybersecurity, cognizant that the cybersecurity landscape is always evolving.

See article here.