Cyber Security Risks are a top concern for 2024

As the new year unfolds, organisations take stock of the lessons learned in 2023 and lay out their priorities and strategies for enhancing cyber security in 2024.

Cyber Risk and Governance According to the Allianz Risk Barometer 2024 report, cyber security incidents rank as the foremost concern for businesses of all sizes in 2024. This comes in the wake of numerous supply chain attacks and a surge in ransomware incidents facilitated by Ransomware-as-a-Service (RaaS) in 2023. Additionally, cyber security resilience is identified as a paramount challenge within environmental, social, and governance frameworks.

Board members must grasp their roles and responsibilities concerning cyber security and take measures to ensure they possess the requisite skills, expertise, and resources to govern effectively in this domain. This can prove to be challenging, as underscored by previous research on board cyber competencies.

However, concerns regarding cyber resilience extend beyond individual enterprises; they resonate across the entire UK economy. The UK Department for Science, Innovation, and Technology has initiated efforts to enhance the country’s cyber security resilience. It has launched a call for opinions on a draft Cyber Governance Code of Practice, featuring simplified measures aimed at assisting directors and business leaders in managing cyber risks.

AI and Cyber Security The influence of AI on cyber security is anticipated to further burgeon in 2024, with its role in combatting and facilitating cybercrime expanding.

AI has predominantly been utilised for detecting and responding to cyberattacks, but in 2024, its application by security operations teams is set to increase, alongside exploration into its potential for predicting and thwarting attacks.

Conversely, its propensity for disseminating misinformation is likely to escalate. Indeed, IBM’s cyber-security forecasts for 2024 designate it as the “year of deception”. With several countries, including the US and UK, scheduled for general elections, AI technologies like deepfakes are poised to be deployed to disseminate disinformation and sway election outcomes.

Furthermore, businesses have observed a surge in the utilisation of AI to enhance the efficacy of phishing attacks, aiding cyber criminals in crafting authentic-looking communications in diverse languages. Traditional indicators of suspicious communications, such as spelling and grammar errors, are becoming less reliable.

When coupled with the burgeoning use of AI deepfake technology to replicate video and audio, employees face heightened challenges in discerning genuine interactions from those designed to lure them into inappropriate actions. Employees must undergo enhanced training to exercise greater vigilance, discernment, and skepticism towards anything appearing unusual.

The National Cyber Security Centre (NCSC) has conducted an analysis and compiled a report on the immediate impact of AI on cyber threats.

Moreover, the majority of organisations will engage with third parties in either developing or implementing and utilising AI systems. As evidenced throughout 2023, robust supplier cyber security controls are imperative.

Cyber security assistance is available for small or micro AI technology companies operating in the UK through the NCSC Funded Cyber Essentials Programme, offering free, hands-on support to attain Cyber Essentials Plus certification.

Business Account Compromise Business email compromise has long been a prevalent concern and continues to pose a significant risk. This entails hackers gaining access to legitimate business email accounts for nefarious purposes. However, such attacks are not confined to email accounts and may encompass social media platforms like LinkedIn, WhatsApp, and X (formerly Twitter).

An illustrative incident occurred recently when the US Securities and Exchange Commission (SEC) X account was breached and employed to announce the approval of new Bitcoin Exchange Traded Funds (ETF). This announcement triggered a surge in Bitcoin’s price to $48,000 before the tweet was retracted 20 minutes later, with the SEC disclosing the compromise of its X account.

The attack was executed through an apparent ‘SIM swap’ tactic, wherein the hacker deceived SEC telephone providers into transferring control of a mobile phone number linked to the SEC X account to the hacker’s device, thereby facilitating a password reset. Additionally, the SEC revealed the absence of multi-factor authentication (MFA) on the account, rendering it easier for the hacker to gain access.

Given the plethora of credentials obtainable through data breaches like the Historic Data Leak, it is imperative for organisations to not solely rely on usernames and passwords for account access.

MFA should be activated on all pertinent business accounts, and organisations should consider implementing cyber security measures such as authentication via a dedicated app instead of relying on phone numbers and email addresses, which are more susceptible to compromise. The NCSC Guidance on multi-factor authentication for online services offers further insights on implementing MFA.

Users should also undergo training to question and verify any anomalous or unexpected information or communication, even if seemingly originating from a legitimate source. Mere visual authentication is not sufficient grounds for trust.

Would you like to delve deeper into Cyber security? Contact us for help and support with your data.