網路安全概要： Tenable 對 2023 年的六大預測

As 2022 draws to a close, we asked Tenable experts what they expect for the new year. After reading the tea leaves, they’re forecasting developments in extortion attacks, OT security, SaaS threats, metaverse risks and more!

Dive into these six predictions for 2023 from Tenable experts.

1 - Expect a surge in extortion attacks

Security teams should brace themselves for an intensification of extortion attacks. In the past year, these attacks have gained popularity among cybercriminals, because they’re effective and simpler to carry out than the data-encryption attacks that characterize ransomware. 

Witnessing the success groups like the Lapsus$ gang have had with extortion attacks, attackers are eagerly mimicking their tactics. In 2023, CISOs must be ready to weather a stronger storm of extortion attacks.

For more information about extortion attacks:

• “Cyber Extortion: An Industry Hot Topic” (Center for Internet Security)
• “What is cyber extortion?” (TechTarget)
• “Understanding the LAPSUS$ Extortion Group” (Tenable)
• “Cyber extortion surges 78% on spread of ‘ransomware-as-a-service’” (CFO Dive)
• “DHS Cyber Safety Review Board to focus on Lapsus$ hackers” (CyberScoop)

2 – OT security will dodge budget cuts 

Companies will look closely at their IT cybersecurity spending plans for the new year, as difficult macroeconomic conditions persist. However, they will prioritize securing their critical operational technology (OT) systems and increase spending there accordingly. 

CISOs and their fellow C-level executives, as well as boards of directors, have seen the consequences of high profile cyberattacks against critical infrastructure targets. They understand that the risk to OT is higher and that skimping on OT security would be a bad move.

Check out these Tenable blogs to learn more about OT security:

• “Translating OT Security Recommendations into U.S. Policy Outcomes”
• “Three U.S. Policy Recommendations to Strengthen OT Cybersecurity”
• “Securing IT-OT Environments: Why IT Security Professionals Struggle”
• “Log4Shell: 5 Steps The OT Community Should Take Right Now”

3 – A SaaS vendor will get hacked

As adoption of software-as-a-service (SaaS) applications continues to grow, it offers an increasingly attractive target for attackers, given the shared responsibility model and limited monitoring capabilities. In 2023, this will lead to a significant, headline-grabbing breach of a SaaS provider, and the incident will put SaaS security and software supply chain risk in the spotlight.

This prediction serves as a reminder of how important it is for organizations to thoroughly assess the cybersecurity preparedness of prospective SaaS vendors. It’s true that doing this due diligence – a process formally known as vendor risk management – won’t guarantee that all the SaaS vendors you choose will never get breached. 

However, it will reduce your risk, because SaaS vendors that follow solid security and compliance practices are less likely to become victims. Organizations also should take precautions and have a business continuity / disaster recovery plan in case one of their SaaS vendors gets breached.

Check out these articles to learn more about managing the risk from SaaS vendors, as well as about proactively planning in case they get hacked or suffer a major outage, potentially impacting your operations and data:

• “Key takeaways from CSA’s SaaS Governance Best Practices guide” (CSO Magazine)
• “SaaS and Third-Party Risk: Is Your Organization Asking the Hard Questions?” (DarkReading)
• “Cloud Security: 3 Things InfoSec Leaders Need to Know About the Shared Responsibility Model” (Tenable)
• “Best practices for negotiating a SaaS SLA” (TechTarget)
• “A 10-point plan to vet SaaS provider security” (CSO Magazine)

4 – Nation-state attackers will target cloud MSPs 

Companies are increasingly using cloud managed service providers (MSPs) to more quickly and conveniently expand their cloud use, a trend malicious nation-state actors will try to capitalize on. Working on behalf of governments, these attackers will try to breach these service providers and their key customers to carry out geopolitical sabotage, spread misinformation, steal intellectual property, compromise critical infrastructure and more.

Here again we have a prediction that speaks to the importance of doing due diligence in assessing the strength of a prospective vendor’s cybersecurity processes and infrastructure – in this case, cloud MSPs specifically, given the increased likelihood that nation-state attackers will go after them more aggressively.

For more information about this topic:

• “US, allies warn of nation-state attacks against MSPs” (TechTarget)
• “Protecting Against Cyber Threats to MSPs and their Customers” (CISA)
• “How To Assess the Cybersecurity Preparedness of MSPs” (Tenable)
• “Risk Considerations for Managed Service Provider Customers” (CISA)
• “US Secret Service reports an increase in hacked MSPs” (ZDNet)

5 – Fools rush in: Many orgs will overlook metaverse security

Businesses are hurrying to set up shop in the metaverse, but as often happens with emerging technology adoption, many organizations will treat cybersecurity as an afterthought, leaving them exposed and vulnerable to a variety of novel and existing cyber risks. 

In fact, we recently got a concrete snapshot of how these two factors – eager metaverse adoption coupled with cybersecurity unpreparedness – are already at play from Tenable’s “Measure Twice, Cut Once: Meta-curious Organizations Relay Cybersecurity Concerns Even as They Plunge Into Virtual Worlds” report. 

Based on a survey of 1,500 IT, cybersecurity and DevOps pros in Australia, the U.K. and U.S., the study found that 81% of organizations have either already launched offerings in the metaverse or plan to do so within the next year. But less than half feel very confident about curbing threats in these virtual worlds.

A good first step to ensure your organization’s metaverse strategy has a solid cybersecurity foundation is to download the 18-page report, view an infographic and read a blog about it. You can also check out these articles about the topic:

• “How to ensure a secure metaverse in your organization” (TechTarget)
• “The metaverse is coming, and the security threats have already arrived” (ZDNet)
• “Top metaverse cybersecurity challenges” (TechTarget)
• “A Survey on Metaverse: Fundamentals, Security, and Privacy” (Xi’an Jiaotong University, University of Windsor and University of Waterloo)
• “As the metaverse evolves, businesses must think differently about virtual security” (ITPro)

6 – Economic turbulence will fuel cryptocurrency scams

And last but not least, Tenable predicts that, as people’s worries about global economic conditions deepen, scammers will double down on get-rich-quick schemes, aggressively peddling fake cryptocurrency investments on social media platforms and online dating services.

So as we march into 2023, please don’t become a victim of a crypto scam. Here’s more information about this topic that can help you reduce your risk:

• “9 common cryptocurrency scams in 2023” (TechTarget)
• “What To Know About Cryptocurrency and Scams” (U.S. Federal Trade Commission)
• “Twitter crypto scams: Bored Ape Yacht Club, Azuki and Other Projects Impersonated to Steal NFTs, Digital Currencies” (Tenable)
• “Bitcoin Scams: How to Spot Them, Report Them, and Avoid Them” (Investopedia)
• “How to Avoid Becoming Another Crypto Fraud Statistic” (Lexology)