2024: A Challenging Year Ahead - Gazing into the Crystal Ball

Looking into the crystal ball

As 2024 begins it is always worth reflecting on what has been, and what is to come. January is named after the roman god Janus after all, the god of transitions and beginnings.

Politics… and hard realities

The world seems a more complex, more polarised and more risky place as we enter 2024. The war in Ukraine rages on and seems to have created a strange hybrid of sophisticated drone, missile, cyber and electronic warfare along with trench warfare sadly more reminiscent of World War 1. The Middle East seems to be on the verge of further escalation as the battles between Israel and Hamas risk spreading across the region. And in the far East tensions rise between North and South Korea, and perhaps China and Taiwan too.

While not directly cyber related, all of this sets a geopolitical context for a rise in infrastructure attacks on both military and civil targets, which itself links to increasing sophistication and adoption of operational technology, and increased exploitation of vulnerabilities in those systems. CISA warned of increasing attacks on industrial control systems by both the Iranian revolutionary guard and by the Russian SVR intelligence service in December, and we expect to see more targeting of critical infrastructure during 2024.

Regulatory concerns over threats to critical infrastructure will grow, as will the range of service coming in scope of regulation. For example, EU member states are required to implement the Network and Information Systems directive 2 (NIS 2) by October this year bringing new sectors such as space, social network services and data centre services in scope.

Supply chains… and complex ecosystems

Third party (and beyond) security and resilience concerns are growing as we move to an increasingly interconnected and inter-dependent world. In this world our supply chains both physical and digital are both more complex, but also more open to concentration risk and single points of failure. While we didn’t see a supply chain attack of the profile of the 2020 SolarWinds attack, it would be wrong to assume that supply chain attacks have gone away. The UK NCSC and Republic of Korea released an advisory in November last year detailing a campaign of supply chain attacks by North Korea, and of course we have seen cyber criminals continue to look for supply chain vulnerabilities including the exploitation of a vulnerability in MOVEit to deploy widespread ransomware in June.

Regulators are looking to extend regulations to cover supply chains whether that is through flow down of contract obligations by regulated entities, or increasingly by bringing critical third parties directly in scope of regulation. In the financial sector, the UK Treasury is consulting on its critical third party regime, EU regulators are doing the same under the Digital Operational Resilience Act (DORA), and Singapore is also looking to extend the scope of its Cybersecurity Act. 2024 will bring another tranche of supply chain regulations, as well as ongoing discussions about how to scenario test critical third parties and how to manage concentration around digital services.

We can also expect to see the EU Cyber Resilience Act entering into force shortly starting the 36 month clock for manufacturers of software and products connected to the Internet to demonstrate compliance with new cyber security standards.

Protecting the community…

Ransomware isn’t going away. But it is interesting that targeting has increasingly shifted to smaller and medium sized enterprises, as larger organisations improve their cyber security protection, detection and response measures. There is still money to be made by ransomware groups using a ransomware as a service model, but it will be interesting to watch how they re-innovate their business models. Some have speculated around more sophisticated exploitation of stolen data, and a wider range of extortion techniques than simple encryption and denial of service.

From a national perspective it is easy to focus purely on protecting larger organisations, but in doing so we ignore the economic impact of widespread compromise of smaller firms, and also ignore the fact that key parts of our infrastructure and supply chain are operated by such firms. It’s always interesting to read the annual EU NIS investments report, and note that the median number of information security professionals in EU critical infrastructure operators is five. In short, often small hard pressed information security teams (or individuals) have key roles in striving to protect against sophisticated threats.

It is no surprise then that we are likely to see further extension of national active cyber defence programmes (such as the UK’s scheme), community defence schemes such as the US’s joint cyber defence collaborative, and the proposed EU cyber solidarity act to provide the legal basis for EU collective cyber defence. The partnership model between government and major tech/service providers will be the key to success of these initiatives. Equally, we can expect to see additional regulation of managed service providers in many countries which many companies depend on for secure service provision. The UK has already signalled it’s intention to do so.