The security landscape in 2024

Source: Jumio. Prigge.

It's unlikely that cybersecurity can ever become obsolete when cybercriminals are so organised. In April 2023, Trend Micro released its Inside the Halls of a Cybercrime Business report, which found that larger cybercrime groups lead lives similar to corporate workers at legitimate software companies, with separate departments for human resources (HR) and information technology (IT), and even “employee-of-the-month” recognition programmes. 

At the same time, businesses may still be easy targets. Veeam's Regional CTO APJ, Anthony Spiteri, who said: "For 2024, the likelihood of larger and more significant attacks is set to increase, coupled with the fact that most businesses are not adequately prepared. 

"In our recent Ransomware Trends Report, we found that a majority of organisations in the Asia Pacific & Japan (APJ) region has a risk management programme that drives their security roadmap or strategy. That said, only 19% believe their programme is working well, with the rest seeking to improve their situation and some do not even have an established programme yet," he said. 

At the consumer level, sentiment is just as gloomy, with 55% of respondents in Ipsos research* expecting their personal data to be leaked on the Internet in 2024. The Singapore respondents were even more pessimistic. Fifty-nine percent of the populace fear personal data leaks.

Source: Ipsos. The majority of respondents expect their personal data to be leaked on the Internet in 2024.

Derek Manky, Global VP Threat Intelligence Fortinet, said that classic threats will not disappear, just evolve and advance as attackers gain access to new resources. "For example, when it comes to advanced persistent cybercrime, we anticipate more activity among a growing number of advanced persistent threat (APT) groups. In addition to the evolution of APT operations, we predict that cybercrime groups, in general, will diversify their targets and playbooks, focusing on more sophisticated and disruptive attacks, and setting their sights on denial of service and extortion," he said.

Trends: Ransomware

"Cybercrime 'turf wars' continue, with multiple attack groups homing in on the same targets and
deploying ransomware variants, often within 24 hours or less. In fact, we’ve observed such a rise in this type of activity that the FBI issued a warning to organisations about it earlier this year."

Liam Dermody, Director of Red Team, Darktrace, said that ransomware crews have been focusing on APAC countries since late 2023, when an increase in ransomware targeting APAC countries was reported by Hong Kong’s Computer Emergency Response Team Coordination Centre (HKCERT).

"This could represent a longer-term pivot to APAC by ransomware operators, as the region has key similarities to Central America which saw an extraordinary spike in ransomware attacks in 2022. APAC contains some of the fastest growing economies in the world but also contains many businesses who are not as prepared as their counterparts in other regions which have historically been the focus of ransomware attacks," he said, in alignment with Veeam's ransomware research.

"As such, much of APAC represents a greenfield investment for ransomware operators. Furthermore, APAC represents less of a risk to ransomware operators when compared to their ‘traditional hunting grounds’ like the US, where cyber criminals are being subjected to increased scrutiny from government, intelligence agencies and law enforcement. 

"This combination of lowered risk and heightened reward could see the ransomware operators continue to focus on APAC well into 2024."

The single biggest change happening right now is the greater involvement of government regarding ransomware, said Tony Jarvis, VP of Enterprise Security, Darktrace.

"The Australian government is now mandating that businesses report ransomware activity so that more can be done – both in terms of understanding the scale of the problem, and also coordinating responses with impacted entities. This is Australia-only at this stage, but I expect other neighbouring countries to follow suit or adopt something similar.

"I think this is interesting because ransomware has really been a problem since early 2016 and is now a global issue. Government is stepping in, meaning public-private cooperation. I expect to see additional government initiatives play out in this space both in Australia and around APAC as neighbouring countries take notice and learn from the efforts of others," he said.

BeyondTrust's take is that business models for ransomware are evolving. "(Over 2023) we have already seen the purpose of an attack evolve from personally-identifiable information (PII) and protected health information (PHI) to spyware, malware, and ransomware. We have even seen where ransomware attacks have leveraged exfiltrated data for extortion.

"In 2024, we can expect to see a further shift in the attack purpose to vulnerability identifiable information and exploit identifiable information, once it becomes coupled with AI. Instead of getting their hands dirty (and risking detection) by injecting malware and holding businesses hostage for ransomware payment, we will see threat actors start leveraging the threat to sell exploitable data, such as enterprise vulnerabilities, exploits, identities, privileges, and hygiene," said Morey J. Haber, Chief Security Officer, Christopher Hills, Chief Security Strategist, and James Maude, Director of Research of BeyondTrust in a blog post.

"This newly-purposed attacker will target data that can lead someone to a compromise or that can breach an organisation. Similar to an auditor reviewing your security practices and telling you what you need to remediate, threat actors will build a list of how you can be attacked and leverage that information as a part of ransom with a persistent presence to prove their intent."

Reuben Koh, Director of Security Technology and Strategy, Akamai, noted that cybercriminals are leveraging AI for ransomware attacks through programs like FraudGPT and WormGPT. He said cybercriminals would:

- Automate the tasks of target prioritisation and circumvention of defences

- Enhance ransomware encryption, making it more resistant against decryption and reverse engineering with optimised encryption algorithms.

- Deploy AI chatbots for ransomware, which would increase the scalability and efficiency of attacks

"For organisations, the call to action is clear: fortify cyber resilience by getting holistic visibility, and embrace Zero Trust access and segmentation through meticulously verifying all application access," Koh suggested.

Source: ExtraHop.
Bowling.

Mark Bowling, Chief Information Security and Risk Officer, ExtraHop, focused on the potential damages due to ransomware. "We are entering the cyber whistleblower era. With more legal responsibility falling on the shoulders of cyber leaders, whistleblowers have 10 times the reason to report unsafe cyber conditions or disreputable behaviour to (government) regulators," he said.

"Resource-constrained organisations cutting corners will find themselves in hot water as their practices come to light. As an additional twist to complications, ransomware actors will also become involved in the 'whistle-blowing' process, as a way to compel publicly-traded victim companies to pay their demanded ransom."

Manky from Fortinet also sees ransomware evolving. "Over the past few years, ransomware attacks worldwide have skyrocketed, making every organisation, regardless of size or industry, a target. Yet, as an increasing number of cybercriminals launch ransomware attacks to attain a lucrative payday, cybercrime groups are quickly exhausting smaller, easier-to-hack targets. Looking ahead, we predict attackers will take a 'go big or go home' approach, with adversaries turning their focus to critical industries—such as healthcare, finance, transportation, and utilities—that if hacked, would have a sizeable adverse impact on society and make for a more substantial payday for the attacker. 

"They’ll also expand their playbooks, making their activities more personal, aggressive, and destructive in nature," he said.

Vulnerabilities: new tech adoption

The uncertainty surrounding gen AI will create new vulnerabilities, said Andrew Hollister, CISO & VP Labs R&D, LogRhythm. "Just as there was initially a lack of understanding regarding the shared responsibility model associated with cloud computing, we find ourselves in a situation where gen AI adoption lacks clarity. Many are uncertain about how to effectively leverage gen AI, where its true value lies, and when and where it should not be employed," he pointed out.

"This predicament is likely to result in a significant risk of confidential information breaches through gen AI platforms. This echoes findings from a recent survey of channel partners by LogRhythm, which found 47% to have grave concerns about AI tools causing data leaks, while 18% are particularly anxious about potential leaks of proprietary business data."

Vulnerabilities: Email and collaboration tools

"In this year’s SOES key findings for APAC, a staggering 72% of respondents expected to be harmed by a collaboration tool-based attack. Additionally, 78% of Singapore CISOs experienced an increase in email-based threats in 2023.

"As more business is conducted online and remotely, there is a larger reliance on collaboration
and email platforms. Unfortunately, this also means that cybercriminals would stand a chance
to exploit the vulnerabilities of these tools to gain access to sensitive data, disrupt operations,
and extort ransoms," said Stanley Hsu, Mimecast Regional VP for Asia.

Source: SailPoint. Boey.

Beyond the tools, the data within them could be a blind spot for cybersecurity, said Sailpoint's Chern-Yue Boey, Senior VP, APAC. "At the same time, as businesses create, share, and store more data than ever before, more blind spots are also surfacing. Specifically, unstructured data – that makes up 80% of businesses’ data – is posing to be a significant data security challenge.

"Examples include documents, emails, as well as text and files exchanged on corporate messaging and collaboration applications. Often scattered across various platforms, devices, and repositories, unstructured data adds an extra layer of complexity in being both difficult to monitor and, thus, secure. This is worrying, since the volume of data doubles every two years.

"To effectively mitigate the risks associated with unstructured data, organisations must evolve their identity security approaches to include managing access to this class of data as well. After all, unstructured data is particularly ubiquitous given its centrality to business operations; organisations then need to broaden the scope of their identity security programmes to plug vulnerabilities.

"Doing so can include utilising automated identity security solutions that can provide a unified view of access and a centralised control point across both applications and unstructured data to extend access policies as necessary. Only through bridging this gap between identity management across data and applications, can businesses truly have the visibility they need to address identity-related threats." 

Vulnerabilities: mobile devices

"Similar to email and collaboration platforms, mobile devices will be a target for increasingly
sophisticated attacks such as ransomware, phishing, spyware, and device hijacking. Hackers will exploit the vulnerabilities of mobile applications, operating systems, and networks to gain access to sensitive data and credentials," Hsu added. 

"To protect against these advanced attacks, victims should lean on AI to help with detection. According to the report, 93% of respondents agreed AI systems that provide real-time, contextual warnings to email and collaboration tool users would be a huge boon to their organisation’s cybersecurity." 

BeyondTrust predicted that 2024 would be the year of USB-C. While convenient for users, a single standard is easier to target, said Haber, Hills and Maude.

"Having one standard USB connector everywhere will ensure compatibility, bring us closer to using the same power connector worldwide, and eliminate tons of e-waste from proprietary connectors. From a threat angle, you can also expect an increase in juice jacking and other attack vectors related to physical connections. With only one connection type for threat actors to target, the bar has been significantly lowered."

*Mimecast's State of Email Security (SOES) report surveyed 1,700 CISOs and IT professionals in 2023. 

*Juice jacking refers to hacking that occurs when a device is charged with a cable, with 'juice' referring to electricity. 

Vulnerabilities: obsolete tech

CrowdStrike identified outdated technology as a vulnerability that will be exploited in 2024. "Based on CrowdStrike’s review of antiquated products that have reached end-of-life (EOL) between September 2022 - September 2023, threat actors are increasingly capitalising on vulnerabilities in gateway appliances, operating systems, and applications," the company said in a list of 2024 predictions. 

"In addition, CrowdStrike identified multiple threat actors deliberately targeting EOL products—particularly Windows— to opportunistically leverage well-known exploits that are several years old and actively developing new exploits for products that cannot be patched to mitigate vulnerabilities."

CrowdStrike pointed out that many of the products, including Windows 8.1, MS SQL Server 2012, and Windows Server 2003 are still in use today despite having debuted over a decade ago. "As threat actors increasingly target these critical gaps, it will be more important than ever that businesses consolidate IT and security operations to seamlessly keep an up-to-date asset inventory, track impending software obsolescence and targeted systems, and update/mitigate/replace technology whenever possible in 2024," the company said.

"Amid this, we are seeing an industry-wide shift, with the increased collaboration between CISOs and CIOs driving the adoption of AI-native platforms that not only prevent breaches but also offer a cost-effective single point of control for CIOs."

BeyondTrust named plain old telephone services (POTS) and voice over IP (VoIP) as vulnerabilities. "We can answer phone calls on our computers, using applications on our smartphones, and we’ve nearly obliterated the need for dedicated VoIP and POTS. In fact, it is only a matter of time before phone numbers become a moot point too and are fully obfuscated by email addresses and aliases," said Haber, Hills, and Maude.

"And finally, with communications no longer relying on a dedicated analogue system, expect vulnerabilities, hacks, and exploits to breach what was once considered a secure medium for communications."

Vulnerabilities: network infrastructure

Source: Vectra AI. Fisher.

“While this year’s headlines appeared to be less sensational than the previous year’s, breaches have been far more impactful with attackers having moved away from traditional endpoint-style attacks to infiltrate network infrastructure. For example, the MOVEit breach is potentially one of the largest data breaches from a single instance of a vulnerability that we’ve seen to date, which affected a lot of ANZ/APJ organisations. We see this breach as laying the path for more critical zero-day mayhem in 2024.

“While organisations have become better at putting traditional security systems in place, attackers are also getting more sophisticated by pivoting towards network infrastructure to gain entry. As we move into 2024, threat actors will see networks as a soft target, and this indicates that they will continue to exploit this as organisations struggle to stop lateral movement. Once attackers gain a foothold, they can move in a way that they can’t be detected and can do very significant damage,” said Chris Fisher, Vectra AI’s Director of Security Engineering APJ. 

Vulnerabilities: APIs

Lebin Cheng, Head of API Security at Imperva, predicted that organisations will come to terms with the fact that they need to take a more proactive approach toward securing their APIs. "The challenge is that many organisations don’t have the right defenses or controls in place. They don’t know where their APIs are deployed or what data they’re accessing. This exposes them to risks in magnitudes that they cannot comprehend or even begin to quantify," he said.

"In 2024, as pressure to mitigate API-related security incidents continues to grow, security leaders will look for and invest in solutions that integrate seamlessly into their existing application security technology stack. This approach will give organisations a more coordinated and unified view of automated threats that target APIs and critical applications – many of which connect to data stores where the businesses’ data is located.

"In the coming years, this will force a new era of convergence in the security industry where API management and security are embedded within application security platforms."

Vulnerabilities: subscriptions

"In 2024, electronic payments will continue to replace cash, but instead of buying and owning things outright, we will increasingly license them via a subscription. If you want the built-in car dashcam to work, if you want to receive the latest version of an application, or if you want delivery services at no additional cost, they will be subscription-based. In fact, more and more of the items we purchased in the past will become available/usable only via a subscription," continued Haber, Hills, and Maude.

"One consideration here is that any gaps in subscription licensing or termination of an agreement can lead to data loss (during the gap) or archival of information that could be subject to a later data breach. Requesting data deletion from the intentional termination of a subscription may be a user’s best recourse to combat the digital information stored during your term."

Vulnerabilities: Blockchain

"Attacks on private blockchains will increase as a result of vulnerabilities in the implementation of a number of private blockchains. Threat actors could use these rights to modify, override, or erase entries and then demand a ransom. Alternatively, they could try to encrypt the entire Blockchain if it's possible to seize control of enough nodes," said Trend Micro in a list of 2024 predictions.

Vulnerabilities: identity

"Generative AI can craft highly convincing phishing messages that mimic the writing style of a trusted contact, making it increasingly difficult to spot these malicious communications. Their top targets? Consumer identities," said James Cook, Director of Digital Security, Asia Pacific & Japan at Entrust.

"Identity is the thread that ties the world together, making it a high-value target for cybercriminals. This will reach a fever pitch in 2024 as the entire nature of identity is being disrupted as a result of AI, making it increasingly difficult to know who to trust and how to identify who (or what) you're interacting with." 

Cook observed that many countries in Asia are pushing for increased privacy and data protection laws, initiating stricter regulations to protect consumer identities. "We predict more organisations will adopt a decentralised approach to identity and turn to increased levels of verification, including knowledge-based, document, biometric and device authentication to further validate users," he said.

"The bottom line: It’s time to give individuals full ownership of their identities. With decentralised identity*, all the information used to build an identity is encrypted and protected with digital keys that can be used to confirm an individual’s identity without exposure. Businesses don’t store those – the individual does."

"Decentralised identity is overdue to go mainstream, and in 2024, we must all work towards a world with more privacy and less fraud. There is no reason why consumers should continue compromising on privacy, trading their identity for access, and taking the security risk that comes with surrendering their personal information in order to get the products, services or information they want," Cook concluded.

The identity landscape will face a seismic upheaval in 2024, said Robert Prigge, CEO, Jumio. "The impending recession, budget cuts, business closures, increasing M&A activity and more caused sweeping changes to the identity space in 2023 that are still cutting in as we near the holiday season.

"In 2024, we can expect to see a flight to stability and consolidation in this market as vendors are bought out, forced to go out of business and continue to streamline operations. As a result, identity verification companies will be forced to innovate or risk losing their business," he said.

*According to Entrust, the core elements of a decentralised identity framework include an identity wallet, Blockchain ledger, decentralised identifier and zero-knowledge proofs. A zero-knowledge proof is one which doesn't share any information other than providing assurance that a statement is true. 

Vulnerabilities: digitally-native mega projects

"Singapore's Changi Airport Terminal 5 and Tuas Port, along with Indonesia's ambitious Nusantara capital project, are at the forefront of major infrastructure developments poised to propel economic growth in the region. However, as these projects are designed to be digitally native, they introduce numerous vulnerabilities that malicious actors could exploit. This situation escalates the demand for cybersecurity professionals specialising in critical infrastructure. These experts are essential for devising and implementing solutions to safeguard against the unique threats these advanced systems face," said Joanne Wong, VP, International Markets, LogRhythm.

Future vulnerabilities

Source: Keeper
Security. Dr
Everspaugh.

A post-quantum apocalypse could occur when quantum computing goes mainstream, unless everyone is prepared to prevent it from happening, said Dr Adam Everyspaugh, a Cryptography Expert with Keeper Security.

"Quantum computing algorithms are known to break public key cryptography, including RSA and elliptic curve cryptography, by efficiently solving the underlying hardness problems on which these cryptosystems rely. To address this risk today, the industry must begin reviewing research and guidance from NIST, in order to incorporate quantum-resistant cryptography to ensure long-term security.

"Cybersecurity involves not only protecting data now, but also ensuring security into the future. Organisations will need to assess their cybersecurity risks and begin adopting quantum-resistant cryptography where appropriate. This includes understanding which data and systems are most vulnerable and where changes to protection must be prioritised," he said.

"The critical next steps for the cybersecurity industry will be to monitor NIST’s progress and watch for the finalised versions of their encryption standards, as well as production software library support. Then, the industry must integrate these new cryptographic standards. This process may take a year or more, so attention and investment must happen now to evade store-and-break-later attacks. 

"A multi-agency cooperative effort by organisations and the cybersecurity community is crucial to ensure the industry is prepared as soon as possible. All organisations and agencies will need to collaborate with CISA, NIST and NSA on tracking the migration to quantum-resistant cryptography and the overall state of quantum readiness."

Attacks: nation-state actors 

Bowling added that attacks by nation-state threat actors on the cyber supply chain will increase, targeting national supply chains which support governments such as those from KSA, Japan and Taiwan, as well as Australia, and New Zealand.

"They will use sophisticated social engineering and zero day exploits to gain access to administrative and design engineer credentials for creators of support software critical to the government and defence supply chains for those nations. Once inside critical government and defence systems, the attacking nation-states will use advanced persistence strategies to maintain access. This access will be used only for strategic purposes, and may only be exploited in the event of hostilities," he said.

"Attacks by hostile nation-state actors on critical infrastructures will increase...Generative AI will be used to develop advanced attacks in less common industrial protocols and industrial control systems that are used in support of those critical infrastructures."

Attacks: multifactor authentication (MFA)

Dermody also touched on an expected rise in MFA bypass attacks. "The increase of MFA bypassing over the next 12 months by all levels of attackers will test the security industry’s resolve," he said.

"MFA has been wildly successful in preventing brute force attacks and reusing stolen passwords. MFA’s effectiveness has seen it become a prerequisite in many cybersecurity frameworks and a default setting of many providers, like GitHub.

"Unfortunately, as MFA is now in wide use, attackers have adapted to this hurdle and now have a number of ways to bypass it. These methods range from the simple – sending countless MFA push notifications until a fed-up victim clicks accept – to the more involved – using detailed OSINT investigations on a target to enable a SIM swap, allowing the attacker to impersonate the victim’s phone."

Dermody sees MFA bypasses in high-profile attacks continuing into 2024. "We need to move past viewing MFA as a credential protection panacea and be more attuned to unusual activity during and after authentication has occurred. This requires having a deep and nuanced understanding of what is ‘normal’ for any given identity – location, timing and resources being accessed – which can be difficult to do with our dispersed and dynamic workforces without using AI or machine learning (ML) to learn patterns of life," he stressed.

Cyberdefence 

Businesses have to keep on their toes on cyberdefence, cautioned Kevin Kirkwood, Deputy CISO, LogRhythm. "Static security investments will leave organisations vulnerable to evolving threats. A concerning trend will persist in the cybersecurity landscape: organisations repeatedly investing in security measures under the assumption that their security posture is sufficiently fortified. However, a critical perspective often overlooked is that hackers share this same mindset, recognising when organisations become complacent in their investments," he said.

"The reality is that security is an ever-evolving landscape, and if a security program is not continually adapting and enhancing its defences, it remains vulnerable to emerging threats. (2024) will underscore the importance of not just initial investments but a sustained commitment to security to effectively thwart evolving cyberthreats."

Industry observers touching on cyberdefences included:

Defences: firewalls

Source: HPE Aruba
Networking. Hughes.

The rise of the hybrid workforce and the extensive deployment of Internet of Things (IoT) devices have irreversibly eroded the network perimeter, and the standalone firewall is dying with it, said David Hughes, Chief Product and Technology Officer, HPE Aruba Networking. 

"No longer can a good 'inside' be protected from a bad 'outside' by a ring of firewalls. Trying to plug the gaps by deploying even more firewalls inside an organisation only adds complexity, creates room for errors, and slows down businesses that want to move rapidly.

"Consequently, the next-gen firewall appliance is rapidly becoming the last-gen firewall appliance. On one side, the secure service edge (SSE) is replacing firewalls and proxies with cloud delivered secure web gateway, cloud access security broker and zero trust network access. SSE provides a compelling way of managing security for users accessing applications from anywhere. 

"On the other side, for IoT security, segmentation is needed on-prem, right at the edge of the network, and to achieve this firewall services are being built directly into access points, switches and SD-WAN gateways. Even in the data centre the introduction of top-of-rack switches with L4-7 security functionality can deliver east-west segmentation far more cost-effectively than traditional next-gen firewalls at end-of-aisle. Over the coming couple of years the next-gen firewall market will continue to decline as these new cloud-based and built-in capabilities usher in a simpler way of managing secure connectivity."

*SD-WAN stands for software-defined wide area network. L4-7 are specific layers in the OSI network model. There are seven layers, and each layer represents a different network capability.

Defences: collaboration across entities

While Jarvis spoke of governments deciding to do something about ransomware, more will likely happen across businesses, industries, and governments, others said. 

"I expect we will see greater collaboration among more autocratic nations, enabling them to increase the sophistication and volume of attacks. We will also see the increased targeting of developing nations. These nations will accept the trade-off of cost-effective, advanced technology for communications like 5G and ports infrastructure with the high risk of future control of those systems by autocracies that strive to strictly control their citizens," said Dr Purser.

"But, while the threat actors are becoming more organised, sophisticated, and better funded, we are also seeing the good actors improving their skills when it comes to cyber resiliency, covering defense, response, and recovery.

"In the future, there will be increased collaboration between countries but also between businesses and governments, enabling a much more robust defense against cyber threats. This will require organisations to be more open and communicative – whether they operate in the public or private domain – to improve cybersecurity."

Dr Purser further observed that there is growing evidence of government and private industry collaborating to tackle cybersecurity threats. "A more joined up approach, with fast access to threat information and analysis, puts everyone in a much better position to respond quickly in a cybersecurity crisis and take remedial action to suppress or address the threat," she said.

"Individual relationships between government offices and business cybersecurity leaders are critical to this process of collaboration. There needs to be a high degree of trust between the parties to overcome reticence about exchanging what can be highly sensitive information about attacks. This knowledge-sharing will have a huge impact on being able to better prevent attacks in the future and ensuring cyber resiliency."

Defences: passkeys

The FIDO Alliance predicted that many organisations will embrace the security and ease-of-use of passkeys as a replacement not just for passwords, but for legacy forms of two-factor authentication (2FA). These can be managed by an operating system or independent credential provider, providing a familiar consumer experience, or housed in a FIDO security key for higher-assurance use cases.

Source: FIDO
Alliance.
Shikiar.

“With major brands and platforms like Amazon, Apple, Google, Microsoft and TikTok supporting and even mandating the use of passkeys in some cases, there are already around 8 billion passkey-enabled accounts today," said Andrew Shikiar, Executive Director and CMO, FIDO Alliance.

"2024 will be a key year in shifting from a new technology to mass adoption, ultimately hitting 20 billion passkey-enabled accounts by the end of the year. More businesses will make passkeys their default authentication method, with service providers following suit to benefit from a better user experience and reduced cart abandonment. 

“There are 5.3 billion Internet users worldwide, each with many accounts they use daily, monthly or even yearly, so there is still a long way to go. But a significant and growing number of people will benefit from speedier login and checkout processes as enabled by passkeys, which will raise their expectations across all their online accounts.”

Multifaceted cyber resilience

Source: Veeam.
Spiteri.

"To stay ahead of ever-evolving threats, a comprehensive approach is needed. For businesses, employees still remain their strongest weapon against attacks. Actively engaging employees in maintaining a secure environment is not merely a best practice but essential. 

"Regular training and upskilling programmes can help employees stay current with evolving threats and allows them to recognise phishing emails, flag suspicious links and foster a continuous cycle in education and awareness," noted Anthony Spiteri, Regional CTO APJ, Veeam.

"Complementing this approach with AI has become a powerful tool in the battle against cyberthreats, particularly for ransomware. Beyond its current applications in the data protection market, generative AI can be leveraged for data analysis and ransomware detection, picking up trends or activity that can point to malicious activity that would otherwise go unnoticed."

Spiteri also lauded governments and industry groups for their part in cyberdefence. "Initiatives like the launch of the Singapore Cyber Leadership and Alumni Programme, a structured programme tailored for participants at various stages of their cybersecurity journey, exemplify the government’s commitment to a robust cybersecurity posture," he noted.

While the face of cybersecurity has changed, it is still fundamentally about attack and defence, Manky said. "Attackers will inevitably continue to expand the collection of tactics, techniques, and procedures (TTPs) they use to compromise their targets. Yet defenders can gain an advantage by finding ways to disrupt those activities," he said. 

"While most of the day-to-day work done by cybersecurity defenders is related to blocking indicators of compromise, there's great value in taking a closer look at the TTPs attackers regularly use, which will help narrow the playing field and find potential “choke points on the chess board.”

George Lee, Senior VP, Asia Pacific and Japan, Imperva, said that Asia will continue to lag behind in cybersecurity compared to other regions. “The gap in cybersecurity readiness will persist in Asia in (2024),” Lee said.

“Cybersecurity readiness differs a lot depending on where you are in Asia. Mature economies like Japan and Australia face different challenges than developing economies like Bangladesh and Thailand. While ASEAN countries share a common interest in bolstering cybersecurity and investing substantial resources in the industry, achieving a unified regional standard akin to Europe will take time.”

*Results of a 34-country survey conducted by Ipsos on its Global Advisor online platform and, in India, on its IndiaBus platform, between October 20 and November 3, 2023. For this survey, Ipsos interviewed a total of 25,292 adults aged 18 years and older in India, 18-74 in Canada, Malaysia, New Zealand, South Africa, Turkey, and the US, 20-74 in Thailand, 21-74 in Indonesia and Singapore, and 16-74 in all other countries.