In predicting what will transpire in cybersecurity in 2023, the best method is to look at past experience. As with any security and criminal activity, threat actors tend to build upon what they have done in the past, adding new twists to keep their tactics fresh and effective.

So, taking this into consideration, it is no surprise that Trustwave's security experts see much of the same type of attacks that plagued 2022 continuing. Ransomware shows no signs of abating, attackers will target operational technology, and security teams will be forced to do more with less financial support.

The major differentiator from last year is the Russia-Ukraine War. The war has not only caused unmeasurable levels of human suffering but is the fulcrum on which a large cyberwar is being fought between the two opponents. This war has manifested itself through attacks centered on each nation and in some cases, striking targets in countries supporting their enemy.

So, let's dive into what Trustwave's experts are predicting for 2023 and don’t forget to come back tomorrow for Trustwave 2023 Cybersecurity Predictions: Part 2.

Speaking of ransomware, which is something we often protect our clients against, a key factor is breaking down the common attack paths of ransomware. Once we accomplish this task, the ability to mitigate ransomware is far easier than trying to mitigate ransomware as a whole.

If I look forward to 2023 while wearing my pen-testing hat, which of course, is black, I'm still concerned that the basics are not an organization's primary concern. We know that threat actors are using known CVEs to gain a foothold into organizations, most of these CVEs are from 2020 and 2021 and should in fact already be fully mitigated/patched.

So, why are they not patched? All too often, we see organizations drowning in "spreadsheet hell" around their patching processes and are quite often trying to boil the ocean instead of really focusing on key vulnerabilities for key assets.

But it's not all bad news. Within Trustwave, we're using machine learning and AI to help our clients better understand the risks they are facing and helping with ransomware mitigation, ensuring that the basics are covered and increasing the cyber maturity of our clients, which is important to us. 

Additionally, those organizations that rely on operational technology will have to be on guard as we expect threat actors using malware such as Industroyer2 and Trisis/TRITON to continue their attacks. The most likely reason behind these attacks is that these environments are often running legacy systems, in unpatched environments, and are ripe for well-known exploits while increasingly being connected to the IT network, allowing a bridge to Threat Actors. CISOs who gain responsibility for securing these legacy networks should ensure appropriate boundaries between environments are put in place, using the Purdue model as an example. This type of error will lead threat actors to create additional Metasploit-like toolsets such as PIPEDREAM. The Purdue Model is a structural model for industrial control system security focusing on the segmentation of physical processes, various sensors, supervisory controls, operations, and logistics and while access to the cloud does complicate OT/IoT/IoMT environments, the model is still relevant.

Another issue that will continue into 2023 is the general lack of funding afflicting so many security teams worldwide. An unfortunate outcome here is CISOs may know their organization is vulnerable but will not have the financial resources required to fix the problems. In a way, this is similar to the 'failure to patch' epidemic many suffer from today. CISOs should go on the attack, using limited budgets to proactively uncover weaknesses in their environment through cybersecurity controls such as vulnerability scanning and continuous threat hunting.

On the plus side, we think more companies will take the mature view of "assumption of breach," and although their security teams may already be overworked and overstressed, they will spend more time and money to understand their entire attack surface. This change will improve asset-based risk management based on easy-to-use-and-deploy configuration management databases (CMDBs), providing network and asset controls ensuring “shadow” systems are not stood-up within the environment, unknowingly. 

Managed Detection and Response (MDR) will become more tightly defined in the industry and will continue to be widely adopted across verticals and organizations of all sizes, often displacing or significantly altering the expectations of "traditional" SOC operations and tools, including SIEM. 

Due to economic pressures, many CISOs will be faced with cost-reduction or cost-optimization challenges, forcing them to consolidate products and service vendors while looking for ways to maintain their organization's security. This factor will also increase the "partnership" aspect of these relationships, moving from a detached "vendor management" approach to one with a more shared commitment to achieving outcomes. Hybrid and Co-Managed solution formats will be highly valued as a result.  

The need for and investment in OT security solutions will continue to accelerate, with safety-impacting threats surfacing in multiple geographies. 

The weight of incoming data security regulations will crush some businesses. We will see companies leaving certain lines of business because they cannot afford the cybersecurity compliance burden. 

We are coming to the end of the 'de-centralization' period of cybersecurity in which everyone tries to do everything themselves, and we are shifting into a 're-centralization' phase where a small number of players will take on the heavy burden of protecting the majority of the market. We see this in things like "shared service hubs" in government and are heading towards shared Identity Service Providers in government to mitigate against ID breaches in private sector organizations.