What should CISOs be focused on in 2024 and beyond?
A recent article from Security Boulevard highlighted 10 key trends for CISOs, as highlighted by Nitin Raina, CISO at ThoughtWorks, Mike Wilkes, former CISO at Marvel, and Yogesh Badwe, CSO at Druva.
Here we summarize these trends, and offer CISOs ways that they can position themselves to leverage these trends to drive personal and organizational success.
The 10 Key Trends
Without further ado, here are the 10 key trends predicted for 2024:
- Increasing CISO accountability: The role of Chief Information Security Officers is evolving with greater accountability. They are increasingly held responsible for cybersecurity outcomes, facing more scrutiny from stakeholders and regulatory bodies.
- Resurgence of cyber regulations: There’s a growing trend of new and revised cybersecurity regulations globally. These regulations are shaping how organizations approach and manage cybersecurity.
- Emergence of cyber-kinetic warfare: Cyber threats are no longer confined to the digital realm but are increasingly causing physical, real-world damage, leading to a new form of warfare.
- Third-party risk management: As organizations rely more on third-party vendors, there’s a heightened focus on managing the cybersecurity risks these partnerships entail.
- Ransomware dominance: Ransomware remains a dominant cybersecurity threat, continuing to evolve and challenging organizations to develop effective defense strategies.
- Hypothetical digital crisis scenario: Planning for large-scale digital crises is becoming crucial. This involves preparing for hypothetical scenarios that could significantly disrupt digital infrastructure.
- Cybersecurity staff development: There’s an increased emphasis on the training, development, and retention of cybersecurity professionals to combat the growing sophistication of cyber threats.
- Critical infrastructure security: Protecting critical infrastructure from cyber threats is becoming more important, with a focus on securing vital systems and networks.
- Importance of cybersecurity resilience: Organizations are placing more importance on building resilience to not just prevent cyber attacks but also to recover quickly and effectively from them.
- Role of AI in cybersecurity: Artificial intelligence is playing a growing role in enhancing cybersecurity measures, from detecting threats to automating responses.
Before we dive into real-world examples, it’s important at this point to demonstrate how ITsMine addresses these major issues.
How ITsMine Enables CISOs to Harness These Trends
To take just a few critical examples from this list, it’s eye-opening to see how ITsMine supports CISOs in their challenging role:
Increasing CISO accountability: The liability aspect is effectively managed by implementing a Virtual Vault on each employee’s desktop and throughout the organization.
This approach shares the responsibility with executives and employees, similar to how a hotel offers a safe in each room. The hotel provides the safe for guests to secure items like passports and wallets, but it’s up to the guests to decide whether to use it.
- The CISO will provide a secure location for storing important files.
- The system will develop and provide training for users on how to effectively utilize the Vault.
- The CISO will monitor usage and provide executives and employees with performance reports, identifying users who may require additional training due to insufficient use of the vault.
Ransomware dominance: Double and triple extortion ransomware accounts for 83% of successful attacks, yet many companies focus primarily on backup and Endpoint Detection and Response (EDR) strategies to prevent data encryption. However, the real threat lies in data leakage and theft. ITsMine offers CISOs several key solutions:
- Alerts are generated for any abnormal usage of the company’s data, especially when it occurs outside the company.
- ITsMine provides a detailed list of the specific files that have been stolen.
- For the most critical files stored in the Vault, ITsMine has the capability to remotely delete or “kill” these files, enhancing data security.
Just these examples show the tremendous benefit that ITsMine provides CISOs against the backdrop of these trends.
Key ITsMine features include:
Virtual Vaults: ITsMine offers a solution for maintaining complete control over your sensitive files. It enables the creation of numerous Virtual Vaults within your primary file storage system. This feature is compatible with various platforms such as OneDrive, Google Drive, Dropbox, NetApp, and any file storage on Windows or Linux systems, and can be set up with just a few clicks. Any folder can be quickly converted into a highly secure digital area within your organization, ensuring end-to-end protection for each file, even outside the company’s boundaries.
The following unique and robust measures are included:
File-GPS™: This feature ensures you’re aware of every access or movement of your files. Even when files leave tour company perimeter, they remain protected and under your control, no matter where they go. If a File-GPS™ protected file is accessed outside your organization, it sends an alert back to you. This lets you know the file’s location, who accessed it, when and by whom it was removed from the vault, and what other resources were involved, providing comprehensive data control and visibility.
File-Timebomb™: This tool allows you to set expiration dates for your data with ease, limiting its lifespan outside the “Virtual Vault”. After the set date, files outside the Virtual Vault become locked and unusable, regardless of their location or device. Inside the vault, however, the file remains accessible and intact.
Automated Defense with AI: ITsMine employs artificial intelligence to intelligently position its unique SoftwareMines™ (digital threat sensors) across key file-sharing locations. This proactive approach automatically identifies and counters various threats, including unauthorized data access, ransomware, and both intentional and accidental actions by employees that may compromise security.
Proactive Security Education: Through ITsMine’s Training Campaigns, the SoftwareMines™ play a pivotal role in educating employees about appropriate file handling within the company. These campaigns focus on pinpointing users who may pose higher risks and offer targeted guidance to correct and improve their data handling practices.
Real-world Examples of these Top Trends
These predictions aren’t just theoretical: they are backed up by incidents that have already happened, and that are likely to grow in scope and frequency.
CISO Personal Liability
For those that might not know the story, Joe Sullivan, the former Chief Security Officer of Uber, was involved in a legal case that highlighted the increasing personal liability of CISOs. Sullivan was charged with obstructing a Federal Trade Commission (FTC) investigation into Uber’s data security practices and failing to report a felony related to a 2016 data breach at Uber. This breach occurred while the FTC was already investigating a previous data breach at Uber from 2014. Despite being aware of the new breach, Sullivan chose not to disclose it to the FTC or any other government body.
In response to the 2016 breach, Sullivan arranged to pay the hackers $100,000 in Bitcoin through a bug bounty program to keep the breach under wraps and had them sign a non-disclosure agreement. This action was central to the charges against him. Sullivan’s case was closely watched by the cybersecurity industry and raised concerns about the personal liability of security professionals in handling data breaches and their aftermath.
Ultimately, Sullivan was convicted and sentenced to three years of probation, a $50,000 fine, and 200 hours of community service. The prosecution had sought a 15-month prison sentence. This sentencing was seen as lenient by the judge, who emphasized that future similar cases might result in harsher punishments. The case has had a significant impact on the cybersecurity community, driving changes in policies and practices towards greater transparency and disclosure, even in legally ambiguous situations.
Sullivan’s case has become a cautionary tale for CISOs, emphasizing the importance of transparency, legal compliance, and the potential for personal legal consequences in the handling of cybersecurity incidents
Real-World Impact of Cyber Breaches
There have been a number of instances where cyber attacks have been linked to severe real-world consequences.
There are a couple of cases where cyber attacks have been linked to the loss of life, highlighting the real-world consequences of digital threats.
One notable case involved a ransomware attack on a German hospital, Düsseldorf University Hospital. In this incident, a female patient scheduled for critical care could not be treated at the hospital due to the disruption caused by the cyberattack. As a result, she had to be transferred to another hospital 19 miles away. Unfortunately, the delay in treatment was linked to her death. This case is significant as it was the first time a fatality was directly associated with a cyberattack.
Another case is linked to a ransomware attack on Springhill Medical Center in the United States. A lawsuit alleges that the hospital’s disabled IT systems, due to the cyberattack, prevented the availability of critical data regarding a baby’s elevated heart rate. This data, which was essential for timely medical intervention, could not be accessed, leading to delays and reduced monitoring capabilities. The suit claims that these delays and reduced monitoring contributed to the infant’s death.
What this means
These examples demonstrate the pivotal role that CISOs play, the responsibility they have, as well as the opportunity to strengthen defenses and enable good people to continue doing their jobs in the face of relentless attacks.
Tools to Tackle these Trends
While there are numerous – almost too many – tools out there to tackle cyber threats, we believe that ITsMine is absolutely critical in light of these trends. It provides crucial value in almost every one of these predictions, making it an invaluable addition to any CISO’s arsenal.
With the powerful capabilities from ITsMine at your disposal, you can ensure you’re on top of every single one of the 10 key trends: from third-party risk management to ransomware protection, staff development, cyber resilience, and everything in between.
To learn more about ITsMine’s Agentless solution, get in touch with a product expert today.