2023 Cybersecurity Predictions

Cybersecurity will face serious problems in 2023 as the economics between attackers and defenders will drastically shift in favor of those who conduct attacks. Welcome to the 2023 cybersecurity predictions. I'm Matthew Rosenquist, CISO and cybersecurity strategist. I've been publishing cybersecurity predictions for over a decade. And here is my take on what we will see unfold in 2023. First off, a primer. Now, cybersecurity is a chaotic and ambiguous industry, and it is really tough to figure out what is going to happen and what isn't going to happen. It all starts with the attackers, and we basically need to figure out what they're going to try and get away with. And that becomes the predictions. Now, there's a lot of predictions every single year, and honestly, most of them are worthless. Either they're so generic, uh, saying, yes, there's going to be more attacks, uh, cybercrime will be bad. We already know that. That isn't actionable. That doesn't help anybody. It's just too obvious. Sometimes we try and get very specific with predictions, but that's very problematic for the reasons we've already discussed. People are not easily predicted in this space. It's very complex. So specific predictions tend to have very low accuracy, and that isn't very helpful either. So what I commit to you is to be pragmatic. I'm not here to self-promote. I'm not here to sell anything. I'm not gonna be talking about products or companies. This is really about having a realistic viewpoint on what's gonna happen in our industry. What sectors are gonna be at risk? What threat agents are going to be the most profound in shifting our world? What are the big challenges that security organizations are gonna have to deal with and they should know about now because knowing about it now will give them an edge, will allow them to prepare for what comes later. There is a tectonic shift under our feet, and it starts with the biggest player that impacts global cybersecurity, and this is governments, nation-states, governments, whatever you want to call them. Their cyber offensive capabilities are truly the most powerful. They bring in the biggest investments, whether it be doing their own research and development, whether it's fielding or hiring outsourcing attackers. Governments can be the biggest players. They can also create safe havens for the operators who support their goals. This protects the attackers from being interfered or arrested by other governments. And we also see them have the capability to build long-term talent channels. This means basically hire people as career. Sometimes you put them in your intelligence, sometimes you put them in your military, but this is a long-term long-term capability where you're continually growing and expanding what you can do and making it more affordable at the same time. These impacts— offensive operations by governments actually have impacts not only to the other governments and countries they may target, but to everybody. There's this waterfall effect, and we're going to talk about that a little later, but it doesn't matter if you're not part of a government agency or you're not part of critical infrastructure. It impacts everybody. What big governments do and the amount of money that they can throw into this impacts us all. And that's what we need to consider as we talk about what's going to happen in 2023. The biggest change is that governments are starting to get aggressive. And their willingness to use cybersecurity to advance their political agendas around the world, that's opening up. The resistance that they've had over the past few years in doing that, that's starting to disintegrate, and we will see it more in the first half of 2023, and it will downward spiral because as soon as some of the big countries start doing it, Everybody basically has to join in this force projection that you can do, and you need to understand that it is an equalizer. Every country in the world can invest in offensive cybersecurity. It doesn't require you to even have a border with the country you don't like. You can attack from anywhere. And it doesn't cost all that much. You don't have to buy aircraft or submarines or massive amounts of ammunition. You don't have to put together infrastructure and things that military or intelligence organizations typically require at a very high expensive level. Don't need any of that. In fact, you could even outsource your program. And we're seeing smaller countries do exactly that. So it allows whether you're small or medium-sized country, whether you're isolated or not, for you to reach out to any other country around the world and potentially impact them and swing way above your weight class when it comes to what you potentially can do and therefore affect them and the policies that you want to see around the globe. So it makes a lot of sense. But when countries start to do that, the victims start to respond. They have to. And we're seeing this now. We're seeing legislation and proposals where countries not only will invest heavily in cybersecurity defense but they will actually preemptively attack other countries that they see as a threat. They're going to go after the attackers. They're going to go after the attacking, uh, infrastructure that they're using. This is going to be like the Cold War that we've seen, except in the digital world, and it may not be so quiet. Here's the big change with Governments realizing they need to start doing more offensive work, that opens the floodgates. And now that means billions of dollars are going to pour into the offensive world. What does that mean? That means development of new or better tools, systems, entire compute infrastructures and networks, massive amounts of potential servers, either ones that they create or ones that they hijack and are using. And of course, the brainpower behind that, not only to use all those tools, but to continually innovate and develop new ones. When you throw billions of dollars into an industry, things start to happen. And we've seen countries throw millions of dollars into offensive cyber cybersecurity, and it's made a big difference. Uplevel that to billions across countries all over the globe, you've got a tremendous amount of money that's going in to develop all those tools and systems and best practices to identify vulnerabilities, to develop exploits, to train people and get them upleveled to become better experts and more specialized to discover new ways of doing Well, bad things. This also means, because wherever there's money, there are mercenaries. We're gonna see more outsourcing to cyber mercenaries. In fact, we're gonna see dedicated cyber mercenary teams emerge. You've seen private armies in the news lately, like in Ukraine and Syria. We're gonna see something similar emerge for cyber mercenaries. And they're going to be proud of what they do. They're going to have a brand. They're going to recruit. It's going to be a different world, familiar in one sense, but new in the digital landscape. And this all means these countries, they're investing not for a one-time weapon, but to build sustainable offensive capabilities as part of their toolset. For global politics, for internal control of population, for the ability to drive misinformation and disinformation campaigns. But this is gonna be much different because we're going to see a tremendous slide from many different countries that are now investing in this. And the arms race is going to come to fruition 2023. We're gonna see that first step, uh, where a huge amount of money starts flowing in, and it's not going to stop. And when governments can start building this toolkit, everyone is going to want to use it. Defense agencies, policy groups, regulators, the intelligence groups— they're all going to want to be able to use this tool set. Offensive tools. And the private side, again, you have all this money, you've got security researchers out there, and they're very interested in being able to discover new vulnerabilities. Zero-day markets, we will see a skyrocket in that, and we're already seeing some of that. There are vulnerabilities that are being requested out there in Apple phones or in Microsoft Windows or in secure communication applications and tools schools or to get into particular agencies or companies. And there are buyers out there willing to spend millions of dollars. This only gets worse. Vulnerability researchers really have to decide, are they going to do the right thing and get paid by that company's bug bounty and report it only to them? Or are they gonna make 10 times or 100 times more selling it probably to a nation-state? Because when you get into the millions or tens of millions of dollars, that's who you're really selling it to. Make no mistake. And governments are going to be willing to pay that. Tens of millions of dollars. For exploitable vulnerabilities in certain systems. This is a game changer and we have to worry about it starting 2023. The next thing we need to think about is that 2023, it's projected that there's gonna be some economic downturn and that puts a lot of pressure on the cybersecurity teams, the teams that have to defend against all these types of attacks. Cybersecurity for the most part is not really considered profit, a profit center. It's an expense. During an economic downturn, companies are forced to squeeze budgets and make cuts, and you tend to allocate to your profit groups and let everything else starve. Cybersecurity teams have to worry about this. At the same time, they have to worry about greater threats, greater risks, more potential vulnerabilities in their environments and in their products. At the end of the day, security is going to have to adapt, and this is not going to be easy. Many will fail. Attackers really like technology because they're often early adopters and benefit from that window of opportunity where they're using it for some purpose this and the good guys, the cybersecurity guys aren't yet. And that gives them an advantage. And one of the big tools that's really coming to fruition, no surprise, artificial intelligence. In 2023, it is going to become the preferred tool by so many different types of attackers. And we've got some examples, ChatGPT, deepfakes. We've seen synthetic images, voice, text, all sorts of things emerge. That it can be used for. These types of tools can develop adaptive exploits and specific attack code. They can create all sorts of interesting images that can be used for extortion or even harm, and certainly for misinformation and disinformation campaigns. We already see a lot of that, but with AI tools, it can get better and you can mass produce it at scale. You can flood people and targets with this type of information. And beyond the scale, it gets even worse. It can get more personalized, more customized. And this is of huge importance, especially for social engineering attacks. And right now, social engineering attacks are the number one way that attackers are succeeding. If you receive a spam email or a, or an email that's asking you to log in or click on this link, or, or Open this file or run this script. Hopefully you're not doing that. But if an AI system can create and craft something specifically for you, knowing your habits, maybe where you were yesterday from your social media, tying in your boss's name, all of that becomes more real to you and there's a greater chance of success. The other thing with AI is it can learn. It sends you one and it fails, it adapts, it adjusts, it tries again and tries again and then again, and it will continue to do that until it succeeds. It is unrelenting when you have automation to be able to do this, and the more information you connect to it, the better chance it has of victimizing people. So we're gonna see a gravitation towards technologies that increase the effectiveness and the efficiency. Again, like artificial intelligence. Also, you know, being able to do things like remote monitoring and control, take a look and exploit sensitive user data, all those kinds of things. AI systems can make happen. AI will make reconnaissance, target selection, ingress, lateral movement, uh, resistance to eviction more effective and scalable in 2023. And this is gonna be some of the big challenges that security organizations are gonna have to deal with. The only easy year for cybersecurity was last year. For some general cybersecurity predictions, we'll get into specific ones in the next slide, but many things can't be quantified. We can talk about them at a high level, and it's important because it's context, but not all of these necessarily can we act on because they're not specific enough, but we're gonna go through it here. First off, we know nation-state attacks, they're gonna go against country to country. And when they do, they're gonna be attacking critical infrastructures and supply chains. And again, in the first part of the year, it's gonna be subtle. They're still gonna try and hide it. They're gonna try and obfuscate it. They're gonna try and minimize it. But over time, it's that slippery slope. As you start getting successes, you want more, you want more. And it's gonna be aggressive throughout 2023 and beyond. It won't stop there. It'll keep getting more aggressive. I don't see a tipping point in the future yet. We will see more attacks which support geopolitical and national objectives. A lot of what we see, you know, ransomware, denial of service, and sometimes they're geared towards the industries or companies or agencies that kind of align with what an adversarial nation might want. We're gonna see much more clarity here. There is going to be much more specificity, and we will see precise attacks that are truly aligned with what the aggressor country wants. It's not going to be vague. It's probably going to be pretty obvious when we start seeing these attacks come into fruition in 2023. And the most impactful types of attacks will be things like ransomware, destructive wipers to bring systems down, command and control capabilities to remotely control and manipulate systems, as well as intelligence and intellectual property theft. These are all big things that, by the way, many nations really want to do and have great benefit for. Critical infrastructure out of all the sectors, and there's a number within there, those critical infrastructure sectors will be the number one target. And they're gonna suffer the most severe attacks because they're being targeted by this trifecta, nation-state operators, those professional cyber mercenaries, and then also big cyber criminal organizations that wanna get into this. And we'll talk about that in kind of that trickle-down effect, which is next. Criminal organizations are great. They're motivated by money, but they also don't want to spend too much money to get it. So they're really not involved in or interested in spending $5 million for an exploit. No, no, no. Why, why spend all that money on research and development when they know governments will do that for them? And all they have to do is wait because as soon as a government maybe pays $10 million for a vulnerability, writes a professional exploit that may have taken thousands of hours across dozens of professionals, and they release that into the wild, all the criminal organizations have to do, all the super smart hackers have to do is grab that, grab it out of the wild, inspect it, tear it apart, figure out the pieces. It isn't that tough. And when you have those novel attack methods, they can take pieces of it and reuse it in their own attacks. And this is where we're gonna see data miners, cyber criminals, and so forth reuse the very expensive, highly developed and vetted technology coming out of governments, out of their offensive teams. It's gonna get reused. And cyber criminals, they're not all that particular. Yeah, they go after critical infrastructure because they know they'll get paid, but they'll also attack grandma if they think grandma is going to pay them money. They really don't care. They're looking for easy targets. So they're more than happy to blanket the world with their malware, their ransomware, their denial of service, uh, exploitations if they're going to receive financial benefit. So it affects us all. This tenuous balance that we've had for several years between what the attackers are doing and what the defenders are doing and how much the defenders can spend and all of that, it's going to get thrown out of whack in 2023. The attackers will be able to incur so much more risk than what the defenders traditionally can defend from. That's a big problem. That will be a conundrum that we will have to deal with. And as AI tools, as we've talked about, as they blossom and the attackers get their benefit for using them in all sorts of new and novel, interesting ways, we then elevate all of those risks, both in scalability as well as the efficiency, the effectiveness of what those attacks can do. So there'll be more cybersecurity challenges and risks, but again, the defenders, they're gonna be under that budget crunch. So they're going to have difficulty in bringing in or upgrading tools, hiring more people, paying that overtime, doing all the things that they need to do to potentially adapt to those risks. That's going to be very tough for them to justify and get the resources that they need. And keep in mind, when nation states, when they are on the offensive, we will see coordinated cyber attacks across multiple theaters and sectors. They're gonna go after the critical infrastructure first with a higher emphasis on specific ones, finance, telecommunication, government agencies, energy. And in the energy sector, it's the supply acquisition, transportation, and distribution of it. They're gonna target healthcare, water, social media, and the entire defense industrial base, which includes defense agencies. They're still going to primarily use social engineering techniques for exploitation, for ingress. Why? Because it works and it's easy. They're not going to give that up. They will start targeting more supply chain attacks as well, because that gives them the greatest breadth of potentially desirable victims, and we're going to see a impact overall through the timing, the attack types, and the target selection. So for the critical infrastructure people out there, if you're in that sector, you work in there, then you're going to have much greater risks to deal with beginning in 2023. They don't go away. It's a new cadence. It's a new pace. And for everyone else, well, we're not off the hook either. Remember that trickle-down effect? This is going to touch us all. We may not be directly attacked by some nation, but their research and development will benefit the cyber criminals, and those cyber criminals are going to be the one that attack us all. Overall, in 2023, security will become more important because we're going to feel more pain from all these improved attacks. Okay, let's talk about specific predictions because these are the ones that hopefully we can do something specific about. First off, We will see in 2023 the emergence of several highly sophisticated attacks. Think of these as attacks that would require millions of dollars to either purchase or develop the vulnerabilities, thousands of hours development time to develop those exploitations, tremendous amount of resource— resources to create the necessary infrastructure to deploy and maintain what they're doing. Big, big sophisticated capabilities, types of attacks. We're going to see probably a handful of those come out from various countries. There'll be other ones that are out there that we probably don't even detect in 2023 and may not pick up in 2024, but we're going to see some of these big attacks happen. And the follow-on impacts from them. From a critical infrastructure perspective, the impacts we're going to see at least 2x, maybe 3x, maybe more from what we saw in 2022 levels. Yes, critical infrastructure was attacked in 2022, not as big of impacts as the attackers would have liked. They're going to get better in 2023. We will see demand will drive costs of exploitable zero-day vulnerabilities modestly on average up 30 to 50%. But the extreme range for some of them, for a handful of them, it will go up from a million dollars to $10 million. And that's a huge jump that attracts a lot of attention., it will gain a lot of success for those nations that are looking to buy exploitable vulnerabilities. We will see dozens of AI-enhanced attack tools, all sorts of different tools that the defenders are gonna have problems with. But these tools will be able to upgrade the attacks in their effectiveness as well as be used to scale out over time And even by the end of the year, we're going to see AI-powered attacks, cyberattacks that learn from its failures and then reapply, reimplement. And we see that continuous improvement cycle by the end of the year. So it won't take an army of attackers to distribute things. AI will help do that automatically. Lastly here, and this is a little scary, we already have loose collections and in some cases some small dedicated teams out there that are cyber mercenaries for hire, or they're collective groups aligned by either the desire for money or some political goal. We will see something entirely different. We will see fully formed cyber army type mercenary groups emerge. With clear leadership, a clear brand. They will start to recruit, have formal recruiting and their own marketing. We will see this and they will service particular countries. There will be some dedicated just to— well, you can name your favorite country out there, Russia, for example. They already have private military for conventional weapons and arms. The Wagner Group, for example. We're gonna see the same thing, the same formality and organization for cybersecurity mercenaries, and they will become a formidable adversary. Conclusions. 2023 will be a watershed year as nations are making the decision to commit to permanent cyber offensive capabilities. Many of them already have defensive capabilities. We're talking offensive capabilities. And given the fact that they are making that decision, money, funding, organization, support, all of that come with it. And that helps all of the attackers. And we will see an accelerated cyber arms race and that'll be very similar to the Cold War that we saw. But there will be attacks, and there will be threats, and there will be feigns, and there will be, you know, false flag operations, all sorts of things again that we've seen in the traditional world, in the intelligence and military. And we will see that emerging in 2023, and that will be the new state. Well, for as long as I, as I can see into the future unless something radical changes. An AI as a truly powerful tool which can be used for incredible mind-boggling good and benefit to society. It's just a tool. It can equally be used for harm and attackers are first movers. They like that advantage. We're going to see them take advantage. We're already seeing that now. Just the very tip of it, but they're gonna get good at that. They're very creative, they're very motivated, they're very talented. Attackers will use AI for their benefit, for all of our detriment. And as part of that, we're going to see much more customized attacks. They're going to go up, they're going to have greater impacts, they're going to be more specific. And successful, especially around social engineering. That'll probably be the first main vector. And with this economic downturn, defenders, we're gonna suffer. The cybersecurity teams are gonna have to face all these new and improved and more capable risks and threats, and yet they're not going to have the assets by default. To be able to go and deal with it. And it may not be until companies start getting impacted by all of this, and it may take a year. It may not be until 2024 your company is impacted because of this, but when that does happen, it's gonna be painful. And the organizations that can adapt now, that can justify it now, that can either keep their and preserve their spending or even increase it in cybersecurity, they're the ones who are gonna have that advantage because they're not going to be impacted as much over time. They're going to be able to get a, potentially get ahead of all these types of attacks. And that's where we're at for 2023. Final thoughts here. Last year's predictions, my predictions from last year are available. I'll put the, a link in the bottom. And that's really important because every listener, you should all be thinking, does Matthew have a good grasp on what's going on? Does he have real insights or is he just full of hot air and likes to talk? Well, the way you find that out for me or for anybody else that does predictions, go check, go see what other people and what I've written back in the beginning parts for all of 2022. Did they come true? Did they not? That helps you understand who is credible in the industry. And be very careful, beware of the huge number of predictions that in most cases they're product marketing. They're trying to sell you using fear to buy their products, to switch over to them, use their service. Don't listen to those. Also avoid the ones that are just too vague. I see them all the time. There'll be more attacks, more risk. Yeah, does that really help you? Does that tell you who's going to be the attacking? Does that tell you what type of methods, what type of tools? Does that tell you what types of targets they're going after? That's what we really need. So The obvious ones, it's not actionable. All right, thank you everyone for watching. Be sure to comment because I absolutely appreciate it and I read all of them and I try and respond, especially if there's questions. Connect with me on LinkedIn if you'd like, and like and subscribe to show your support if you like what I'm doing in these videos. Thank you.