“The pandemic might be receding, but remote working is here to stay,” said Jon Clay, vice president of threat intelligence at Trend Micro. He predicts this will mean a renewed threat actor focus on unpatched VPNs, connected SOHO devices and back-end cloud infrastructure in 2023.
In response to the threats, he posits that organisations will need to focus on helping overworked security teams by consolidating attack surface management and detection and response to a single, more cost-effective platform.
“Organisations in Southeast Asia will stand to greatly benefit by pivoting to a platform-based approach to security in 2023. This is largely underpinned by the need for greater visibility of the attack surface, which in 2022 stands at just 62%—impeding an organisation’s ability to adequately understand, communicate, and manage cyber risks,” said Nilesh Jain, vice president of Southeast Asia & India at Trend Micro.
“A platform-based approach will not only deliver efficiencies and enhanced capabilities for risk management through vendor consolidation, but it will also enable organisations to catch up to advancing threat groups, now and in 2023.”
Nilesh Jain
The report revealed that VPNs represent a particularly attractive target as a single solution could be exploited to target multiple corporate networks. Home routers will also be singled out as they’re often left unpatched and unmanaged by central IT.
Alongside the threat to hybrid workers, the report anticipates several trends for IT security leaders to watch out for in 2023, including:
- A growing supply chain threat from managed service providers (MSPs), which will be selected because they offer access to a large volume of downstream customers, thereby maximising the ROI of ransomware, data theft and other attacks
- “Living off the cloud” techniques may become the norm for groups attacking cloud infrastructure to stay hidden from conventional security tools. An example could be using a victim’s backup solutions to download stolen data into the attacker’s storage destination
- Connected car threats such as targeting of the cloud APIs which sit between in-vehicle embedded-SIMs (eSIMs) and back-end application servers. In a worst-case scenario (i.e., Tesla API) attacks could be used to gain access to vehicles. The connected car industry could also be impacted by malware lurking in open-source repositories
- Ransomware-as-a-service (RaaS) groups may rethink their business as the impact of double extortion fades. Some may focus on the cloud, while others could eschew ransomware altogether and try monetising other forms of extortion like data theft
- Social engineering will be turbo-charged with business email compromise (BEC)-as-a-service offerings and the rise of deepfake-based BEC
Recommendations to mitigate these emerging threats in 2023
- Zero trust strategies built on a “never trust, always verify” mantra, to minimise damage without sacrificing user productivity
- Employee training and awareness raising to turn a weak link in the security chain into an effective line of defence
- Consolidating onto a single security platform for all attack surface monitoring and threat detection and response. This will improve a company’s ability to catch suspicious activity across their networks, reduce the burden on security teams and keep defenders sharp
- Stress testing IT infrastructures to ensure attack readiness in different scenarios, especially ones where a perimeter gateway has already been breached
- A software bill of materials (SBOM) for every application, to accelerate and enhance vulnerability management—by delivering visibility into code developed in-house, bought from commercial sources, and built from third-party sources
