Security, especially in the current digital environment, is ever-changing – primarily because of the rising threats and attacks taking place across the world. According to Flashpoint, there were 4146 reported data breaches globally in 2022. The United States was the most targeted country for data breaches. There was a significant increase in hacktivism resulting from the Russia-Ukraine war. 

So, the question that arises is, ‘will 2023 be any different?’ Cybersecurity leaders and Chief Information Security Officers (CISOs) are arguably the most knowledgeable people to comment on the changing security landscape. So we thought, what better way to predict what to expect in the field of cyber threats and security risk management in 2023 than to ask some experts and CISOs? 

Let’s take a look at the cybersecurity predictions for 2023, according to CISOs.

What are the security predictions for 2023?

Every year, certain cybersecurity trends largely influence the cybersecurity plan an organization tends to take. These can range from technological to people-centric, depending on the overall security landscape. However, it is the responsibility of a CISO to maintain and update the security landscape of the organization – according to these trends.

We were able to pinpoint several areas where CISOs believe enterprises’ main priorities will lie in 2023. The list of security predictions is as follows:

Security prediction no. 1: Greater focus on the basics of cybersecurity

While discussing the security predictions for 2023, Kevin Cross from Dell Technologies emphasized on the fundamentals of cybersecurity. It is commonly known that threat actors use basic vulnerabilities, including weak passwords, using open networks, or sharing unnecessary information, to breach the organization’s networks. Hence, cybersecurity hygiene is critical to the cybersecurity and information security of an organization. 

The shortage of cybersecurity professionals in the industry accentuates the lack of cybersecurity hygiene. Organizations simply do not have enough people to overlook their security systems, resulting in an overall gap in the cybersecurity of the organization.

One way to reduce the threats is to strengthen your basic yet fundamental defenses and train your employees to protect the system against social engineering attacks. Creating a balance between basic learning and technical implementation is integral in 2023, according to CISOs.

Security prediction no. 2: Integrating technological and human aspects in cybersecurity

According to Verizon, 82% of the organizations that reported a security breach in 2022 insinuated that it was caused due to a human element. Considering these statistics, it can be concluded that the people aspect of cybersecurity is considerably overlooked. 

But how? Let’s take the example of a phishing email. As reported by Verizon, 2.9% of the employees still fall for phishing emails, thereby compromising the data of millions of users. This enables cybercriminals to use the lack of employee training as a method to gain entry into the organization’s database. Cyberattacks on Okta, SolarWinds, and Mariott are some examples of using phishing emails as initial vectors.

The human aspect of cybersecurity is a little complicated as it is unpredictable. As the work landscape keeps changing from office to remote and hybrid, the security consciousness of the employee must change too.

Security prediction no. 3: Taking a risk-first approach to security

According to CISOs worldwide, one of the latest security trends organizations need to adopt is taking a proactive approach towards cybersecurity.

The goal of CISOs will be to give the board as well as all business units visibility into their assets that contribute to their attack surface and corresponding threats and vulnerabilities. CISOs will leverage these insights to understand their risk posture better, continuously rank threat likelihood and business effect to decide where to concentrate resources and build and manage controls that are pertinent to their organization.

Building an incident response plan to tackle the consequences of a data breach is integral but not necessarily the need of the hour. Organizations need to build their product and software with the assumption that, sooner or later, they are going to be breached. This not only instills advanced organizational security understanding but keeps organizations up-to-date on their security posture.

What are the best practices for security risk management for CISOs in 2023?

Now that we have discussed the key security predictions for 2023, let’s uncover the best ways to prepare for security risk management in 2023.

The following are some of the steps that security professionals have revealed they are taking to prepare their systems to protect against threats and limit damage in the event of a data breach.

1. Increasing investment in cybersecurity

The Deloitte survey found that 54% of organizations with US$5 billion or more in revenue are spending more than US$250 million annually on cybersecurity while 71% of the organizations with US$500 million to US$5 billion in revenue are spending less than US$250 million annually on security risk management.

Prices of most goods and services are rising, and so is the cost of cybersecurity. CISO and the board of directors are finally considering cybersecurity as an investment rather than as an expense.

It is important to remember that an organization’s security is hacked, it loses money not only on dealing with the attack but also on lost business. The CISO must ensure that the business is up and functioning in the least possible time after a cyberattack. A cybersecurity incident should not stop the organization’s development plans.

That said, are CISOs only thinking of increasing investment in cybersecurity as a by-product of ensuring compliance with frameworks? No, another trigger for increased investment is to create an advanced technological infrastructure to build secure products upfront.

Cyber organizations are focusing on developing products that are more in line with the higher security standards as it doesn’t look like the threat actors are going to slow down in 2023. As per Rick Holland, CISO at Digital Shadows, it is the duty of the CISOs to understand the company’s strategic objectives for next year and look for ways to minimize risk and enable business initiatives.

2. Creating a culture of security

It is no longer an option but a necessity for every organization to develop cybersecurity awareness among its employees to reduce vulnerabilities. By providing security training and conducting phishing tests, the organization can ensure that the employees are aware of the threats lurking on the internet and are well prepared to fight against them. They should be informed about the latest security threats in the industry to know the pitfalls if they come across one.

A security-first work culture ensures that every employee focuses on the security risk management aspect before taking any action. Even while using the company laptop or mobile phone for personal use, the employees should keep in mind the security protocols. Josh Yavor, Tessian rightly said, “Attackers don’t respect work-life boundaries.”

One of the most accepted practices these days for cybersecurity is implementing the zero-trust architecture. A zero-trust architecture takes the principle of least privilege to the next level, allowing granting access to data, networks, applications, and services only to authenticated users. If employees don’t need access to certain information to fulfill their responsibilities, they are denied access – which goes a long way in ensuring no one has unauthorized access to information.

3. Managing third-party risks

When multiple organizations share data, the risk inherited is also being shared. There should be a barrier between the two organizations to filter out any suspicious data/code. It is not always possible to monitor third-party risks at a micro level, but you should consider the threat exposure management before sharing your data/network with third parties.

Gartner predicts that “by 2025, 45% of organizations worldwide will have experienced attacks on their software supply chains, a three-fold increase from 2021.”

The security of these external networks is directly proportional to the security of your organization, meaning that a breach in any of the partners can lead to a breach in your firm.

Organizations can have minimum requirements before they share digital data with other organizations. For example, if the partner organization’s software is not updated, the sharing should be flagged/prohibited. 

Conclusion

CISOs are best placed to understand the state of the markets now and in the future. Therefore, we combined some of the best practices that an organization should follow with the security predictions to stay protected. CISOs analyze the threats and prepare the systems for the upcoming year. A CISO cannot afford to lose the visibility of the organization’s digital systems. 
If you want to know more about cyber compliance for your organization, reach out to us here.

The source for this article is VentureBeat.