With historic inflation, rising prices, the escalating Ukraine conflict, and massive job losses in banking and tech, policymakers and executives are stretched to deliver a recovery agenda to get the world back to normal.
Most have little bandwidth for yet more problems to solve, like the impending perils faced by cyber threats. Sadie Creese, a Professor of Cyber Security at the University of Oxford, said, “There's a gathering cyber storm and it's really hard to anticipate just how bad that will be."[1]
Speaking at the World Economic Forum in Davos in January, she was joined by other heavy hitters sounding alarm bells like Jürgen Stock, Secretary-General of the International Criminal Police Organization (INTERPOL) who said, “This is a global threat, and it calls for a global response and enhanced and coordinated action.” Their concern cannot be understated. Fortunately, heads are becoming unstuck from the sand pile of cyber threat denial, albeit slowly. We are facing an estimated $10 trillion (eight percent of global GDP) cyber damage headache by the year 2025 if we continue to take a “business as usual” approach to cybersecurity.
The statistics make for troubling reading. A 2021 CyberEdge report stated that 85 percent of the surveyed organizations in the report were affected by a successful cyberattack. Ransomware attacks have increased by 80 percent year-over-year with over 37,700 ransomware attacks happen every hour globally, that is about 578 ransomware attacks each minute. Putting the size of the cyber threat problem into context is a herculean task. With global GDP estimated at $94 trillion, eight percent, or $7.5 trillion, is a hefty sum of money to put at risk to criminals.
Currently, the combined market value of FAANG (Facebook, Amazon, Apple, Netflix, and Google) exceeds $3 trillion. If you compare this to the GDP of a country, Apple’s market cap is 2.1 times higher than Mexico’s GDP, and Amazon's market cap is 4 times the GDP of Austria. Add Microsoft into the mix, and its $1.8 trillion market cap would make it one of the richest countries in the world, with a value larger than the GDPs of Canada, Russia and Spain combined, even then however, the market cap of FAANG and Microsoft combined would only amount to $4.8 trillion. Some of the best criminal minds are poised to control more money than the largest companies and countries in the world, and many criminal syndicates are state-sponsored.
This money will not be invested in new infrastructure, job creation, poverty alleviation, food security, or the environment. The money is lining the pockets of a cohort that are not acting in the best interests of "team humanity" or democracy.
The Cost Of Convenience And Connected Devices - The Internet of Things (IoT) has been an incredible contributor to humanity, but it comes at a cost. According to Statista the global number of connected IoT devices is expected to grow to 30 billion connections by 2025. Everything from car keys to baby monitors, laptops to mobiles are all potential single points of failure as their internet connectivity opens back doors to vulnerable networks. In the past, enterprise and institutional security was ring-fenced, and could be managed within the walls of the organization, but with servers moving to the cloud, remote workers, and a proliferation of IoT devices creating a huge mesh of interconnectivity, borders are no longer identifiable or defensible.
This startling weakness has been swept under the rug or at least underestimated by both Web2 and Web3 enterprises. Until there is a monumental major shift in our understanding and thinking of both cybercrime and cybersecurity, institutions and private citizens will continue to be victims relentless criminal hackers. Monica Oravcova, co-founder and COO of Naoris Protocol says, ”When the World Economic Forum and the head of INTERPOL state that cybersecurity is in a crisis, it’s time that we change our approach and embrace new technologies like decentralized solutions, that remove the single points of failure, from traditional cybersecurity solutions, with the ability to identify and mitigate threats in real time.”
The Centralized Status Quo - Current cybersecurity is centralized, it configures every device to be a single point of risk to the network it’s connected to. Cybersecurity software lives in a black box controlled by the cybersecurity company, it is opaque and centrally owned and governed. Cloud services used by companies, institutions and governments are also centralized, so it’s a challenge to trust the service when we cannot see or audit how it operates and performs. Any device is a point of entry for an attacker and any centralized system is vulnerable.
Globally, we are only now beginning to spotlight the weaknesses that exist in the current cybersecurity arena. Many organizations are realizing that they are working off outdated cybersecurity models and practices that are no longer fit for purpose, with some systems and processes dating back 40 years. Today, a professional hacker can breach a system in less than 12 hours, using software that can be bought on the dark web for a few hundred dollars. Hackers are forming cohesive and organized businesses, with their own marketing departments and administrative systems, for the purpose of selling Ransomware-as-a-Service (RaaS).
Institutions Are Slow to Move and Are Losing The Battle - We are only now beginning to spotlight the weaknesses that exist in the current cybersecurity arena. Many organizations are realizing that they are working off outdated cybersecurity models and practices that are no longer fit for purpose, with some systems and processes dating back 40 years. The cybercrime space is as at least as well funded as the cybercrime prevention space – but the criminals are winning. The fight is not against a band of hooded teenagers grappling with existential malaise, cybercrime is a multi-billion-dollar industry run by some of the many brilliant minds on the planet, and often incentivized by malevolent governments. Despite a global cybersecurity spend of $1.75 trillion in 2022, companies are still losing the battle, not because they are being outsmarted, but because they are fighting a tank battle on horseback. There needs to be stronger intervention and more innovation in the technology used to fight cybercrime.
According to Microsoft, the average cost of a data breach is touching $4.25 million, and username and password attacks amount to 921 attacks every second, a 74 percent increase in 12 months, from July 2021 to June 2022. Their digital defense teams blocked 34.7 billion identity threats and 37 billion email threats in 2022. It’s not difficult to understand why so much money is being thrown at the problem. IBM reports current detection time for a reported breach is 280 days on average, it’s little wonder that chief information and risk officers are being kept awake at night.
No company is immune to attack, in 2017 the Equifax hack compromised private data of 50 percent of the US population, Twitter had 200 million records compromised, the U.K's Royal Mail was shut down due to a Ransomware attack, and 44 universities or colleges and 45 US school districts were hit by ransomware attacks in 2022. The list of companies affected by cyber-attacks in 2022 reads like the Top Companies List, it includes San Francisco 49ers, Cisco, Macmillan Publishers and The Red Cross.
Traditional Web2-based cybersecurity configures devices to operate independently of each other and not in harmony, with each device acting by default as a single point of risk (as it is outside the walled security network of an enterprise and a vulnerability for hackers to attack). This means there is no unifying governance between network devices. In addition, there is no ability to monitor device behavior and trust status, moment to moment. The traditional Web2 "single point of failure" model cannot be trusted.
A New Way To View Cybersecurity - A recent Gartner report identified cybersecurity mesh as a leading trend for 2023, but stopped short of looking at a decentralized mesh that can remove the centralized mesh’s points of failure. While zero trust and cybersecurity mesh strategies offer the flexibility and composability to accommodate moving boundaries and limit attack surfaces, the underlying device architecture is still centralized. Companies like Naoris Protocol are leading the charge with a new approach to technology that transforms centrally managed computer networks with traditionally un-trusted devices and services such as mobiles, servers and laptops. A whole new category of startups across the decentralized cybersecurity landscape have popped up including Anchore, Dig Security, Project Discovery, and Twingate.
David Holtzman, a security advisor and architect of DNS, echoes this new approach, “The rapid ascension of Web 3.0 acknowledges the evolution from centralized to decentralized architecture, including a decentralized cybersecurity mesh. This transition is inevitable for three reasons:
It takes far less resources to attack a network than to defend it, Centralized security systems provide a single point of vulnerability that, like the Equifax hack, can affect huge amounts of people for the price of a single operation, and, A decentralized approach eliminates the requirement for blind faith in a global cybersecurity company as it removes the company itself from being an entry point for hackers, therefore if the company fails the security protocol continues.”
Technological innovation is moving at a pace that few others than innovators and cyber criminals can keep up with. Business and government leaders are slowing understanding that Web3 will not safely scale for society without a dramatic shift in our thinking to decentralized networks, which require decentralized cybersecurity solutions. Even with little bandwidth, leaders will require greater and a more persistent digital education to better secure our future from cybercrime, or worse, a cyber meltdown.
Author: https://www.forbes.com/sites/lawrencewintermeyer/
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@wapacklabs.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www. redskyalliance. org/
- Website: https://www. wapacklabs. com/
- LinkedIn: https://www. linkedin. com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/5504229295967742989
[1] https://www.forbes.com/sites/lawrencewintermeyer/2023/02/02/the-10-trillion-case-for-decentralized-cybersecurity/
Comments