Key webinar takeaways: Cybersecurity trends to look out for

Gerald Kasulis, VP of Business & Channel Operations, North America at Nord Security, recently hosted a webinar featuring Matt Lee, Senior Director of Security and Compliance at Pax8, and Frida Kreitzer, IT Consultant at FridaIT. Together they shared insights on the tech trends that are shaping cybersecurity into the near future.

Topics discussed included the shift towards Zero Trust architecture, ransomware’s surging menace, and the growing momentum in passwordless authentication.

Watch the full recording below, or keep reading this blog for some of the key takeaways we took from the webinar.

Cybersecurity landscape

Matt Lee believes that changing market conditions demand a heightened focus on cybersecurity: “what changed drastically is that we actually started feeling the pains of threat actors' endeavors. But the big shift that I think took place is that people are actually trying to solve the cybersecurity problem at the SMB and mid-market level.”

Frida Kreitzer gave a quick overview of the situation on the ground for IT teams in the current threat landscape, where more than 80% of cyberattacks are made possible by human error. For her, the primary concern is: “How can we be as proactive as possible without “breaking” the company?”

Zero trust, but more security

Never trust, always verify

A Zero Trust architecture assumes that all network traffic is untrustworthy, regardless of origin. It’s become an increasingly significant area of interest for business leaders, as it minimizes risk by dividing your assets into walled-off sections.

“Zero Trust is a world where I know the device's posture is healthy.” Matt suggests not even allowing network connections to be attempted if certain criteria aren’t reached: “If it's got the right [security] tools, it's using a layer for access, and it's coming from the right IP address, then I’ll let someone try a password. Why would I even [allow an attempt] if they're not meeting those conditions?”

Perimeter model

Matt draws a comparison between fortified castle walls and the perimeter model which has been “the mainstay of network security for decades. In both scenarios, the fortified area has a single gateway for access. But when cannons are rolled up or spies sneak through the gate, the perimeter can no longer adequately protect its inhabitants.

When new means of attack are developed, defenses must adapt. “Business email compromises and social engineering have grown extremely large,” Matt says, referring to the most common methods used by hackers to gain access. “It's a different world now, that [requires changing] to a different policing model.”

Verify first, then trust

Matt sees Zero Trust as a shift from the attitude of trust first, then verify.

IoT security risks

Security leaders should consider more than just end users when addressing security concerns, Frida observes. With every additional device on your network, your potential attack surface expands. Internet of Things (IoT) devices can be particularly risky:

Ransomware: Not going anywhere

State of ransomware

Ransomware attacks have been surging in recent years. Matt observes that ransomware groups have become so efficient as to resemble legitimate businesses:

Matt explains that ransomware has become a fully-fledged economy unto itself, with various personas, services, and markets operating within. “I could be a bloke that just breaks into companies – that’s an initial access broker. You've heard of SaaS or software as a service. Well, now there's RaaS – ransomware as a service. I can go to a marketplace and not only find a victim. The marketplace has all the infrastructure, all the capabilities to fully enact a ransomware scheme.” The problem has escalated to the point that law enforcement agencies worldwide and the recent US National Cybersecurity Strategy prioritize the dismantling of ransomware gangs.

Should you pay?

Gerald poses a controversial question on the topic – should you pay the ransom?

For Matt, “It depends. For me, it's typically a balance of the greater good. And I think that that's where I would try to make that decision of what's in the best interests of everyone involved: the company, the customers, the patients. So it'll come down to the sensitivity of the data, the impact, the gravitas of it. All of those things come into the conversation. Each one is a business by business decision.”

Frida suggests that pay or not, companies won’t be guaranteed safety from other attacks in the future. “They will get blackmailed again and again… Now you’re a target. We know that you're vulnerable.” Frida says baking security into your software in early development should be a priority, but the real challenge is staying proactive on an ongoing basis.

Avoiding complacency is a big point for Matt as well: “Just like any business risk, you're going to have to deal with it on a continuous basis. This is a continuous improvement model.”

Security leaders should be particularly vigilant when dealing with external contractors or consultants. Frida outlines the risks: “Someone who doesn't know policy, someone who doesn't have a company computer, someone who doesn't use a password manager. Someone who's easily susceptible to social engineering.”

Frida warns smaller companies not to assume they’ll fly under the radar:

Promises of passwordless: What’s the benefit?

The future of authentication – passwordless

The humble password, used since the early days of the internet, represents an increasingly outdated means of authentication, compromised with growing ease by social engineering or brute force attacks. As Matt says, “Passwords can be tricked or coerced from you.” The golden term for forward-looking, security-conscious organizations is “passwordless”.

Frida Kreitzer weighs in: “Most simply, [passwordless] means you're not having to type in a password or use a password manager for authentication. That's very exciting – you're skipping that portion and just going straight to MFA (Multi-factor authentication, where multiple criteria have to be reached in order for the user to be authenticated). It’s a key that’s being sent to a device – usually a phone.”

Passkeys – a simpler and safer sign-in

Passkeys, digital credentials generated by a device, are invisible to the user, and represent a big step forward for the passwordless future. By removing the need for passwords and relying on user devices or biometrics for authentication, passwordless essentially circumvents the risk of password-related attacks.

Built on public-key cryptographic algorithms, passkeys are virtually impossible to phish or hack. Matt explains: “A [passkey] is a cryptographic representation of you that’s very hard to beat – it's really large math.”

Closing comment

Getting your cybersecurity into a resilient posture is no mean feat. Matt points out that helpful frameworks exist that can support getting the ball rolling. “Stop trying to be the smartest guy or gal in the room. CIS (Center for Internet Security) has 153 little “do this” statements… if you do each of those you'll greatly reduce your risk and reduce overspending because you won't duplicate efforts. Be pragmatic.”

Important to remember is not to exaggerate or overstate security concerns when communicating with stakeholders. This can cause diminishing returns, according to Frida:

As technology continues to evolve, so do the threats that emerge alongside it, shaping the cybersecurity landscape and the strategies needed to navigate it. Understanding these ever-changing trends is vital for any business aiming to build robust defense mechanisms. They can embrace security strategies like Zero Trust architectures, prepare for the relentless threat of ransomware, and explore cutting-edge authentication methods, such as passwordless systems. Through these strategic measures, organizations can enhance their digital security, preserving trust and ensuring continuity in an era marked by swift technological changes.