As cyber threats continue to dominate headlines, businesses are facing an increasingly complex landscape of risks that require robust cybersecurity measures. Experts stress the importance of preparing for both current challenges and potential future incidents, as the landscape is rapidly evolving.
Ffion Flockhart, the global head of cybersecurity based in London, highlighted the intricate interplay of factors contributing to cyber threats. Speaking to JD Supra, she stated, “It’s a complex web of factors that interact and develop at a rapid pace. We’re at the heart of all of that: our mission is to help clients best manage the cyber risks and threats they face, however challenging the circumstances.”
Ransomware remains a significant issue, with Steven Hadwin outlining the emergence of sophisticated cyber-extortion groups utilising a ransomware-as-a-service model. These groups proliferate by licensing tools for cyber-extortion to affiliates, leading to widespread unauthorised system encryption and large-scale data theft. This growth in ransomware incidents has made these attacks a major point of concern for businesses across various sectors.
The lucrative nature of ransomware operations often forces companies to consider engaging with these attackers. Marcus Harewood explained that organizations may consult with ransomware negotiators to evaluate the credibility of the threat actors, noting, “The organized, financially motivated threat actor groups rely heavily on their name and reputation to extort their victims.” Furthermore, legal considerations surrounding ransom payments can complicate the decision-making process, particularly in sectors such as healthcare where operational continuity is critical.
Cyber espionage, often orchestrated by nation-state actors, poses additional threats to sensitive information. Flockhart warns that these threats often adopt a ‘low-and-slow’ strategy to remain undetected while extracting valuable data from compromised systems.
The publication reported on non-malicious cyber incidents that can result in significant business disruption. An example cited was the global IT outage involving CrowdStrike’s cybersecurity software in July 2024, described by Ross Phillipson as a “black-swan event” that prompted a reevaluation of operational resilience across many organisations.
As these challenges mount, businesses are compelled to invest in cybersecurity to comply with evolving regulations such as the EU Digital Operational Resilience Act (DORA) and the recast EU NIS2 Directive. Boards of directors now face increased pressure to adopt proactive risk management strategies. Anna Rudawski remarked on the shift from a reactive to a proactive approach in cybersecurity governance, underscoring that “boards need to set the tone, so everyone understands the risk to business.”
With the emergence of advanced technologies, machine learning is being increasingly integrated into cybersecurity strategies, aiding in the detection of threats. Marcus pointed out the advantage of utilising AI technologies to sift through alerts and discern credible threats more efficiently than human teams could manage. This technological capability is becoming essential as businesses face a growing number of cyber-attacks and alerts.
Preparations for cyber incidents are crucial for efficient response mechanisms. Steve emphasised the importance of having a mature incident readiness programme that clearly defines roles and responsibilities, which can mitigate confusion during a crisis. Training and simulations are employed to enhance a company’s capabilities to respond effectively, and Marcus noted the value of rehearsing scenarios in advance, stating, “If you prepare for it, train, and train again, your response capability will increase.”
Looking ahead, AI poses both new opportunities and challenges in the cybersecurity realm. Charlie Weston-Simons warned that while AI can be leveraged to bolster security, it also enables threat actors to enhance their methods of attack, making cybersecurity an ever-evolving battleground.
As legislative measures continue to evolve alongside the threat landscape, Anna Gamvros noted an increasing trend towards regulations being framed as matters of national security, which may lead to greater government oversight in private enterprise cybersecurity practices. This multifaceted environment offers both challenges and opportunities for legal professionals operating within the cybersecurity space, signalling a period of significant transformation.
Source: Noah Wire Services