Predicting 2024's cybersecurity threats: insights from Barracuda Network's experts

As we navigate ever-evolving and increasingly advanced cyberthreats, tech company Barracuda Network's Security Frontline predicts the course of the cybersecurity landscape in 2024 based on trends witnessed in 2023.

Reflecting on the most surprising events of the previous year, Adam Khan, VP of Global Security Operations at Barracuda, pointed to the MGM attack wherein a group known as Scattered Spider demonstrated the enduring power of social engineering. "This access enabled them to infiltrate MGM's managed IT service," he explained. The sophisticated breach cost MGM Resorts approximately $100 million.

Another surprising observation came from Merium Khalid, Director of SOC Offensive Security. Khalid noted the near parity of ransomware attacks and business email compromises (BEC), highlighting the evolving strategies of cybercriminals. "As organisations bolster their defences against ransomware, attackers are diversifying their tactics, leveraging BEC as an equally lucrative avenue," Khalid shared.

One of the key questions as we look towards 2024 is which security concerns are looming largest in the minds of customers. Sheila Hara, Senior Director, Product Management, Email Protection, shed light on this question, stating that customers are eager to learn how to deploy a defence-in-depth cybersecurity strategy. The evolving AI threat, cloud-based vulnerabilities, and a continued shortage of cybersecurity professionals also rank high on the list of concerns, according to insights shared by Adam Khan and Merium Khalid.

When considering threats that businesses are least prepared to deal with, Stephan Schachinger, Senior Product Manager, IoT, underscored the inability of many organisations to defend against high-quality, targeted attacks previously associated with nation-state and intelligence agency level adversaries. "If you add the use of AI, it's clear that more organisations are going to face sophisticated attacks," Schachinger opined. Additionally, Charles Smith stated that "Companies are poorly prepared to deal with testing their data loss prevention (DLP) and recovery."

Predictions for the biggest focal points of attackers in 2024 include AI-powered cyberattacks reported by Khan and Khalid, the continuation of account takeover attacks highlighted by Peterson Gutierrez, VP, Information Security, and sophisticated mass cyberattacks that exploit vulnerabilities across IT systems and supply chains. Jesus Cordero, Director, Systems Engineering, SASE and Cloud, imagined a future where we "are automatically creating new attack vectors that are crafted based on the quality of results of generative AI itself."

In counteracting AI-enabled cyberattacks, a focus on detection, response and innovation is crucial according to the Security Frontline team. Smith asserted that it's essential for organisations to have adataprotection recovery plan they can rely on. "In addition to the initial prevention, we should focus on the detection of ongoing attacks and the corresponding response," suggested Stephan Schachinger.