Davos warns of looming cybersecurity catastrophe

Christopher Jablonski

Contributor

Zscaler

Jan 26, 2023

State-sponsored attacks + rogue nations = gloomy expectations

The World Economic Forum's Annual Meeting 2023 in Davos, Switzerland, wrapped up last week. The yearly gathering in the Alps is a snapshot of leading business, political, and technology insights. The global cybersecurity outlook coming out of this year’s conference was bleak.

"There's a gathering cyber storm," said Sadie Creese, an Oxford professor specializing in cybersecurity. "This storm is brewing, and it's tough to anticipate just how bad that will be."

According to the WEF's Global Cybersecurity Outlook 2023 report released at Davos, that perspective is pervasive. Nine out of ten participating business leaders said they believed a far-reaching and catastrophic cyber event is “at least somewhat likely” by 2025 (though what constitutes “far-reaching” and “catastrophic” was not well-defined).

What’s driving this gloomy outlook? Predictably, leaders cited phishing, ransomware, and DDoS attacks as cause for concern, but also that governments could throw their support behind hacking activity as a form of coercion less likely to provoke disproportionate responses from adversaries.

There is a definite fear concerning the rise in capabilities of well-funded, sophisticated, state-sponsored cybercriminal teams. These APT groups act either in support of rogue nations or benefit from their indifference, usually for their financial gain and beyond the reach of the law enforcement in their target nations. At Davos, leaders perceived this as a global issue due to its scope, one that any single technology, solution strategy, or agency can not address.

“It calls for a global response and enhanced and coordinated action,” said Jürgen Stock, secretary general of Interpol. “The key to winning the battle against cybercrime is, of course, to work together to make it a priority across the geopolitical fault lines.”

Issues of transnational crime are inevitably thorny, but a recent cybercrime crackdown involving law enforcement entities from the U.S., Europol, and France offers a template for success. The collective shut down an illicit cryptocurrency exchange called Bitzlato, which was known to funnel cryptocurrency to Russian ransomware groups like Conti and DarkSide from its base in Hong Kong. International cooperation like this will be critical to ensuring Davos attendees’ worst fears don’t come to pass.

Like global leaders, business leaders still fear online instability

Perhaps awareness of global instability’s role in exacerbating cyber risk is catching up to the recognition that “cyber risk is business risk.” By now, saying so in a business context is almost cliche. Still, the WEF report confirms that cyber leaders who spend more time in front of boards and chief executives believe their organizations are better able to withstand threats. Of those security leaders meeting monthly with their boards, 36% described their companies as cyber resilient compared to 8% who still felt unsure despite meeting at that cadence.

"Security executives gain by articulating a story to their board that aligns with corporate and business priorities. Boards should be presented with a cyber posture that resonates with customers’ and authorities’ expectations, and helps address sectorial ecosystem challenge," said Christophe Blassiau, Senior Vice-President, Cybersecurity & Global Chief Information Security Officer, Schneider Electric.

It’s encouraging that business leaders, not only cybersecurity specialists and IT workers, can recognize cybersecurity's importance in meeting business objectives. A global response to cybersecurity threats of the type Stock suggested requires that everyone gets the message, and, judging by Davos, it seems more and more business leaders do. It’s encouraging that business leaders, not only cybersecurity specialists and IT workers, can recognize cybersecurity's importance in meeting business objectives. For instance, bankers, including JP Morgan CEO Jamie Dimon and Bank of America CEO Brian Moynihan, got a customized briefing from FBI Director Christopher Wray.

Macroeconomic headwinds don’t discourage cybercriminals. Recession woes will not cause cybersecurity priority to plummet, but it could pause hiring, cut training, and freeze funding for cyber programs–creating a more fertile environment for attackers, which is the last thing we need as talent is in short supply.

The cybersecurity skills shortage is driving cross-domain collaboration

Of course, it’s one thing to say abstractly, “We should improve cybersecurity in the following ways,” and it’s another thing to get it done. According to the Global Cybersecurity Outlook 2023 report unveiled at Davos, real-world implementation is a significant problem confronting security teams today because:

34% of security professionals cited in the report believe their teams lack significant expertise in important areas
14% said that significant expertise was lacking in critical areas
In public facilities such as energy and utilities, 25% said they doubted their teams were capable of entirely securing the infrastructure — a particularly daunting problem when considered in context with the rise of state-sponsored attackers

And while there is no simple solution to the problem of the cybersecurity skills shortage, it’s still possible to leverage expertise wherever it exists to create more value through widespread collaboration and cross-domain orchestration.

Echoing Stock, Jeremy Jurgens, managing director of the World Economic Forum, suggested a cohesive response spanning organizations and industries as necessary. “All stakeholders from public and private sectors who are responsible for our common digital infrastructure must work together to build security, resilience and trust,” said Jurgens.

A final security theme that came up frequently at Davos was the importance of supplying business context in discussing security topics. While security professionals with years of experience may automatically understand the big-picture ramifications of new technology, malware, attack vectors, network topologies, and other recent developments, not everyone will.

That’s why it’s essential to discuss such matters in a context that reflects not the speaker's understanding but the audience's understanding. “Boards should be presented with a cyber posture that resonates with customers’ and authorities’ expectations and helps address sectorial ecosystem challenges,” Blassiau said.

That advice, if broadly followed, bodes well for the long term in cybersecurity and provides a balance to the dark expectations at Davos this year.

Over time, as the importance of security best practices and solutions resonates more quickly and easily, we can expect faster security rollouts, more direct funding, and universal implementation, translating naturally into a more efficient and less vulnerable business ecosystem for everyone.