Cybersecurity in 2023 and the challenges ahead

Cybersecurity science only really started to emerge in earnest in the early 2010s. The US National Security Agency (NSA) sponsored the first annual Science of Security Community meeting to discuss issues fundamental to the science of cybersecurity in 2012. We are in still the foothills of evidence-based approaches to cyber resilience, while adversarial capability and aggression are increasing rapidly. Several trends outline the scale of the technological challenge nations and societies face.

Vulnerabilities

Software vulnerabilities have surged from tens per month in the 1990s to thousands per month in the 2020s. This growth contributes to global systemic levels of vulnerability. In response to this technical debt, a growing number of organisations are adopting strategies to patch only the most serious vulnerabilities rather than all of them. This approach has yet to provide successful results.

Many vulnerabilities stem from incorrect or poor configurations. One example is memory corruption. This was first discussed in 1972 in the Computer Security Technology Planning Study report of the US Air Force, which read:

The code performing this function does not check the source and destination addresses properly, permitting portions of the monitor to be overlaid by the user. This can be used to inject code into the monitor that will permit the user to seize control of the machine.

Fast forward to 2023 and this class of vulnerability 50 years later enables commercial spyware companies, such as NSO’s Pegasus or Cytrox’s Predator, to compromise the most modern mobile devices.

Socio-technical vulnerabilities are also pervasive in allowing cyber intrusions. This primarily means human error: 74% of the disclosed breaches analysed in 2023 included a human element.

Aggressive adversaries

Over the last 30 years, technology has become increasingly embedded, distributed, and connected. It is being met by more aggressive and greater numbers of adversaries.

Their aggressive nature is evident in the criminal ecosystem as shown by the decreasing time it takes for them to breach an organisation and deploy ransomware payload. In 2023, the median time between initial breach and deployment decreased to a median of just 24 hours compared to 4.5 days in 2022 and 5.5 days in 2021. On October 25, insurer Allianz said that in 80% of large cyberattacks in 2022, personal or sensitive commercial data was stolen. This figure was up from 40% in 2019 and is expected to be even higher in 2023. Ransomware activity alone saw a 50% increase in the first six months of 2023. The stolen data is then used for extortion.

States are also becoming more aggressive. Since 2005, thirty-four countries are suspected of sponsoring cyber operations, mostly espionage. Some make more extreme use of offensive cyber capabilities, with one nation-state assessed to have stolen over $3 billion in crypto assets through cyber operations to fund its nuclear programme.

The response

Regulatory intervention, both primary legislation and guidelines, is increasingly shaping cyber defence trends.

States are growing more concerned about the Internet of Things (IoT), which refers to physical objects connected to the internet. It is projected that by 2030, there will be approximately 50 billion IoT devices in use around the world, with a majority lacking basic security measures. The response to this challenge ranges from legislation to voluntary schemes. For example, Singapore and the EU have implemented labelling or certification schemes that will help consumers identify products with enhanced security. These emerging principles are attempts to address market failures in producing secure embedded internet-connected devices.

Another emerging response is the application of root cause analysis to cyber risk. This approach involves identifying the underlying cause of vulnerabilities and implementing necessary changes to the technology to eliminate them.

Root cause analysis has been applied to the memory corruption mentioned earlier. Academic research has led to technological solutions that have enhanced the underlying hardware computing architectures we rely on, such as CHERI. At the level of computer programming language design, new languages have been developed to prevent the inadvertent introduction of this vulnerability class.

Other trends include data collection and analysis for cyber defence, from insight and quantification to understanding adversary behaviour. The future will rely on high-quality data at scale to detect and respond quickly.

One example of the value of data is seen in active cyber insurers who use ongoing technological assessment and policy underwriting to achieve better outcomes. Cyber insurance company Coalition, for example, achieved a 65% lower claim frequency than the industry average by using measures like continual scanning and prompt issue notification so clients could fix the identified problems. In 2022, Coalition reported that they reduced their clients’ critical vulnerabilities from 17% to 9.7%.

However, there is still room for improvement in technical cyber resilience solutions that address real-world threats and vulnerabilities on a large scale and with quantifiable performance.

The future of cyber technology

Forecasting technologies that will perform in the real world is challenging. However, a few show promise. Emergent technologies, such as artificial intelligence, help improve security outcomes through machine learning. An example of such an emergent solution is artificial intelligence that helps developers write secure code using large language models. There are also technologies that use data to detect security events in real time and respond automatically to suspected breaches.

Beyond these, there are many short-term open questions, including:

• Which technologies help small organisations achieve cyber resilience the most effectively?
• Which technologies are the most effective in helping critical national infrastructure organisations secure their industrial control systems?

Longer term there are still fundamental research problems to which we seek answers, as articulated by the NCSC:

• How can we build systems we can trust?
• How do we make system security assessments more data-driven?
• How do we create and adopt meaningful measures of cyber security?
• How do we make phishing a thing of the past?
• How can we accelerate the adoption of modern security mitigations into operational technology?

These may seem rather foundational and they are. But they also highlight the lack of evidence as to what does work in practice.

Cyber resilience is arguably today for the most part not evidenced with any scientific rigour. It is this that needs addressing at scale to give us the best probability of creating a more secure internet digital society for all.