Prime 10 cyber security tales of 2024
OEIS Private Investigator:
OEIS Private Investigator: Knowledge breaches, recordsdata privacy and security, and the thorny advise of open offer security hold been all sizzling issues this year. In the period in-between, security corporations incessantly stumbled on themselves hitting the headlines, and never incessantly for accurate causes. Here are Computer Weekly’s high 10 cyber security tales of 2024
The year 2024 threw up any other various slit of tales on this planet of cyber security, with significant to hear to, critically in the realm of synthetic intelligence (AI), which persevered to dominate the headlines.
This year, we steer away from AI disaster, uncertainty and doubt to home one of the crucial various gigantic considerations, equivalent to recordsdata privacy and security, colossal scale breaches, and the now not easy considerations surrounding the protection of broadly ragged open offer ingredients.
There changed into also trouble on the mill for cyber security corporations themselves, which most incessantly stumbled on themselves in the headlines, most incessantly after the privileged find admission to afforded by their products and services changed into abused to assault their prospects. Ivanti, Microsoft and Okta all attach our high 10 this year – and we would be remiss now not to level to CrowdStrike.
Here are Computer Weekly’s high 10 cyber security tales of 2024.
1. Leak of 26 billion recordsdata may perchance maybe just prove to be ‘mom of all breaches’
On the pause of January 2024, an data dump comprising 26 billion recordsdata and totalling more than 25GB in dimension changed into stumbled on by researchers. Dubbed doubtlessly the most sharp leak in historical past, and the “mom of all breaches”, the majority of the suggestions related to Chinese social media platforms, however the likes of Adobe, Dropbox, LinkedIn, MyFitnessPal, Telegram and X hold been also included.
Noteworthy of the suggestions looked as if it will perchance maybe hold been compiled from diversified smaller leaks, doubtless a broker who intended to promote on to others for exhaust in identity theft, phishing assaults and fable takeovers.
2. Okta doubles down on cyber in wake of high-profile breaches
In February, identity and find admission to management (IAM) provider Okta introduced plans to double its investment in security over the next 365 days and launched a Trusty Identification Commitment. This came in the wake of the exploitation of its products and services for the length of a series of cyber assaults for the length of 2023, and earlier.
The corporate’s management acknowledged that as a security leader it recognised it wanted to work a lot more troublesome to end ne’er-pause-wells from taking income of the identity recordsdata its prospects entrust to it.
3. Widespread Ivanti vulnerabilities attach waves
One other cyber company changed into in the news on the starting up of 2024, Ivanti, a specialist in asset, identity and provide chain management stumbled on a series of vulnerabilities in its Policy Trusty network find admission to manage (NAC), Ivanti Connect Trusty catch socket layer virtual private network (SSL VPN), and Ivanti Neurons for zero-belief find admission to (ZTA) products brought on advise at organisations worldwide after being exploited by a risk actor.
The three vulnerabilities in query enabled attackers to find admission to privileged recordsdata and carry out elevated find admission to rights on their victims’ programs.
4. Birth offer alert over deliberately placed backdoor
In April, customers of the open offer XZ Utils recordsdata compression library narrowly avoided falling victim to a predominant provide chain assault, after evidence of an interestingly deliberately placed backdoor in the code changed into published. The malicious code, embedded in variations 5.6.0 and 5.6.1 of the library, enabled unauthorised find admission to to affected Linux distributions.
It later emerged that the dodgy code changed into placed there by a malicious actor who deliberately labored exhausting over a prolonged period to kind the belief of the initiatives’ builders. The protection of broadly ragged open offer ingredients changed into to be one amongst the gigantic issues of the year.
5. Microsoft beefs up cyber initiative after exhausting-hitting US portray
In Would perchance maybe moreover just, Microsoft doubled down on its Trusty Future Initiative (SFI), rising the programme – which instruct out to tackle the software program and vulnerability considerations incessantly exploited by risk actors – in the wake of a damning US authorities Cyber Safety Review Board (CSRB) portray.
Redmond acknowledged the rapid evolution of the risk panorama underscored the severity of the threats that face every its hold operations and these of its prospects, and admitted that given its central feature on this planet’s IT ecosystem, it had a “severe responsibility” to earn and withhold belief.
6. CrowdStrike update causes worldwide chaos
Basically the most sharp IT memoir of 2024 – arguably – changed into now not strictly speaking a security incident, however appears right here because it originated at a security company. On 19 July, IT pros far and extensive the UK and past wakened to a fast spreading IT outage downing key programs, originating at cyber firm CrowdStrike after it pushed a unsuitable rapid response update to key risk detection sensors that brought on Windows computers to enter a so-called boot loop.
The wide disruption brought on no major security incidents on the time, however the ramifications proceed to for the time being, with CrowdStrike execs dealing with appropriate repercussions and even being called to fable for the incident in front of politicians. As with the XZ Utils alarm about a months previously, the CrowdStrike incident shows again the importance of paying shut attention to at least one’s code.
7. Campaigners name for evidence to reform UK cyber authorized guidelines
Of us which hold been following the CyberUp campaign for accurate reform over the final few years will know effectively the difficulties the group has had in convincing Britain’s politicians that the time has attain to reform the out of date Computer Misuse Act of 1990, which – attributable to venerable wording in regard to the offence of “unauthorised” find admission to to a pc – puts security consultants in the UK liable to prosecution simply for doing their jobs.
With Keir Starmer entering into 10 Downing Twin carriageway, the campaign group seized the opportunity to birth a recent name for evidence and views for the length of the summer season, announcing that about a Third of UK security corporations had skilled financial losses attributable to the legislation, placing at risk £3bn of the field’s £10.5bn annual contribution to the financial system.
8. NCSC celebrates eight years as Horne blows in
In eighth build on the Computer Weekly list, the National Cyber Security Centre infamous its eighth birthday this year, even supposing its contemporary leader, Richard Horne, who took up the submit in October, is most sharp the organisation’s third legitimate CEO.
Eight years may perchance maybe just now not be an extremely very prolonged time – the Brexit referendum changed into eight years previously – however the cyber security panorama has changed radically in that time, and looking out ahead, because the interdependency between security and intelligence would change into more severe, and the dangers and opportunities of latest technologies and more refined threats develop, the NCSC’s work to recover at addressing the protection of these technologies and the formulation to exhaust them to the UK’s advantage continues.
9. Zero-day exploits more and more sought out by attackers
In November, the NCSC and its US the same, CISA, printed contemporary annual recordsdata revealing that of the 15 most exploited vulnerabilities of 2023, the majority hold been zero-days in contrast with less than half of in 2022. The trend has persevered by means of 2024, and the NCSC warned that defenders must dramatically up their sport when it involves vulnerability management and patching.
Among some of doubtlessly the most heavily exploited CVEs hold been some that are certainly effectively known, including nasty considerations in Development Tool’s MOVEit Transfer, Log4Shell and Citrix, many of them dating abet years.
10. US TikTok ban drawing shut after charm fails
On the pause of 2024 came the news that TikTok is doubtless to be banned in the US in mere weeks after a Washington DC charm court rejected representations from the China-owned social media platform, which claimed its First Amendment rights hold been being violated.
Knowledgeable concerns relating to the firm’s recordsdata security and privacy practices – and the chance that the suggestions TikTok holds may perchance maybe perchance be exploited by the Chinese authorities – lie on the core of the potential ban which would hold world ramifications and affect hundreds and hundreds of customers, influencers and corporations alike.
Considerably satirically, given he once tried to ban it himself, the platform’s most sharp hope for a reprieve may perchance maybe just now lie with president-elect Donald Trump, who will positively be an impactful power in the cyber security world in 2025.
