Organizations large and small have never been more at risk from cyberattacks, to the point that the litany of evolving and escalating cyberthreats have made cybersecurity a key boardroom-level agenda item. As security is the backbone of a successful digital transformation, getting a grip on it becomes vital.

The need to stay ahead of the myriad cyberthreats also highlights the collective role of not only security practitioners in embedding security into the fabric of every organization and, ultimately, in shaping our common digital future.

Since today is Antimalware Day, a day when we recognize the work of security professionals, we’ve rounded up some of the main challenges facing cybersecurity today, as well as those that are brewing for the future.

• Growth of cybercrime

According to a report by Cybersecurity Ventures, global cybercrime costs are foreseen to grow by 15 percent per year from 2021 to 2025 and could reach $10.5 trillion per year. This is more than the profits made by the entire illegal drug trade combined.

The growth can be attributed to significant growth in the activity of cybercriminal groups and government-backed groups. At the same time, in the attack surface is increasing as a consequence of the digital transformation processes spurred by the advance of an increasingly digitized world.

• Shortage of talent

The shortage of skilled people to meet the growing demand for professionals in the industry continues to grow. There is a global cybersecurity workforce gap of 3.4 million and 70% of organizations have unfilled cybersecurity positions, according to the (ISC)² Cybersecurity Workforce Study. Many governments are working to reduce this shortfall, and major companies such as Google, Microsoft or IBM are rolling out various initiatives aimed at training and upskilling people in security.

Meanwhile, the World Economic Forum, in conjunction with several companies, launched an online education platform aimed at individuals and organizations called Cybersecurity Learning Hub. The aim of this project is to train, and improve the skills of, security professionals so that more people can score quality jobs in this vibrant field.

• Inclusion and diversity

In a situation where talent shortages are already a challenge, another challenge facing the industry is to make the workforce more diverse and inclusive. It is necessary to develop initiatives and policies to attract greater participation from underrepresented groups and minorities.

This is not only a matter of values, but also because higher levels of inclusion and diversity are associated with greater innovation, performance and productivity, all being key for any organization’s growth. Needless to say, attracting underrepresented groups to cybersecurity can help lower the lack of skilled security professionals.

• Remote and hybrid working

The digital transformation accelerated by the COVID-19 pandemic has also made it clear to companies that they need to prioritize security. In the case of remote and hybrid work, organizations around the world can no longer rely solely on hardening their inner perimeter using their on-premises technology infrastructure.

Quite the contrary, they must ensure that employees accessing company systems remotely have the right training and technology to avoid risks that cybercriminals are so keen on exploiting.

• The growth of the dark web

The huge growth of criminal activity on the dark web in recent years, especially after the onset of the pandemic, is a major challenge and reinforces the importance of performing threat intelligence activities also in these dark corners of the Internet.

Monitoring the dark web helps cyber-defenders prevent attacks, understand how fraudsters and cybercriminal groups think, what vulnerabilities are being traded, what malicious tools the bad actors use to access organizations’ systems or to defraud people, or what information about an organization is circulating in these underground markets.

• New cybercrime tactics

Trends such as the growth of new forms of social engineering force organizations to keep up with new and evolving attack scenarios and transmit this knowledge to their staff.

One variety of phishing that has seen explosive growth lately is so-called callback phishing, a tactic that combines traditional email-based phishing with voice-based phishing (aka vishing) and is used to gain access to organizations’ systems and deploy malware, such as ransomware, on their networks.

In a recent wave of attacks, a potential victim first received an email to learn, for example, that their subscription to a service is about to renew. In case they want to cancel, they can call the ‘support team’ using the phone number provided in the message. In the call, the victim is then tricked into installing malware on the system that can often spread to other machines.

Meanwhile, the ability to use machine learning (ML) for the creation of synthetic voices has been advancing greatly. The number of attacks in which fraudsters use ML-based tools to mimic in real time the voice of a senior company official and convince an employee to wire money to an account under the attackers’ control is a major threat.

• Security in the crypto ecosystem

Consumers, businesses and governments are all finding new ways to use Bitcoin and other cryptocurrencies – and so are cybercriminals. Crypto scams and cyberattacks against various stakeholders in the crypto ecosystem have shown the vulnerability of the industry to hacks. It is no wonder that security-related challenges in the cryptocurrency world also often make headlines.

To get an idea of the general interest in the world of cryptocurrencies, NFT, play-to-earn games and others, just take a look at platforms such as PhishTank and notice the number of new phishing sites that are spotted daily and are designed to steal people’s credentials for cryptocurrency wallets.

Cryptocurrency exchanges even end up in the crosshairs of APT groups, as evidenced by a recent theft of US$625 million in cryptocurrency from video game Axie Infinity that was attributed to the Lazarus Group.

• Ransomware

While anti-ransomware groups continue to bring pressure to bear on ransomware operators, ransomware is still a major challenge that requires organizations to prioritize preparedness. This includes having the required tools to counter ransomware attacks, organizing comprehensive security awareness training programs and being recovery-ready should a disaster still strike.

From 2020 to 2021 the number of ransomware attacks doubled and ransomware is still a scourge as we almost head into 2023. Indeed, if we look at the evolution of this type of threat over the last five years, it’s clear that there is still a long way to go before the ransomware business stops injecting money into the cybercrime industry.

• The metaverse

Projections about the adoption of the metaverse show that by 2026, 25% of the world’s population will spend at least one hour a day in this virtual world. Therefore, security in the metaverse is a challenge for the future.

These shared virtual worlds for socializing, playing games and where various assets will circulate will undoubtedly give rise to a large number of attacks and scams. In addition, technological innovations are not always developed with security and privacy considerations in mind as the time to market takes precedence instead.

• Better education and awareness

A fundamental challenge that the industry will always face is better education and awareness of existing cybersecurity risks. With the high penetration of the internet and technology globally, the attack surface has expanded considerably in the past decade or two.

However, this change has not been accompanied by actions that seek to raise awareness of the risks and precautionary measures on a large enough scale. Employees are often said to be the weakest link of any organization’s cyber-defenses, but staff are also the first line of defense. The importance of fostering a culture that inspires staff to stay on their toes and with cybersecurity top of mind can’t be overstated.

The above is by no means an exhaustive list of the challenges lying ahead for cybersecurity. However, even this high-level perspective shows that dealing with any of the challenges will require work and effort from many stakeholders – not only from the cybersecurity industry.

Happy Antimalware Day!