The new year is always a time to reflect on what's coming next. As part of the RSA Conference program committee (having worked on the Hackers & Threats track for a number of years), I’m very privileged to see everyone's perspectives. This year I’m happy to report there was a significant growth in the number of submissions suggesting that the collective is starting to look beyond Covid, which definitely hampered the volume and creativity of solutions in recent years.
Starting with the obvious, Ransomware remains a key theme. Still, the number of submissions around the topic has dropped as we have become desensitized to it, even though innovation and the volume of organizations being attacked continue to grow. There were still some interesting submissions around shifts to PaaS, the growth in credential theft techniques, and ransomware being used as a smokescreen for other nefarious goals.
Two other expected topics were the ongoing impact of the Russia/Ukraine war on cyber and supply chain attacks. The massive and still growing scope of supply chain attacks is very much being explored as we saw submissions examining security issues from the hardware level, source code repository sources, API weakness, collaboration tools, marketplaces, and the cloud space.
This year there was definitely a mix of the old and the new. Old in terms of old vulnerabilities and threat techniques being used in new environments. Though the concept isn’t new by any means, the outcomes can be. The new is some of the evolving technology spaces that will likely become the next threat space, such as the metaverse. It feels like we are a long way from the maturity of cloud attacks with still many submissions on every aspect of it, and yet the digital world and threats are already moving forwards again. However, my favorite was an old concept with a different spin: buying cheap decommission hardware and using new techniques to recover the data.
It was interesting to see a growth in focus around psychology, be that how we as humans generate passwords, how our personal data can be used to gain access to the business world, using social media to track troop movements, or on the flip side trying to reverse the model and better understand the adversary to preempt their actions. Additionally, there was talk about how adversaries use psychology against defenders and how we reverse the model.
I always get asked what my favorite submission was, and I have to be honest, there were a few this year. The submission’s diversity had grown geographically and from industry backgrounds and role perspectives. At the same time, the diversity of ideas and new concepts submitted had definitely broadened. I really hope this is a sign that as the world tries to move forwards, we are taking the time to think, be creative, and challenge ourselves and our ideas in cyberspace. If nothing else, I can tell you there will be some great sessions at RSA Conference 2023.
Greg Day
VP & Global Field CISO, Cybereason
