Top CISO Challenges 2024 – Infosecurity Magazine

The cybersecurity community has never faced more challenges than in the last year. The industry’s leading cyber defenders, Chief Information Officers (CIOs), Chief Information Security Officers (CISOs) and Heads of Cyber ​​Security, have had to deal with an evolving cyber threat landscape, with ransomware actors showing impressive resilience, in despite many law enforcement strikes in 2024. -sponsored threats have also become more aggressive than ever.

In addition to these threats, the rise of fraud and scams has added another level of complexity. Cybercriminals have become increasingly sophisticated, using advanced social engineering tactics to defraud individuals and organizations. Phishing attacks, business email compromise (BEC) and identity theft have increased, exploiting vulnerabilities in human behavior and organizational processes.

Furthermore, the rapid evolution of technology has created a dynamic battlefield where defenders and attackers are constantly adapting. Artificial intelligence (AI) and machine learning (ML) are being leveraged by both sides. While defenders use these technologies to improve threat detection and response capabilities, attackers exploit them to automate attacks and evade traditional security measures. This ongoing game of cat and mouse requires cybersecurity professionals to stay ahead of the curve by continually updating their strategies and tools to protect their assets.

Throughout 2024, Infosecurity spoke with numerous cybersecurity leaders to hear their perspectives on what they believe to be the most significant concerns and challenges they believe the cybersecurity industry is facing today.

Retaining cybersecurity talent

Megan Poortman, Head of Cyber ​​Security, London Gatwick Airport

“(It’s) a big challenge retaining talent in the cyber industry. There are many worrying statistics about how many people are leaving their cyber careers due to stress and burnout, and we need to figure out how to make cyber less scary and more sustainable as a long-term career.

We need more career mapping to help people find their niche and show them it’s a great career with longevity. Cybersecurity leaders need to help they realize it.

Retention will continue to be a challenge until we make cybersecurity an attractive career path for a diverse range of individuals. Diversity of thought will only strengthen your cyber function.”

Risk management concerns

Luke Kiely, Group CISO, GetBusy

“Future compliance requirements, supply chain risk – everything from the cleaning solution coming into your organizations at your service Amazon Web (AWS) managed – and general risk management are my most important concerns at this time.”

Stay aware of payment threats

Gina Gobeyn, Executive Director, PCI Security Standards Council (PCI SSC)

“Our biggest concern is the ever-present criminal element that continues to work to create new ways to attack payments. The number of cyber criminals is on the rise, while the number of cyber professionals continues to struggle to keep up.

Anyone involved in payments must ensure they remain vigilant and make cybersecurity a top priority. We just can’t let our guard down. We need to stay nimble and adapt to changes in payments and payment technology.”

Discovering the unknown unknowns

Jason Manar, CISO, Kaseya

“My biggest concerns have always been “unknown unknowns”. Let’s say the company doesn’t have a process to find out or know if a piece of hardware or software has been added to their environment. That would be an unknown unknown.

We are always looking to implement processes that will uncover any unknown unknowns as quickly as possible. The unknown unknowns can also be geopolitical events and various other global crises that occur.

Try to stay ahead of that and be predictive of what those events might be so you can prepare a little.

Almost everyone I talk to will tell you how hard it is to retain cybersecurity talent, they’ll tell you how hard it is to recruit and then develop that talent.

The unknown unknowns and getting people in the right positions are the two things I think about constantly.”

Don’t trust, check

Jerry Geisler, SVP and Global CISO, Walmart

“If Walmart ever paints something I frequently say on the wall, it will simply be this question: how do we know that the things we believe to be true remain true? We work to secure an environment and data sets and have controls in place to do so. But how do we know these controls are still serving us effectively? I constantly challenge my team on this.

Along with that would be what we don’t think about, that maybe we should be? What we do not anticipateor are you not thinking in the right context or perspective? For us, it’s so critical to remain students of our business and stay tightly coupled with our business—understanding the business strategy, where the business is going, and what technology is needed to unlock those business strategies. Cybersecurity plays a role in this empowerment in protecting the environment.”

Breaking the insider risk taboo

Jason Clinton, CISO, Anthropic

“Insider risk is probably at the forefront of my concerns. It’s basically impossible to solve and it’s a difficult topic to talk about at the same time. Even if you had a solution, even talking about insider risk is very difficult, people automatically feel a little threatened by the subject.”

Keeping the Trust

Bob Leek, Chief Information Officer, Clark County, Nevada

“Cybersecurity challenges are multifactorial. Continuity of our operations is extremely important. With the digitization of local government, which we are about to do, the ability of our operations to withstand a disruption of any kind is compromised. It is to the point where some teams have said that it will be very difficult for them to go through any kind of manual procedure.

With this wholesale shift to digital solutionsthe ability to switch to something that isn’t digital is gone.

Second, I think the impact of a cybersecurity incident has changed. It’s almost as if cybersecurity issues are now background noise. There is such a generally a low level of trust in government that a cybersecurity-based incident is almost expected, it’s no surprise.

Yes, Facebook for example has a lot of your data, but on the government side, we know a lot about you and the people we tend to serve from vulnerable populations.

If you think about housing assistance programs, food assistance programs, people coming in contact with us for domestic violence services, there’s a lot of very sensitive data involved in that.

The occurrence of a cyber security incident is not just about systems going down, it is about the impact on the level of trust, which is already low.”

Integrating Cyber ​​into operational procedures

Friedemann Kurz, Head of IT, Porsche Motorsport

“Keeping cyber security manageable. That’s what worries me.

When we’re in operations, we work with a small team and under high pressure with other things going on in parallel, and we generally don’t have a dedicated cybersecurity person. We have to be able to handle all of that in a racetrack situation at the weekend.

This includes threats that may arise, but also monitoring the entire solution.”

Preparing for future cyber regulations

Tom-Martijn Roelofs, Global Head of Security Strategy and Data, CISO department, ING Bank

“Its getting implementations on pace for the new regulations. That’s definitely a challenge.

At the threat level, we were still rearranging and adjusting to the geopolitical threats that arose with the invasion of Ukraine, but even earlier. It’s definitely a job to do.”

Supply chain security in complex OT environments

Anjos Nijk, Director General, European Cyber ​​Security Network

“Unique to the electricity sector is the mix of innovative technologies and legacy systems, which creates a vast attack surface with many complex interdependencies.

This emphasizes the importance of approach supply chain securitybecause vulnerabilities within it could lead to large-scale incidents in interconnected infrastructures. These interdependencies often extend beyond the control of individual entities, making collaboration essential.

There are emerging threats from distributed energy resources and consumer equipment that are not under the control of transmission system operators and distribution system operators and remain unregulated. These external elements introduce additional complexity and potential risks to network security, making it imperative to account for both traditional vulnerabilities and new decentralized threats.

In addition, there is the “real-time” requirement: unlike IT environments such as banking, the power grid cannot simply be turned off to investigate and fix problems. Any disruption can cause cascading effects, shutting down other critical infrastructure.”