When it comes to systemic cyber risks, cybersecurity experts rated Internet of Things (IoT) devices and large language models (LLMs) as the most immediate emerging risk areas of concern.
That finding came from a recent CyberCube and Munich Re survey of nearly 100 cybersecurity professionals. That project was designed to gather expert judgment in different areas of accumulation modeling where empirical data is limited or nonexistent. It also aimed to test and refine cyber catastrophe modeling assumptions and to explore the practical realities of cyber resilience and mitigation.
The survey found that in the near term, industrial and consumer Internet of Things (IoT) devices pose the biggest concern. When asked why IoT devices were seen as the most immediate area of concern, Ethan Spangler, lead economist at CyberCube, pointed to their recent increase in attack surface.
“You suddenly have machines that weren’t connected and vulnerable now being connected and open,” he explained. “Yes, there is a massive efficiency gain, but it’s also a massive security risk that you now have to worry about.”
IoT devices in a manufacturing setting, for example, can improve efficiency by providing insights to production levels and other telematics-based information in real time. At the same time, however, this interconnectedness makes companies vulnerable to ransomware that can shut down the same production lines. On the consumer side, hacking into and shutting down large swaths of IoT devices, such as WiFi-enabled smart fridges, could also cause chaos.
A said LLMs have been shown to be productivity enhancers across industries, allowing users to quickly learn and implement cybersecurity methodology on both the defense and attack sides. Notably, for attackers, these language models can be used to inform hacks and allow for scaling sophisticated spear phishing operations, the report said, whereas previously those were laborious exercises.
Related: Hacked Columbia University Data Includes Banking Numbers, GPAs
Spangler explained that meticulous research was formerly required to understand vulnerabilities when devising phishing schemes, Spangler said. Today, a LLM can do the phishing itself and be convincing, he said.
“LLMs are already being used in cyberattacks,” he said. “It’s no rogue SkyNet agent attacking. It’s people using these tools to enhance their own abilities.”
Conversely, on the defense side, LLMs also allow practitioners to analyze the sentiment, origin and prior communications of messages to better detect phishing attempts.
Respondents differentiated their views between artificial general intelligence (a hypothetical form of AI that would possess the ability to perform intellectual tasks on the same level as humans) and LLMs. The currently existing large language models were regarded as having an impact now, and AGI was seen as being a greater concern in five or more years.
Other Findings
The survey also found that another widespread malware event on the scale of WannaCry or NotPetya would not be seen as surprising to most experts. According to Cloudflare, the WannaCry malware worm spread to 200,000 computers in over 150 countries in 2017, and NotPetya impacted at least 2,000 organizations that same year. Experts said that a 10% global infection rate would be surprising, and a 25% rate would be truly shocking.
Respondents identified patch management, network segmentation and data backups as the most effective mitigations that organizations have against widespread malware attacks.
“When done effectively, such mitigations can reduce the chance of being affected by a widespread malware attack by 50% to 80% and reduce the financial impacts of such an event by a similar amount,” the report said.
CyberCube and Munich Re’s research found that the most effective mitigation against cloud outages is to establish a multi-region architecture with cloud service providers used for critical business applications.
“Having multiple CSPs was not found to be effective, as organizations commonly use different CSPs for different objectives, and the option to transfer service during an outage of one provider was seen as unfeasible,” the report said.
Topics Cyber
Was this article valuable?
Here are more articles you may enjoy.
Florida OIR Approves 31.5% ‘Catch-up’ Rate Increase for TRUE, Despite Missed Filings 
Demotech’s Petrelli Responds to WSJ Article. Others Say it Echoes Old Concerns 
Parents Want More Warnings After Brain-Eating Amoeba Killed Son in SC Lake 
Some Large Accounts Start Seeing Chubb’s Back as it Focuses on Middle, Small 
