Insights from RSA Conference 2024: AI, Cyber Resilience, and More
AI’s integration into cybersecurity and the urgent need for cyber resilience took center stage at the RSA Conference 2024.
Sundhar Annamalai, president of LevelBlue, discusses the growing complexity of computing and the importance of cyber resilience. He highlights key insights from the RSA Conference 2024 and emphasizes the need for proactive cybersecurity measures, including advanced threat intelligence, regular vulnerability assessments, and investment in cutting-edge security technologies.
This year’s RSA Conference, which was held in San Francisco on May 6 – 9, 2024, brought together cybersecurity, government, and business leaders from around the world to network and learn about emerging cyber threats, industry trends, and actionable best practices to address IT security’s top obstacles. With a timely theme of “The Art of Possible,” the major industry event featured an estimated 650 expert speakers, 425 actionable sessions, and 600 exhibitors, creating a wave of excitement that spanned the entire week (and beyond).
Now in its 33rd year, this year’s RSA Conference was different compared to those in the past. For one, attendance finally felt back to “full force” post-pandemic years – and it was very apparent on the expo show floor. There seemed to be a record amount of cybersecurity vendors this year, with each of them touting artificial intelligence (AI) and machine learning (ML) capabilities. Last year, AI was the talk of the town at the RSA Conference, with many saying it will change the cybersecurity industry as we know it. This year, AI shifted from a concept to an urgency – it’s here, it’s being implemented within business, and it’s changing the way we work. But it’s also fundamentally changing the cyber threat landscape, and vendors are capitalizing on this, creating noise and longer-term, only adding to the industry’s tool fatigue. This was a common concern that I directly heard from cybersecurity practitioners on-site.
Additionally, public and private sector collaboration was a main theme this year compared to past years. A prime example of this was the U.S. Cybersecurity and Infrastructure Agency’s “Secure by Design” pledge, a voluntary commitment signed by over 60 big tech companies at the RSA Conference. The pledge spans seven foals, with technology vendors measuring their progress against each of the following areas:
- Increase the use of multi-factor authentication (MFA) across their products;
- Reduce default passwords across their products;
- Reduce one or more entire classes of vulnerabilities;
- Increase the installation of security patches by customers;
- Publish a vulnerability disclosure policy (VDP) that authorizes testing by members of the public on products and commits to not pursuing legal action against anyone engaging in good faith efforts to follow the VDP;
- Demonstrate transparency in vulnerability reporting by including accurate Common Weakness Enumeration (CWE) and Common Platform Enumeration (CPE) fields in every CVE (common vulnerabilities and exposures) record for their products;
- Make it easier for customers to spot evidence of intrusions affecting their products.
This was just some of the buzz stemming from the RSA Conference, but here are my top takeaways and standout themes from the event following several discussions with industry peers on-site:
Understanding the Impact of Dynamic Computing on Cybersecurity
There’s been an explosion in computing power, and for business leaders, this dynamic computing brings an immense opportunity for rapid innovation and competitive advantage. However, the stark reality is that these computing advancements also drastically increase the attack surface, lessening IT estate visibility. In fact, recent LevelBlue research found that 56% of senior executives have limited visibility of the IT estate, with 72% believing digital transformation is an ongoing barrier to cybersecurity resilience. Securing dynamic computing environments requires a new way of thinking, starting with prioritizing cyber resilience.
Bridging the Gap: Aligning Business Leaders with Cyber Resilience Goals
Resiliency was a key theme in conversations overheard at the RSA Conference. The term can carry various meanings amongst audiences, but there was an increased emphasis on cyber resilience this year. Cyber resilience focuses on the entire IT estate across a business (as it pertains to computing) and its ability to recover from an unexpected interruption, from a cyber incident to natural and artificial disasters.
Despite the increasing number of cyber attacks and the skyrocketing costs of such attacks, cyber resilience is still not prioritized as a business initiative. Security teams know the importance of cyber resilience, but across the C-suite and Board, there’s room for greater awareness, education, and prioritization. Moreover, our research found that 63% of senior leaders admit leadership doesn’t prioritize cyber resilience and 72% claim that their governance team doesn’t understand it. This is a massive disconnect that had RSA Conference attendees (and speaking sessions) interested in learning how to break down these silos and bridge the gap in the most efficient, collaborative manner.
See More: AI in Cybersecurity: What Organizations Must Know
Cybersecurity Budgets Continue to Be Reactive
IT security budgeting has always been a hot topic in the industry, but given the current macroeconomic climate, it was at the top of most minds at this year’s RSA Conference. Most agree: Budgets continue to be reactive rather than proactive when addressing cybersecurity – further distancing organizations from the goal of achieving cyber resilience. Top drivers unlocking cybersecurity budgets include new, evolving compliance requirements, competitor breaches, and internal breaches, which again are reactionary.
The Adoption of Cybersecurity-as-a-Service Is on the Rise
Given these trends, businesses choose to address IT security and computing complexity by outsourcing trusted third-party advisors. As a result, we’re witnessing an increase in the adoption of Cybersecurity-as-a-Service (CSaaS), with 32% of organizations opting to outsource their cybersecurity needs rather than managing them in-house. This external party typically provides expertise and always-on support while also being a key factor in addressing the cybersecurity skills shortage.
One of the biggest challenges in finding a trusted cybersecurity advisor is finding the one that’s right for your organization and its specific needs. For this reason, buyers must arm themselves with the latest vendor-neutral, forward-looking industry research—one that helps them with investment prioritization while also helping them understand the emerging trends and threats on the horizon. It’s important to arm yourself with this type of information before purchasing another security tool, especially as computing complexity increases and security team burnout increases.
Image Source: Shutterstock
MORE ON CYBER RESILIENCE
