In 2024, the ‘1000x developer’ combined with the ‘1000x hacker’ will create the perfect storm for breaches
Kevin Bocek, VP of Ecosystem and Community:
The gathering momentum behind the ‘1000x developer’ movement – whereby developers will become a thousand times more productive with the power of AI – will magnify security challenges in the year ahead. The speed and complexity of securing modern environments is pretty mind-boggling. And businesses are already struggling – 75% of IT and security leaders believe speed and complexity of Kubernetes and containers creates new security blind spots, while 59% of respondents admit to already having experienced security-related issues within Kubernetes or container environments, according to Venafi research.
Complicating matters is the ascent of the ‘1000x hacker’ – AI-enabled attackers who are equally productive and powerful. Organizations can’t feasibly hire 1000 cyber pros to compete with these threats. The solution lies in embracing the power of automation operating at machine speed. The only way to keep up is with the power of automation operating at machine speed. If developers are using AI to be 1000x more productive, we need the ‘1000x CISO’ and ‘1000x security architect.
2024 will be the year of the AI poisoning attack
Shivajee Samdarshi, Chief Product Officer:
In 2024, AI poisoning attacks will become the new software supply chain attacks. Such attacks will be characterized by threat actors targeting the ingress and egress data pipelines to manipulate data as well as poison AI models and the outputs they produce. With AI being used across a wide variety of business-critical workloads – potentially with very little oversight – maintaining the integrity of such systems needs to be of paramount concern. Small tweaks to AI inputs can change outputs dramatically – either immediately or slowly over a long period. So, any data being fed to AI must be secured. This means establishing the provenance of data and using technologies like code signing to secure it.
Next year, regulations will encroach even further into the development space, with changes to data breach liability potentially chilling innovation
Matt Barker, Global Head of Cloud Native Services:
Next year, the EU will be forced to amend the Cyber Resilience Act, as it’s unworkable in its current form. The Act’s wording around liability for data breaches and open source is worrying. In theory, if a 16-year-old developer writing open source code merely accepts a coffee as a reward for its contribution, it could be held to account if a large organization using its code is breached. So, there must be more clarity in the Act’s language around liability, or people writing open source code in the EU could stop contributing. And as we move into 2024, we will see an increased focus on ‘Know Your Code’ – underpinned by regulations such as the Executive Order on SBOMs – meaning organizations will need to establish and verify the provenance of the code they are using. Now that AI is being used to generate code, establishing where that code has come from is harder than ever before. Those who fail to do so will soon find themselves at risk, not only from attacks but also regulatory fines.
As organizations grapple with scaling security and governance across trust boundaries, machine identity and access management will shift to the workload level in 2024
Sitaram Iyer, Senior Director of Cloud Native Solutions:
Venafi research shows 76% of IT leaders believe we are heading towards a cloud reckoning in terms of costs and security. Many organizations started their journey with a single cloud provider, requiring them to manage identity and access only within that single environment. However, 69% acknowledge that when moving to the cloud, they dragged a lot of old security problems with them. As maturity has increased, organizations have begun using the cloud in a more distributed way across multiple trust boundaries, all containing identities that need to be managed.
The challenge in 2024 will be ensuring security controls work across environments and can be governed in a consistent way. This necessitates a strategic shift to a more agnostic, distributed way of managing machine identities and controlling access achievable only through authenticating identity and access at a workload level. As a result, the adoption of federated identities, such as SPIFFE machine identities, will rise. This will enable organizations to utilize existing Public Key Infrastructure for strong encryption across workloads, irrespective of where they run.
Outages will double in 2024 as machine identity lifespans shrink
Kevin Bocek, VP of Ecosystem and Community:
Shorter machine identity lifespans will create chaos, as outages double or even triple. Google has already announced intentions to reduce public trusted TLS certificate lifespans to 90 days – a crucial step to hampering cybercriminals looking to misuse identities. However, most organizations aren’t prepared for this. We’ve seen the impact of certificate related outages recently, with entire payment systems going down. As certificate identity lifespans decrease, this will become much more common, unless organizations automate machine identity management.
