The evolving application security landscape
In 2022, the U.S. Bureau of Labor Statistics estimated that over 2 million people in the U.S. worked as software and web developers, programmers, and testers (category 15-1250, formerly 15-1130).1 The following is a graph charting the population growth in the category over a decade of available statistics. The bars show the absolute growth while the trend line represents the year-over-year (YoY) growth percentages.
Figure 1.1: Year-over-year growth percentage of developers in the US
Worldwide, the industry is expected to grow to over 28 million software developers in 2024.2 Thanks to complexity and specialization, a few of those developers work alone or create all the components of their software from scratch. They use software to build software, collaborate, deliver software, and provide backend services for their software, and monitor it all in production. All the software and services used by developers to create software are collectively called the software supply chain (SSC) and it has become more and more popular as an attack vector.
The growth in software supply chain attacks is not just anecdotal—it’s being quantified. The non-profit Identity Theft Resource Center reported that between 2018 and 2023, supply chain attacks rose 2,600% to represent over 15% of reported identity data theft in 2023.3 A year earlier, Help Net Security noted that supply chain attacks had outpaced malware as a source of data breaches.4 The European Union Agency for Cybersecurity, in their Foresight Cybersecurity Threats for 2030 report, listed supply chain compromise of software dependencies as their #1 threat by the end of the decade, based on both likelihood and impact, scoring 44% higher than ransomware.
Regulatory pressures to address software supply chain security are increasing as well. In US President Joe Biden’s 2021 Executive Order on Improving the Nation’s Cybersecurity, over 25% of the document focused on improvements in software supply chain security, including requiring both internal federal agency developers and external software vendors to provide more transparency about their processes and the provenance of their software.
Developing securely isn’t simply about avoiding issues in the future. It is about taking the right steps, the right precautions, and being able to document that for stakeholders, customers, and regulators. For example, the U.S. Securities and Exchange Commission requires all annual reports for publicly traded companies to include a section on how the company is managing cyber risk for fiscal years starting after December 15, 2023.5
Security awareness
The security culture of an organization is foundational to its ability to protect information, data, and employee and customer privacy. Companies are moving beyond reactive, episodic approaches to security and recognizing that effective enterprise-wide security requires a strategic, long-term approach, focusing more on reliable mechanisms, communication, and culture than lectures from IT and an ongoing stream of new policy mandates.
During the pandemic, industries and organizations saw their security cultures stagnate or decline. As many organizations transitioned to a work-from-home model, new security issues and concerns emerged, while the diaspora of knowledge workers made communication and education more challenging.
Threats such as ransomware can escape notice and do damage for months before detection, even in top-performing organizations. Ongoing awareness, understanding, and appropriate actions are required to ensure organizations’ data is safe and that employee and customer data is not compromised.
Security culture is a critical, must-have asset in the security toolbox. By assessing employees’ security awareness, behaviors, and culture, organizations can adapt their policies and training programs to the constantly changing threat landscape.
Regulatory compliance and legal considerations
While this will be addressed in greater detail in Chapter 7, Security Compliance and Certification, you should be aware that new legislation and regulations are being put in place at state, federal, and agency levels on multiple continents. Whether you make or simply use software, there's increasing pressure to ensure that not only the application but the information it processes is also secure.
These laws and regulations around reporting and compliance come on top of legal liability and reputational damage both for the institutions and their officers. The U.S. Securities and Exchange Commission has specifically gone after the CISO of one hacked company as part of its enforcement action. This will be discussed in detail later in the chapter. That comes on top of the company losing 64% of its market capitalization since the incident.
These laws and regulations are designed to prevent serious incidents with national or global impacts by ensuring that companies have effective strategies and practices in place.
Whether your company handles data or provides crucial services in banking and finance, transportation, utilities, or healthcare, you will face more scrutiny and responsibility from regulators and law enforcement. By adopting strong security measures, you can meet these challenges and ensure compliance, keeping your organization and its stakeholders safe.
Who are the threat actors?
Behind every cyber threat, there’s a threat actor: a person or group of people causing intentional harm by exploiting vulnerabilities in the cyber sphere. They are usually the perpetrators behind cyberattacks, and are often categorized by a variety of factors, including motive, type of attack, and targeted sector. As the frequency and sophistication of cyber threats continue to grow, so will the number of threat actors behind them.
Today, the cyber threat environment is arguably more dynamic than ever before, and threat actors are becoming more sophisticated. Understanding threat actors and their motives can help organizations better protect themselves from the damage these actors cause as they exploit vulnerabilities, compromise user identities with elevated privileges, evade security controls, damage or delete data, or manipulate sensitive information.
One of the larger developments in the security landscape over the years has been the rise of the advanced persistent threat (APT).
What is an APT?
According to the U.S. National Institute of Standards and Technology, an APT can be defined as follows:
“An adversary with sophisticated levels of expertise and significant resources, allowing it, through the use of multiple different attack vectors (e.g., cyber, physical, and deception), to generate opportunities to achieve its objectives, which are typically to establish and extend its presence within the information technology infrastructure of organizations for purposes of continually exfiltrating information and/or to undermine or impede critical aspects of a mission, program, or organization, or place itself in a position to do so in the future; moreover, the advanced persistent threat pursues its objectives repeatedly over an extended period of time, adapting to a defender’s efforts to resist it, and with determination to maintain the level of interaction needed to execute its objectives.”
While this is the textbook definition, to put it more simply, APT stands for:
- Advanced: APTs have resources, skills, and organization. Contrary to the stereotypical image depicted in popular media, they are professionals, often trained by state agencies, and sometimes still employed (or sanctioned) by them.
- Persistent: APT actors typically set up camps, take measures to avoid detection, create backdoors to get back in if you detect and close their main entry point, and move laterally throughout compromised systems to find more things to steal or damage and more connected systems to infiltrate.
- Threat: Needs no explanation.
APTs include organized professionals that pull off data thefts, cryptocurrency thefts, ransomware, corporate espionage, state-sponsored espionage, and even terrorism. In many cases, it’s more than one motive and it’s profitable. As this book details hacks, it will discuss APT groups and their methods in more detail.
Chainalysis, in their 2024 Crypto Crime Report, claimed that ransomware became a billion-dollar business in 2023.6 This was an estimate of ransomware payments, exclusive of the damage done. Due to that damage, the cost of ransomware was even higher. For example, while the ransomware attack on MGM Resorts in 2023 did not result in a payment to the group that successfully infiltrated MGM’s systems, it’s estimated that the clean-up costs were around $100 million.
While some of the access they gain is through deception and social engineering, APTs have increasingly used supply chain attacks to gain footholds or seed vulnerabilities in corporate and even government systems. In this regard, the SolarWinds case serves as a textbook example.
