Past is prologue: The evolution of cybercrime informs the future of cybersecurity

Cybercrime has remained a persistent threat for businesses large and small, despite continual enhancements in security defenses and practices. Cybercriminals are adept at adapting their tactics to exploit new vulnerabilities in the ever-evolving threat landscape. However, understanding past shifts in cybercriminal behavior helps businesses anticipate future threats, including those involving artificial intelligence (AI) and quantum computing.

Here are some key ways the landscape has evolved:

Gone are the days of the lone wolf — self-taught hackers who compromised systems just to satisfy their egos and show off capabilities. Cybercriminals have become increasingly sophisticated in how they identify targets and execute attacks. Moreover, state-sponsored attackers and criminal ecosystems are collaborating more closely, and for many attackers, this is a full-time profession.

Hackers are caught when they use coding and techniques that trigger red flags in detection systems. Attackers now exploit legitimate administrative tools already present on systems or networks. Called “living off the land,” this technique helps them operate under the radar of detection systems.

Attackers aren’t just disabling data and systems to block access to them; they’re also encrypting and compressing stolen data to avoid detection. These techniques obscure data exfiltration and complicate forensic analysis. 

With cybercriminals constantly evolving their techniques, businesses and users can’t be complacent. They, too, must transform their defenses and practices to keep pace or, ideally, move a step ahead of the criminals.

Constantly update your employee training to reflect emerging threats. Cultivate awareness among workers by distributing samples of deepfake audio and videos to build awareness of realistic deception tactics. Ensure employees know about policies and processes on how to respond to suspicious communications.

Enforce the use of unique and strong passwords for every account and deploy multifactor authentication to block unauthorized access.

Staying on top of software updates and patches closes known vulnerabilities often exploited in attacks.

Segmenting critical data and systems from everyday business networks can prevent a simple breach from becoming a catastrophic one. Limit access to critical systems and data to only those who need it.

Legacy systems often lack updates and provide easy entry points for cybercriminals. Audit your network and remove unused systems and accounts.

Effective offline backups and recovery tools are key to fast ransomware recovery. Establish protocols that back up data daily or weekly (depending on the volume of new data you produce and your capacity to withstand data loss). Store backups offline to prevent malware access. Practice restoring from backups once or twice a year, so everyone involved understands the time and tools it will take to resume operation of your business.

The threat landscape is dynamic and constantly evolving, and businesses must adapt to stay ahead. Attackers frequently shift their tactics searching for unrecognized vulnerabilities, making proactive defense essential. Staying ahead means more than reacting to incidents. Rather, it requires anticipating how adversaries will innovate next. By understanding how attackers operated and pivoted in the past, businesses can monitor emerging techniques, invest in adaptive security strategies and foster a culture of vigilance.