Start your day with intelligence. Get The OODA Daily Pulse.
Informing your decisions with actionable intelligence
Start your day with intelligence. Get The OODA Daily Pulse.
Informing your decisions with actionable intelligence
In 2024, the cybersecurity landscape faced unprecedented challenges and rapidly accelerating technological advancements, with nation-state and non-nation-state actors, groundbreaking quantum computing risks, and AI-driven threats redefining the global digital battlefield.
This analysis offers a comprehensive exploration of strategic shifts, regulatory updates, and the critical importance of proactive cybersecurity in a rapidly evolving threat environment.
The 2024 Year-End Review on Cybersecurity underscores the intensifying challenges posed by state-sponsored cyber espionage, particularly from China and Russia, while examining pivotal incidents like the CrowdStrike outage and the largest telecom intrusions in history.
Emerging technologies such as quantum computing and AI are at the forefront, reshaping offensive and defensive strategies, with initiatives on quantum-safe encryption and AI risk management frameworks gaining prominence.
This review also delves into legislative and diplomatic efforts to counter cybercrime and enhance security, including U.S. collaborations under the UN Cybercrime Treaty and measures to curb China’s cyber activities. This analysis comprehensively explores strategic shifts, regulatory updates, and the critical importance of proactive cybersecurity in a rapidly evolving threat environment.
The year ended with a focus on supply chain security and the risks associated with digital dependencies. OODAcon 2024 highlighted China’s cyber tactics and broader global cybersecurity challenges. Discussions on the convergence of quantum computing and Bitcoin emphasized the transformative risks ahead, signaling the criticality of adapting to an increasingly complex threat landscape.
China’s aggressive cyber activities were spotlighted, from orchestrated hacks to strategic use of its hacking contest ecosystem. The largest telecom intrusions in history revealed vulnerabilities at a massive scale. Meanwhile, AI-fueled cryptocurrency crime emerged as a growing threat, and U.S. engagement in the UN Cybercrime Treaty demonstrated efforts to build international coalitions against cybercrime.
Generative AI threats became a focal point as organizations dealt with evolving attack methods. High-profile incidents, such as the CrowdStrike outage, illustrated the shifting roles of CISOs and boards in managing cybersecurity. The Department of Defense’s Cybersecurity Maturity Model Certification Rule was implemented, highlighting the growing regulatory emphasis on cyber.
Efforts to enhance internet routing security and protect cyberinfrastructure in the face of great power competition intensified. Discussions at the Cyberspace Solarium Commission 2.0 reflected on strategic steps for the next administration. The need for quantum-safe encryption was a critical topic, emphasizing national security’s dependence on technological foresight.
This month focused on critical infrastructure resilience amid escalating information warfare, social engineering, and ransomware threats. The finalized NIST post-quantum encryption standards highlighted progress toward securing a quantum future. Global cybersecurity events like Black Hat USA 2024 and DEFCON 32 emphasized emerging attack trends and defensive innovations.
The largest IT outage in history, involving CrowdStrike and Microsoft, disrupted operations worldwide and underscored the need for diversification in cloud dependencies. The OODA Network discussions and subsequent industry analyses pointed to lessons learned from this debacle. Concurrently, blockchain and quantum computing threats gained attention as future vulnerabilities.
The U.S. cybersecurity posture received praise for its improvements, but gaps in data privacy remained concerning. Controversy arose over the U.S. ban on Kaspersky Labs, prompting debates about effective regulation. The NIST NVD backlog underscored the challenges of keeping up with vulnerabilities as global IT supply chain incidents surged, including high-profile incidents affecting cloud providers.
The convergence of AI and cybersecurity became central as the Cyber Arms Race evolved into AI weaponization. The annual U.S. Intelligence Community Threat Assessment emphasized the increasing frequency of cyberattacks. Government and private sector partnerships expanded to address ransomware threats, while discussions about hardware-level zero trust gained momentum as a future foundation for IT security.
Cyber threats surged in critical infrastructure sectors, with ransomware gangs leveraging advanced social engineering tactics. The DEFCON AI Village showcased generative AI as a double-edged sword for attackers and defenders. Reports of powerful malware, like the ‘Brokewell’ Android Trojan, exposed growing vulnerabilities in personal devices. Meanwhile, initiatives such as the UN Security Council’s engagement in international cybersecurity and the U.S.’s bolstered efforts in healthcare cybersecurity highlighted global and sector-specific responses.
The month centered on proactive measures to address persistent cyber threats and improve organizational resilience. U.S. government agencies intensified efforts to combat Chinese cyber espionage and human targeting, though questions remained about the sufficiency of these measures. The NIST Cybersecurity Framework 2.0 was introduced, offering updated guidelines for safeguarding critical systems. The long-awaited Privacy Executive Order was released, signaling a new era for data protection and privacy enforcement.
Within the cybersecurity community, calls for adopting memory-safe programming strategies and better diagnostics emphasized the need for improved cybersecurity quality. Discussions on efficient budget allocation for cybersecurity gained momentum, driven by the imperative to balance protection and cost. The OODA Almanac 2024 was revisited, highlighting strategic insights for navigating the evolving threat landscape, while the i-SOON data leak underscored ongoing vulnerabilities in data security.
February spotlighted sophisticated advancements in large language models (LLMs) and their implementation in cybersecurity, reflecting both opportunities and threats. CISA’s JCDC reaffirmed its priorities amid scrutiny, continuing to address key cybersecurity challenges. A joint report by Microsoft and OpenAI emphasized the urgency of addressing AI-driven threats, accompanied by a $10M State Department bounty for critical AI security solutions. The concept of CYBER COM 2.0 was introduced, exploring a redefined U.S. Cyber Command strategy for the future. The OODA Almanac 2024 provided strategic reorientation guidance, emphasizing the importance of adaptability in a rapidly changing cyber environment.
The year began with a focus on the rapidly evolving cybersecurity landscape, highlighting the need for stronger governance and public trust. Concerns grew around government purchases of commercially available information, raising privacy and trust issues. AI threats became a key area of discussion, with calls for establishing cyberspace attribution standards and improving data privacy regulations through an awaited executive order.
Election security emerged as a pressing priority, with warnings against misinformation. Scams targeting Americans surged, prompting the tech sector and government to explore collaborative solutions. Key reports from the DHS Cyber Safety Review Board and the CISA Cybersecurity Advisory Committee underscored the need for proactive measures to protect critical infrastructure and adapt to exponential technological disruption. The “Tallinn Mechanism” was introduced to enhance civilian cyber assistance in Ukraine.
About the Author
Daniel Pereira is research director at OODA. He is a foresight strategist, creative technologist, and an information communication technology (ICT) and digital media researcher with 20+ years of experience directing public/private partnerships and strategic innovation initiatives.
Informing your decisions with actionable intelligence
Informing your decisions with actionable intelligence