As we wind down 2024, some of our Nexus contributors have looked back on the challenges and wins the cybersecurity industry has achieved, and provided their take on what lies ahead next year within their industries and specialty areas. Today, Adm. Michael S. Rogers, former NSA Director and head of U.S. Cyber Command, reflects on the growing aggression of foreign adversaries on U.S networks, and predicts more deterrence coming in cyberspace.
2024 was a tough year in cybersecurity. We began the year talking about Chinese uploading of destructive malware into portions of the US power grid (Volt Typhoon) and we end it very focused on arguably the worst hack the US has ever experienced in the form of China's penetration of most of the US's telecommunication backbone (Salt Typhoon) and the extraction of significant amounts of data on telecommunications activity as well as accessing of content of phone and text communications.
Along the way we experienced massive data hacks and ransomware events during the year including MOAB (Mother Of All Breeches—26 billion record exposed), the Change Healthcare ransomware event which exposed private health information from more than 100 million individuals; the Russian penetration of the Microsoft internal network designed to access the company's knowledge of Russian cyber operations, and the hacking of Ticketmaster's network and access to data from over 560 million users—just to name a few events of significant scale and concern.
All threat actors—nation states, criminal groups, and even individuals—seem to be emboldened to conduct ever more aggressive cyber intrusions for a host of purposes from revenue generation to espionage to achieving strategic advantage in a crisis or war. Meanwhile, technology continues to fuel an increase in malicious actor cyber capability and for at least now appears to be out stripping the defenders’ use of that same technology to achieve enhanced cyber security. And yet we see in Ukraine that a high level of cyber resilience can be achieved even in the face of conflict and the aggressive use of cyber as an element within that conflict.
2025 will see an increased focus on trying to diminish the accelerating aggressiveness within cyberspace that we experienced in 2024 from nation states and criminal groups. Governments are likely to increase their efforts in cybersecurity while driving (through regulation and partnership) the private sector to do the same.
Governments are also likely to apply a broader range of tools to create pain for those actors engaged in such activity. Offensive cyber operations are likely to be seen as one such tool to be used in response to such activity. Governments will increase their focus on defending critical infrastructure against cyber events and both the government and the private sector of the larger economies will be looking to identify and apply lessons from Ukraine's ability to achieve and sustain a high level of cyber resilience. Advanced technologies such as AI will be applied more aggressively in enhancing cybersecurity.
U.S. Navy Adm. (Ret.) Michael Rogers served as the 17th Director of the National Security Agency and the 2nd Commander of U.S. Cyber Command. Adm. Rogers presided over the activation of the Pentagon's Cyber Mission Forces and the elevation of U.S. Cyber Command to unified combatant command status. He is currently the chairman of Claroty’s Board of Advisors.
