4 Tips For Staying Ahead of Cybersecurity Threats in 2024

As we kick off the new year, we're excited to look back on all that we learned in 2023. This past year saw some momentous advancements, including the large-scale adoption of generative AI (GenAI). However, it also saw some devastating data breaches. According to IBM’s latest “Cost of a Data Breach” report, 95% of studied companies experienced a breach in 2023. While this finding may make breaches seem inevitable, 2023 has shown us a number of ways to either minimize their skyrocketing costs (averaging $4.45 million) or avoid them altogether.

Read on for four of Nightfall’s top tips for leveling up your cloud security in 2024, based on the most newsworthy security moments of 2023.

To ChatGPT or not to ChatGPT

After catapulting to 100 million users at the beginning of 2023, ChatGPT heralded the beginning of a new age of AI. However, despite ChatGPT’s multitude of benefits, it also presented several new challenges for security teams to navigate. From Samsung to Spotify, several major companies even went so far as to ban employee use of GenAI for the following reasons.

1. Employees might accidentally leak sensitive data to LLMs by including it in prompts to GenAI tools.
2. Once data is leaked to GenAI tools, it can’t be deleted. Leaked data can also be used to train LLMs, which means that it can theoretically be reconstructed by threat actors later on.
3. In addition to LLMs, data may also be leaked even further to third parties such as annotation platforms or contractors.

Without security policies in place to encourage the safe use of GenAI, companies are all but certainly putting themselves at risk for prompt injection, data poisoning, and data extraction, as well as other forms of attacks. These risks are precisely what inspired Nightfall’s holistic GenAI solution, which is comprised of the following products:

• Nightfall for ChatGPT scans all ChatGPT prompts and redacts sensitive data before it’s submitted to OpenAI.
• Nightfall for SaaS scrubs sensitive data from SaaS apps with third-party sub-processors.
• Nightfall’s Developer Platform helps developers to remain in continuous compliance while building the next generation of GenAI tools.

Armed with a holistic cloud DLP solution, companies can maximize the productivity benefits of GenAI while also minimizing the risk.

Remediate in real time

IBM’s latest report uncovered that, using AI, security teams can contain breaches 108 days faster—saving an average of $1.8 million in the process. AI has also proven to be incredibly useful in streamlining security team workflows. Here’s just a handful of the other benefits that security teams experience while using AI:

• Better signal-to-noise ratio: GenAI-powered DLP tools have up to 4 times fewer false positive alerts than DLP tools that rely on regular expressions or rule-based approaches. This not only saves hours of time on triage, but also frees up security teams so that they can focus on high-risk alerts.
• Faster time to remediation: Automated remediation can single-handedly stop data sprawl before it has the chance to become a data leak.
• Stronger culture of security: DLP tools like Nightfall can notify an employee the moment a policy violation occurs. And with features like Nightfall’s human firewall, employees can even remediate violations themselves.

With these benefits in mind, AI helps security teams to not only save time, but also enhance overall security posture through real-time education and remediation.

Make sure secrets stay secret

This year Verizon revealed that 86% of basic web application attacks involve stolen credentials. They also found that 74% of all breaches involve human error. While phishing attacks might be the first thing that come to mind, this number also includes instances of accidental data sprawl.

But what is data sprawl? Let's dive into an example. Say you’re a developer who’s accidentally included an active API key in their latest commit in GitHub. You also use Jira to track your projects, so that API key finds its way to Jira as well. Now, there are two possible instances where a threat actor could discover the API key and use it to escalate their privileges. This scenario is precisely why Nightfall teamed up with Snyk: To offer a developer-first secret scanning solution.

Why developer-first, you may ask? First, developers have privileged access to sensitive databases, source code, and more—and with that access, they’re more likely to accidentally share secrets like API keys, cryptographic keys, and passwords. Second, security teams may not always be able to remediate developer secrets, as they don’t have the appropriate context to do so. Nightfall and Snyk provide an elegant solution to both of these challenges by automatically asking developers to evaluate and remediate their own violations.

Protect your data at rest

Speaking of stolen credentials, the 2023 Okta breach raises yet another risk that security teams need to be aware of in 2024. ICYMI, a threat actor used stolen credentials to obtain access to Okta’s support case management system. From there, the threat actor was able to find active session tokens within HAR (HTTP Archive) files, and then use those session tokens to impersonate in-house Okta admins at nearly all of Okta’s 18,000 customers.

In response to the Okta breach, industry experts advised security teams to scrub sensitive data from HAR files before sending them. However, HAR files can be tens of thousands of lines long—which means this approach isn’t practical without the help of a DLP tool.

Here’s where Nightfall for Data at Rest comes in. Once it’s plugged in via APIs, this tool pinpoints PII, PHI, PCI, secrets, and keys stored in historical data across apps like Zendesk. This tool also provides the option to remediate sensitive data in bulk, thereby empowering security teams to improve their security posture and ensure compliance in one fell swoop.

Start the year off strong

Nightfall's holistic, AI-first cloud DLP solution is dedicated to helping security teams safeguard their secrets, protect their data at rest, and build a stronger culture of security.

Get a closer look at Nightfall for ChatGPT, Nightfall for SaaS, Nightfall for Data at Rest, and more by signing up for a free demo today.
‍