By Matías Altamira
We can and must all do better, strengthening our digital domains to protect our networks, data and people at every level, says Tom Burt.
The Microsoft corporation presented its “Microsoft Digital Defense Report 2024” that analyzes the period between June 2023 and July 2024, when it closes its annual balance sheets, which in its opening paragraphs Tom Burt, Corporate Vice President and Head of the security and trust team of Microsoft customer, expressed that over the last year, the cyber threat landscape has become increasingly dangerous and complex. The world’s malicious actors are more resourced and better prepared, with increasingly sophisticated tactics, techniques and tools that challenge even the best cybersecurity defenders.
Because these actors carry out both targeted and opportunistic attacks, the threat they present is universal, meaning organizations, users, and devices are at risk anywhere, anytime. Even Microsoft has been the victim of well-orchestrated attacks by determined and deep-resourced adversaries, and our customers face more than 600 million cybercriminal and nation-state attacks every day, ranging from ransomware to phishing and identity attacks.
These cyberattacks continue on a staggering scale—in the United States alone this fiscal year, 389 healthcare institutions were successfully attacked by ransomware, resulting in network shutdowns, system disconnections, delays in critical medical operations, and rescheduling of appointments. Worse yet, the increased risk of cyberattacks is no longer limited to civilian cybercriminals. National governments are becoming more aggressive in the cyber space, with increasing levels of technical sophistication reflecting greater investment in resources and training. These state-sponsored hackers not only steal data, they launch ransomware, position backdoors for future destruction, sabotage operations, and conduct influence campaigns.
The sheer volume of attacks must be reduced through effective deterrence, and while the industry must do more to defuse attacks through improved cybersecurity, it is imperative that governments provide effective sanctions that discourage the most damaging cyberattacks. While much attention has been paid in recent years to the development of international norms of conduct in cyberspace, so far these norms have not resulted in significant consequences for their violation, and attacks by nation states have not been deterred, and have increased in volume and aggressiveness.
The report explains how Microsoft is responding to significant attacks on its corporate infrastructure, including its company-wide “Secure Future” initiative to make security its top corporate priority, with the hope that these learnings will help others to think about their own security posture and cyber defense approach.
We believe – Burt continues – that transparency and information sharing are essential to the protection of the global cyber ecosystem. Communicating the insights we gain from our unique point of view is one of the many ways we work to make the cyber world a safer place.
In the tug-of-war between attackers and defenders, in which the attackers currently have an advantage, awareness and commitment from both the public and private sectors will be necessary to ensure that the defenders win.
Several aspects stand out to replicate in each organization, first that the individual fight against very well managed organizations for evil will not be efficient; Only by integrating with other actors can joint actions be carried out; second, the law in itself is not enough, if the person potentially sanctioned validates that there is no sanction; and third, it is not a problem for private individuals, but for the entire world society, from the smallest organization, so both Community Chiefs and Presidents of countries must include protection against cyber attacks in their agendas, if there is any area left. unprotected, attackers are empowered.
Lawyer, specialist in Computer Law
