2024: Cybersecurity Year In Review
Security Centric
Engineered Information Security: A business risk focused cyber and information security consulting firm.
Reflecting on a Transformative Year in Cyber?
"Change is the only constant"
This year brought seismic shifts, from major outages disrupting global operations to legislative reforms reshaping compliance obligations. As cyber threats grew in sophistication and scale, organisations across Australia found themselves adapting to new risks, technologies, and regulations. While many significant events shaped the year, the following stand out as some of the most impactful developments, these events are highlighted to showcase the evolving challenges and opportunities in securing critical infrastructure and safeguarding digital ecosystems.??
We have also highlighted how Security Centric has been involved in helping our clients address these issues and changes throughout this turbulent year.?
NIST Version 2.0?
The National Institute of Standards and Technology (NIST) has released version 2.0 of its cybersecurity Framework (CSF), marking its first major update since 2014. A key addition is the new Govern Function, which emphasises cybersecurity governance as a central pillar for managing cyber risks alongside existing core functions: Identify, Protect, Detect, and Recover. The framework now applies to organisations of all sizes and sectors, broadening its reach beyond critical infrastructure. NIST CSF 2.0 includes tools such as searchable references, community profiles, and quick start guides to improve implementation. Organisations using version 1.1 are advised to review the Govern Function and update their profiles to align with the revised framework structure.?
While NIST CSF 2.0 is an American framework and Australian organisations are not required to comply, it remains highly influential. Australian enterprises, especially in critical infrastructure sectors, can use the updated framework to strengthen governance and improve cybersecurity risk management. The addition of the Govern Function and enhanced supply chain guidance offers valuable insights for aligning with global best practices and addressing local cybersecurity challenges.??
The release of NIST CSF 2.0 combines strong risk management requirements and technical mitigations, this mirrors Security Centric’s approach of combining ISO 27001 and Essential 8 requirements for the best of technical and governance standards. We are happy to see more standards adopt this holistic approach to security as we strongly believe that all aspects need to be covered in order to build and maintain a resilient organisation.?
The Rise of AI?
Artificial intelligence (AI) has fundamentally reshaped cybersecurity throughout 2024, presenting both significant opportunities and emerging risks. While AI enhances defensive capabilities, through advanced threat detection, automation, and predictive insights, it simultaneously enables more sophisticated attacks including AI-driven phishing and credential exploitation. Globally, frameworks such as the NIST AI Risk Management Framework (RMF) are guiding responsible AI adoption, emphasising risk mitigation and ethical use. In Australia, the NSW AI Assessment Framework (AIAF) has set a precedent for government-led AI governance. While not mandatory for private organisations, its principles of risk assessment, ethics, and accountability offer valuable guidance.??
AI’s growing adoption has amplified the sophistication of cyber threats targeting Australian organisations. Threat actors are increasingly leveraging AI to bypass traditional security controls through automated attacks and highly tailored phishing schemes. On the defensive front, Australian businesses are exploring AI-powered tools to strengthen detection, automate manual processes, and optimise compliance workflows. Despite the progress, the absence of mandatory AI frameworks for private organisations creates a fragmented approach to risk management. The NSW AIAF highlights how structured governance can support responsible AI use, yet its government-only application limits widespread adoption. Moving forward, Australian organisations will need to strike a balance, leveraging AI to enhance security while proactively addressing its associated risks.?
领英推荐
Security Centric has been heavily involved in assisting to prepare and manage the new risks introduced by AI tools and platforms. Typically, this involves developing business rules and related policy for the use of tools as well as risk assessing the potential impacts of using AI tooling (many of which are not initially very clear).??
CrowdStrike Outage – Global IT Chaos?
On July 19, 2024, a faulty update to CrowdStrike’s Falcon Sensor security software triggered widespread global IT outages, affecting millions of Microsoft Windows systems. This unprecedented incident caused critical services to fail, with industries such as aviation, healthcare, and finance hit the hardest. Systems entered endless reboot cycles, grounding flights, delaying medical services, and crippling government operations. The outage lasted hours but left lasting damage, raising concerns over software dependencies and vendor risk management. Regarded as one of the largest IT disruptions in history, the CrowdStrike outage highlighted the fragility of centralised cybersecurity solutions.?
In Australia, the outage disrupted airlines, hospitals, and essential government services, exposing our nation’s reliance on international cybersecurity vendors. Organisations faced operational paralysis, showing the need for resilient backup systems and improved incident response strategies. However, this event has promoted Australian businesses to reassess vendor risks, diversify security solutions, and prioritise contingency planning to mitigate future large-scale disruptions.?
Security Centric engineers were actively involved in assisting a number of our clients in recoveringto recover from the impacts caused by the outage as well as ensuring that no further impact occurred from a security perspective.??
SOCI Act Changes?
On October 9, 2024, the Australian Parliament introduced the SOCI Amendment 2024, marking a significant evolution of the Security of Critical Infrastructure Act 2018. The bill aligns with the government’s 2023-2030 Cyber Security Strategy, aiming to combat escalating cyber threats. Two key changes stand out, the inclusion of data storage systems as part of critical infrastructure assets, and reforms to protected infrastructure being safeguarded, while simplifying the sharing and classification of sensitive information. These reforms reflect the government’s recognition of increasingly complex cyber risks facing vital Australian industries.?
By broadening the definition of critical infrastructure, the government has acknowledged the growing risk of malicious actors exploiting interconnected IT and Operational Technology systems. For Australian industries, this means stricter obligations to assess and secure business-critical data, alongside updating Critical Infrastructure Risk Management Programs (CIRMPs). Simultaneously, reforms to the protected information regime will provide greater flexibility to disclose sensitive data during crises or operations, reducing compliance confusion.?
Security Centric has been involved in preparing organisations for compliance with the new SOCI Act changes as well as performing ongoing support for organisations that were already subject to SOCI requirements.?
Addressing Cyber Security Challenges in 2025 and Beyond?
The CrowdStrike outage exposed critical third-party vulnerabilities in systems globally, while the SOCI Act amendments detail the need for comprehensive risk management of data storage systems and clearer information-sharing protocols. These events, alongside ongoing challenges like NIST CSF 2.0 updates, the rise of AI-driven threats, and expanding compliance frameworks, demand a proactive and adaptable approach to cybersecurity.?
Security Centric is ready to assist with third-party risk management frameworks, navigating AI-related challenges, and ensuring compliance with evolving governmental requirements along with any other cybersecurity issues and initiatives. With organisation-specific tailored assessments and mitigation strategies, we help organisations stay resilient in the face of an ever-changing cybersecurity landscape into 2025 and beyond.?