In the current cybersecurity landscape, the prevalence of identity-based attacks has significantly escalated in 2024. Threat actors are displaying increased intentionality and resourcefulness in exploiting valid identities to circumvent existing defences. This year, Common Vulnerabilities and Exposures (CVEs) have notably shifted focus towards identity theft and bypassing controls aimed at safeguarding identities. Concurrently, there has been notable diversification in the exploitation of vulnerabilities, with a wider range of classes being weaponised. Threat actors are now leveraging leaked credentials from data breaches and information stealers to exploit misconfigurations and exposed services.

Further, adversary-in-the-middle attacks have evolved, with trusted brands being impersonated to trick victims into providing sensitive information, including their identities, enabling threat actors to assume false identities. Additional risks of identity attacks are also emerging after disruptions and exit scams leave the ransomware landscape even more volatile, creating new opportunities of varying sophistication to exploit vulnerabilities and fill the resulting security void.

Kok Tin Gan, PwC Hong Kong Cybersecurity and Privacy Partner, said: The rising prevalence of identity-based attacks underscores the critical need for enhanced cybersecurity measures. We have to improve cybersecurity measures and execute proactive strategies to protect personal and digital identities in our interconnected world. Organisations and individuals must remain vigilant and implement robust security protocols to safeguard against the evolving tactics of cyber threats. Our Hack A Day was a resounding success, bringing together industry experts, cybersecurity professionals, and enthusiasts to explore key insights and strategies for protecting identities in the digital age.”

The conference provided a lineup of insightful presentations by industry experts, engaging workshops focusing on identity governance and data privacy, and valuable networking opportunities for cybersecurity professionals and enthusiasts alike.

Key highlights:

Identity protection focus: Presentations and workshops delved into the escalating threat of identity-based attacks in 2024, emphasising the need for enhanced cybersecurity measures to combat evolving tactics employed by threat actors.

Diverse vulnerability exploitation: Participants gained insights into the broadening landscape of vulnerability exploitation, ranging from leaked credentials and data breaches to misconfigurations and exposed services.

Adversary tactics: Attendees learned about the sophisticated methods employed in adversary-in-the-middle attacks, including the impersonation of trusted brands to deceive victims and extract sensitive information.

Ransomware landscape: The event shed light on the evolving ransomware landscape following disruptions and exit scams, providing attendees with a comprehensive understanding of the emerging challenges in cybersecurity.

PwC Hong Kong has offered scholarships to over 80 university students to develop their careers in cybersecurity since the Hack A Day was launched for the eighth consecutive year. More than 55 employees are hired for its cybersecurity team in Hong Kong each year. It is also one of the biggest employers in the industry and has groomed over 250 expert staff to date.

Collaboration highlights with CSC and .TOP

PwC Hong Kong’s collaboration with CSC and .TOP showcased the commitment to sharing high-confidence threat intelligence derived from extensive cyber threat operations. The shared insights aim to strengthen Hong Kong’s cyberspace resilience against prevalent threats, promoting data privacy, protecting intellectual property, and underpinning economic stability.

The collaborative efforts target a diverse audience, including individual citizens, small and medium enterprises, large corporations, and the public sector, underscoring the shared responsibility of safeguarding the digital ecosystem.

Kok Tin Gan expressing gratitude for the collaboration, said, “Our partnership with CSC and .TOP reinforces our commitment to fortifying Hong Kong’s cybersecurity landscape and protecting the interests of all stakeholders. PwC’s Dark Lab works with CSC and .TOP to share our collective knowledge with reputable registrars, with the aim of safeguarding Hong Kong’s cyber resilience. Equally, we share the goals of protecting the public safety of citizens by minimising the risk of operational disruption, securing individuals’ data privacy and companies’ intellectual property, and supporting ongoing economic stability by protecting businesses, critical infrastructure, and trade networks from cyber threats.”