Here's what cybersecurity experts want information security professionals to know as we approach 2022.
Nobody could have predicted the total chaos that the cybersecurity industry would face in 2021. Record-breaking ransomware attacks, SolarWinds' supply-chain devastation, and, most recently, the discovery of Log4j by...Minecraft players. All of this would have sounded far too outlandish a year ago.
Nonetheless, here we are.
Predictions for the coming year seem audacious given the previous 12 months, so Threatpost spoke with industry experts and developed this list of the five top trends to watch in 2022.
- There Will Be Increasing Government Interest, Effect in Cybersecurity
The government's interest in cybersecurity will grow, as will its influence.
SolarWinds, the Colonial Pipeline attack, malware, and privacy issues have attracted the interest of governments throughout the world, and experts agree that new legislation and investments will be implemented in the coming year.
In the months running up to the 2020 elections, governments were focused on the spread of disinformation to affect election outcomes, but other urgent national security concerns surfaced in the aftermath of significant cyberattacks on critical infrastructure. These urgent cyber risks, according to researchers, will continue to dominate government attention until 2022.
According to Jonathan Reiber, who served as the Office of the Secretary of Defense's chief strategy administrator for cyber-policy during the Obama administration and is now the senior director of cybersecurity strategy and policy at AttackIQ, the federal government is currently working to determine where resources can be most effectively deployed to shore up cyber-defenses.
Congress will most likely focus on national security risk analyses, according to Reiber.
"Trends show that the federal prioritizing debate in Congress will take the form of macro-level catastrophic risk research to manage the country's top-tier threats," he continued.
"Congress will consider how the federal government can assist in the management of systemic cybersecurity threats to the United States' economy and society, including mission-critical functions in key sectors such as healthcare, elections, and energy, building on previous research of companies across the country that could pose a strategic risk to the country if disrupted."
- Social-Engineering Endures
People will still be people in 2022, and they will, for the most part, do what is easy, regardless of the impact on the security posture of the company. And cybercriminals will continue to rely on it to carry out their social engineering schemes.
Otherwise, serious people might be incredibly irresponsible during their working hours, and this is unlikely to change anytime soon.
"Everyone is responsible for cybersecurity, but few people realize how much harm their actions may inflict."
In addition to the frequently recommended user training, Wiacek urged that cybersecurity experts adapt their approach to internal communications in 2022.
"Most protection teams have a standing for saying 'no.'" Instead, they must develop a reputation for saying 'yes.' Building a good security culture involves relationships, trust, and a strong passion for the customer experience – even if that customer is John in accounting."
Jason Hoenich, vice president of service delivery and security awareness at Arctic Wolf, agreed that security teams can do more to encourage employees to back their cause.
- Supply Chain is the New Ransomware
According to Ian McShane, field CTO at Arctic Wolf, the industry will begin to adjust its perspective on ransomware this year, realizing that the problem is not the ransomware itself, but rather the access point.
"We'll move our attention away from what to do after an attack and toward how to anticipate and safeguard the first line of defence with data," McShane said. The amount of supply-chain ransomware assaults is unlikely to reduce in the next 12 months, according to Deepen Desai, Zscaler's CISO and vice president of security research and operations.
McShane also recommended the industry embrace disclosures more fully.
The people who are most commonly exposed to supply-chain assault vectors are ordinary people.
In 2022, Troy Gill, senior manager of threat intelligence at Zix | App River, predicts that emails will become more targeted.
- Ransomware-as-a-Service Actors Pivoting to SMBs, Prospering
Ransomware-as-a-Service, which focuses on small and medium-sized businesses, has contributed to the expansion of digital extortion, and 2022 is predicted to be another banner year for ransomware threat actors.
"Cyber attackers have created it quite obvious that they make no distinction based on the magnitude of their targets," McShane added. Small and medium-sized enterprises that are underfunded and understaffed are attractive targets for ransomware gangs since the government and large corporations invest heavily in cybersecurity.
- Cybersecurity Industry Needs Better Coordination in 2022
Over the previous year, threat groups have shown their resilience by banding together to solve problems with increased cooperation. Cybersecurity? Not in the least.
"Threat actors are ready to band together for mutual success," Gill added, citing the emergence of malware-as-a-service and phishing-as-a-service. For example, when law enforcement shut down Emotet in January, TrickBot stepped in to assist "began re-seeding Emotet conditions in order to get them back up."
According to Gill, even cybercriminals' adversaries appreciate the significance of a robust ransomware market capable of perfecting their weapons and producing noise to hide behind.
"As a result, we hope cybercriminals will make even more solid working relationships in 2022 to help them continue to succeed," Gill stated. According to Ian McShane, the cybersecurity community still has work to do to enhance the overall ecosystem. This means that, among other things, larger organizations share tools.
Airzero Sec's Cyber Security Consulting professionals have worked on projects for some of the most well-known companies in the world for years. Use the information as needed, whether it's to help you get there or to perform technical checks. Please contact us if you have any questions concerning this issue.
Email:[email protected]
Author - Johnson Augustine
Ethical Hacker and Data Security Researcher
Founder: Airo Global Software Inc
LinkedIn Profile: www.linkedin.com/in/johnsontaugustine/