Cyber threats in 2022 run the gamut of risk

“That’s why it’s so important to make sure you’re preventing threats by securing your perimeter. But you also need the capabilities to detect potential threats and respond in real-time if you suspect you’ve been breached. Unfortunately, a large number of businesses still aren’t adequately protected against today’s sophisticated threat landscape. If you don’t have the internal cybersecurity staff or expertise to maintain 24/7/365 coverage, you might want to seek out a managed security services provider to supplement your own team’s efforts.”

Kevin Hanes, the CEO of Cybrary, a cybersecurity professional development platform that offers hands-on experiences to gain real-world cyber skills, insists that ransomware attacks will continue to increase, and someone finally pays the full price for meeting demands.

“Even though ransomware attacks over the past couple of years have been bad, they were only the tip of the iceberg. Given the extensive financial motivations for ransomware gangs and their utilization of insider threats, even current legislation and the Biden Administration's cybersecurity executive order aren’t going to prevent companies from trying to discreetly meet their demands,” Hanes says. “That being said, as organizations weigh the risks of guaranteed pain now versus potential repercussions later, someone is going to be made an example of by the federal government in short order. Not knowing the law won’t be an excuse and, although jail time is unlikely, there will be organizations that are indicted in order to make them think twice about paying these criminals in the future.”

“With insurance payouts becoming both more frequent and more costly, the cost of cyber insurance has already skyrocketed. Prices rose 96% in the US and 73% in the UK for the third quarter of 2021 compared to the same quarter last year. We expect continued increases in 2022. Moreover, insurance policies will require the implementation of critical controls that reduce the risk of cybersecurity incidents. With attacks becoming increasingly common, insurance companies will pay in exceptional cases only,” Sotnikov says.

Chasing the Bad Guys with New Tech and Methods

Cybercrime has become a global enterprise, and with it, the organizational threats have expanded, and the villains become more covert. 2022 figures to see an increase in criminal activity and state-sponsored hacks.

With these emerging global challenges, organizations will need to step up their risk mitigation game and prioritize how they manage cyber risk, preaches Sotnikov.

“We are in a new era of advanced technologies that can be used for both good and evil,” says Sotnikov. “Simply put, organizations need to focus on securing their most important and valuable assets from the most likely incidents and update their policies regularly. It is increasingly obvious that cyber insurance is not a lifebuoy. Risk assessment is primarily our own responsibility.”

“This will be specifically for advanced phishing attacks that will target organizations’ users across multiple different applications, not necessarily using e-mail. Attackers will put a significant effort into building organizational employee mapping, based on crawlers on social networks, blogs and forums, and collective points of interest, and build more robust and targeted successful campaigns, which will target the users in multiple areas, by simple usage of ML and many impressive results,” he insists.

“The Biden administration is betting on Zero Trust as a primary means for defending against the industry-shattering cyberattacks that have occurred over the past year. However, for companies to achieve Zero Trust, they’ll need to shift away from siloed security approaches. Fifty-one percent of security professionals are using more than 25 different systems for identity management, which makes it challenging to manage access, especially in a remote work environment. To make Zero Trust a reality, organizations will need to consolidate their approach to create a unified security strategy that accurately verifies access and limits attack surfaces,” states Chinski.

He asserts that identity security will become all the more vital as the “metaverse” gains traction.

“The ‘metaverse’ is not a new concept. But as the pandemic continues to trudge on and more organizations turn to digital-native and digital-first platforms to fuel everyday communication, work, life and commerce experiences, the identity landscape will continue to grow exponentially – opening up new gateways and threat vectors to potential bad actors. Eighty-four percent of business leaders agree that the number of digital identities their organization manages today versus 10 years ago has dramatically increased,” continues Chinski, remarking that it is 0 times more than a decade ago. “What’s more, 95% of businesses report challenges managing the number of identities that currently fall under their organization’s umbrella (human, digital, RPA, etc.). As adoption of the metaverse increases, identity security and management issues will only become more profound – and a bigger threat to business resiliency.” 

Keith Driver, the CTO at Titania echoes Chinski’s declaration that Zero-Trust policies will now be zero-tolerance ground rules.

 “In the next year, perimeter-only defenses will no longer be fit for purpose. We have seen numerous recent cyber events breaching perimeter defenses. Network owners must assume that perimeter defenses will be compromised, and that means they must defend the internal/core network as if each node was a perimeter node. There will be a zero-tolerance policy for not implementing a zero-trust architecture,” Driver says. “A Zero Trust paradigm requires network owners to address each network asset individually and ensure it is operating within security and compliance policy requirements. Furthermore, in the coming year, network managers are going to need to continually assess all devices rather than assume they are in an acceptable state as configurations change which often results in unintended security and compliance errors.”

The Lines Have Blurred

Cybrary’s Hanes contends that the line between cybercrime and nation-state attacks will continue to blur.

“Following a cyber-attack or data breach a couple of years ago, threat intelligence companies could often assess the breadcrumbs left behind by attackers and make a reasonably accurate determination of who was behind it. This was largely in part because certain threat actors often have a ‘playbook’ that drives how to operate,” explains Hanes. “However, given the common rebranding of ransomware gangs and criminal organizations using the same tactics, techniques, and procedures (TTPs) as nation-states, some of these attacks are becoming indistinguishable from each other. Additionally, a single threat actor isn’t solely responsible for various attacks, but rather a group that all have a hand in it.”

“Since the pandemic began, our way of working has been flipped on its head. With a hybrid and remote working environment, organizations have a more spread-out workforce to protect under Duty of Care, widening their footprint for crisis impact. We’re living in business unusual. This requires more agility than ever before, and in the next year, operational resiliency will reach a fever pitch in the boardroom,” predicts Herrington.

He also figures that the landmark events of the last 20 months have made the inevitability of cyber and physical convergence a reality.

“Security attacks like the Colonial Pipeline attack that happened this year (2021) showcased that physical and cybersecurity will ultimately converge – and we anticipate more cyber-attacks on critical infrastructure ongoing. Organizations will need to rethink how they manage security incidents and allow for more collaboration across physical and cybersecurity to ensure operational resilience. Cyber teams have the SOAR framework to automate and orchestrate an incident response. Physical security will need to create a similar framework to keep up with these threats,” concludes Herrington.

Sotnikov also warns that attackers will use residential home networks as their infrastructure, knowing that a home network is much easier to infect with malicious software than a professionally secured enterprise IT environment.

“With processing power and bandwidth connectivity in residences increasing, home networks will become more attractive to bad actors. For example, by infecting many devices, they will be able to change IP addresses or even domain names dynamically during malware campaigns, thwarting common defenses like IP blocking and DNS filtering. IT teams should keep this new threat vector in mind when reviewing their security strategies and incident response plans. Moreover, the IT industry should seek to increase user awareness and best practices adoption to reduce the number of easy victims,” he warns.

And Here We Are

Ira Winkler, cybersecurity expert, author, industry speaker and the CISO of Skyline Technology Solutions, encapsulates our look ahead in relatively simple terms.

“When we look at the Colonial Pipeline, we need to ask ourselves: why is this attack any different than Code Red, Nimda or even the Morris worm? Why didn’t anyone stay awake after those so-called wake-up calls? There is no revolutionary new attack so to speak - it’s just an evolution – simply just a progression of using available technologies to refine malware,” he reckons. 

“Regarding the potential for a cyber doomsday or similar, here is the reality of the situation as I see it: there will likely be massive cyber-attacks in one way or another in the future - much like all of Facebook going down. Can someone get into a power grid and do bad things? Yes. However, people need to realize there is resiliency. I do not think in the next 5-10 years, we will be put back into the stone age or see a ‘digital Armageddon.’”

About the Author: Steve Lasky is a 34-year veteran of the security industry and an award-winning journalist. He is the editorial director of the Endeavor Business Media Security Group, which includes magazines Security Technology Executive, Security Business and Locksmith Ledger International and top-rated webportal SecurityInfoWatch.com. Steve can be reached at [email protected].