Hybrid Work Trend Ensures Another Year of Online Vulnerability
Secon Cyber predicts that 2022 will be another eventful year of vulnerability exploits, account takeover attacks, phishing and ransomware.
With the easing of Covid restrictions and much of the workforce back in the office, many people find themselves in the position of choosing between working remotely or splitting their time between the office and home.
“This work-life shift means organizations must continue to be vigilant and address multiple vulnerabilities that persist,” said Andrew Gogarty, Chief Security Evangelist at Secon.
“Over the past two years, organizations have rapidly transitioned to remote working and accelerated cloud adoption to ensure business continuity during the global pandemic. This everywhere access to critical business data has led to security vulnerabilities and created challenges in maintaining effective cybersecurity.
He says that as reports of multiple breaches and ongoing ransomware threats continue, Secon has highlighted ten top security risks that organizations face throughout 2022:
Ransomware : Ransomware continues to impact organizations and remains an ongoing concern. Many organizations have matured their backup and recovery approaches over the past few years with the goal of being able to recover their data and environments if ransomware breaks through defenses. Secon claims that this approach has helped affected organizations avoid paying ransom demands to recover their data. However, ransomware will continue to prevail as one of the most significant risks for organizations.
Cloud Violations: “The cloud helps organizations improve agility through accelerated application deployments, leverage automation and integrations to simplify operations, and ultimately reduce costs to increase revenue,” says Gogarty.
“As cloud adoption continues to increase throughout 2022, we expect an increase in unauthorized access and data breaches due to preventable security vulnerabilities presented by misconfigurations and human error. .”
Vulnerability exploits: The growth of zero-day exploits is likely to become a bigger issue for security operations teams to manage in the future. As a result, Secon expects to see increased adoption of Zero Trust in 2022 to help organizations eliminate their attack surface, control access to their data, and prevent lateral movement of threats.
Increase in Exact Spoofing Phishing: Since it requires little effort from threat actors and an improved click-through rate, Secon predicts an increase in exact domain spoofing phishing emails in 2022.
As more organizations adopt a DMARC “rejection” policy, the company expects to see an increase in similar domain phishing. For this reason, it is recommended that you continue with user awareness training to help users identify these types of emails.
The e-skills shortage continues: Resource constraints can limit an organization’s ability to reduce risk and detect and respond to cyber threats. Secon says to watch for an increase in the number of organizations outsourcing security operations tasks in 2022. It says most organizations will outsource vulnerability management, detection and response to help improve their cyber resilience and enable limited resources to focus on organizational priorities.
Internal threats: In 2021, the battle against insider threats has reached a new level of complexity, with reports of ransomware gangs openly seeking insiders to help them infect their company’s networks in exchange for generous commissions. Secon believes there will be an increase in the number of organizations leveraging User and Entity Behavior Analytics (UEBA) solutions in 2022 to improve their ability to detect and prevent insider threat activity.
Supply chain attacks: The supply chain remains an attractive target for criminal actors. This forces organizations to extend their risk management activities to their suppliers until 2022 and beyond. There will likely be more scrutiny in vendor cybersecurity questionnaires in the future.
The European Union Agency for Cybersecurity (ENISA) said that strong security protection is no longer enough for organizations when attackers have already turned their attention to vendors.
State sponsored activities: Cyberattacks are expected to play a greater role in global conflicts. With countless and untold covert cyber espionage skirmishes launched to seize sensitive information and peek into government and defense infrastructure, government-funded hacking operations will continue into 2022 and beyond. Thus, governments will likely come up with cybersecurity policies to have countermeasure capabilities and continue to educate organizations on improving cybersecurity resilience.
Fake news and misinformation: As many events begin to return, Secon says to watch for more fake news campaigns, troll and bot accounts, and rogue marketing distributed through social media sites and emails.
Fake news and misinformation is not just a problem for the government, as fake news is also used to lure victims to malicious websites. Adversaries can weaponize disinformation to disrupt their own agenda. Deep counterfeits are expected to have a greater impact in 2022, thanks to various applications, Web 3.0 and increasingly common AR and VR technologies.
Cyber Insurance: According to Secon, more organizations will invest in cybersecurity assurance in 2022. He says the process goes beyond a paper-based tick-box exercise; insurers will increase checks and validations to see how companies manage cyber risks and vulnerabilities, as well as their detection and response capabilities to minimize impact.
“2022 will be another eventful year full of vulnerability exploits, account takeover attacks, phishing and ransomware,” Gogarty says.
“Therefore, 2022 should be viewed as an opportunity to step back and examine the pivotal changes of recent years to see how visibility and control can be maintained to reduce business risk from cyberattacks.”