Cybersecurity has always been a never-ending race, but the rate of change is accelerating. Companies are continuing to invest in technology to run their businesses. Now, they are layering more systems into their IT networks to support remote work, enhance the customer experience, and generate value, all of which creates potential new vulnerabilities.
At the same time, adversaries—no longer limited to individual actors—include highly sophisticated organizations that leverage integrated tools and capabilities with artificial intelligence and machine learning. The scope of the threat is growing, and no organization is immune. Small and midsize enterprises, municipalities, and state and federal governments face such risks along with large companies. Even today’s most sophisticated cybercontrols, no matter how effective, will soon be obsolete.
In this environment, leadership must answer key questions: “Are we prepared for accelerated digitization in the next three to five years?” and, more specifically, “Are we looking far enough forward to understand how today’s technology investments will have cybersecurity implications in the future?”
So let’s take a look at the most important and significant trends affecting our online security in the next year and beyond while throwing in some practical steps we can all take to avoid becoming victims:
Similar to the way in which it is used in financial services for fraud detection, artificial intelligence (AI) can counteract cybercrime by identifying patterns of behavior that signify something out-of-the-ordinary may be taking place. Crucially, AI means this can be done in systems that need to cope with thousands of events taking place every second, which is typically where cybercriminals will try to strike.
It's the predictive powers of AI that make it so useful here, which is why more and more companies will be investing in these solutions as we go into 2022. Unfortunately, cybercriminals are also aware of the benefits of AI, and new threats are emerging that use technologies like machine learning to evade the protective measures of cybersecurity. This makes AI even more essential – as it’s the only hope of counteracting AI-powered cyber-attacks!
The growing threat of ransomware
According to the UK National Cyber Security Centre, there were three times as many ransomware attacks in the first quarter of 2021 as there were in the whole of 2019. And research suggests that 61% of technology executives expect this to increase in 2022. Once again, we can largely blame this on the pandemic, and the growth in the amount of activity carried out online and in digital environments.
Ransomware typically involves infecting devices with a virus that locks files away behind unbreakable cryptography and threatens to destroy them unless a ransom is paid, usually in the form of untraceable cryptocurrency. Alternatively, the software virus may threaten to publish the data publicly, leaving the organization liable to enormous fines.
Ransomware is typically deployed through phishing attacks – where employees of an organization are tricked into providing details or clicking a link that downloads the ransomware software (sometimes called malware) onto a computer. However, more recently, a direct infection via USB devices by people who have physical access to machines is becoming increasingly common. Worryingly there has been an increase in these types of attacks targeting critical infrastructure, including one at a water treatment facility that briefly managed to alter the chemical operations of the facility in a way that could endanger lives. Other ransomware attacks have targeted gas pipelines and hospitals.
Education is the most effective method of tackling this threat, with research showing that employees who are aware of the dangers of this type of attack are eight times less likely to fall victim.
The Internet of Vulnerable Things
The number of connected devices – known as the internet of things (IoT) is forecast to reach 18 billion by 2022. One consequence of this is a hugely increased number of potential access points for cybercriminals looking to gain access to secure digital systems.
The IoT has long been recognized as a specific threat – attacks that have been identified in the past include hackers using connected household appliances like fridges and kettles to get access to networks, and from there go on to access computers or phones where valuable data could be stored.
As well as more widespread, in 2022 the IoT is also getting more sophisticated. Many organizations are now engaged in the development of "digital twins” – comprehensive digital simulations of entire systems or even businesses. These models are often connected to operational systems in order to model data gathered by them and may offer a treasure trove of data and access points to those with nefarious intentions.
In 2022 we will undoubtedly continue to see attacks on IoT devices increase. Edge computing devices – where data is operated on as close as possible to the point it is collected – as well as centralized cloud infrastructure is all vulnerable. Once again, education and awareness are two of the most useful tools when it comes to protecting against these vulnerabilities. Any cybersecurity strategy should always include a thorough audit of every device that can be connected or given access to a network and a full understanding of any vulnerabilities it may pose.
Cyber-security risk and exposure a key factor in partnership decisions
Any cybersecurity operation is only as secure as its weakest link, which means organizations increasingly see every link in a supply chain as a potential vulnerability. Due to this, businesses will increasingly use cybersecurity resilience and exposure as a determining factor in choosing who they will partner with.
This is borne out by research which predicts that, by 2025, 60% of organizations with use cybersecurity risk as a "primary determinant” when choosing who to conduct business with.
With more legislation following in the wake of the European General Data Protection Regulation (GDPR), such as the Chinese Personal Information Protection Law and the Californian Consumer Privacy Act, more organizations are at risk of potentially huge penalties if they make information security slip-ups. This means every partner that potentially has access to an organization's data or systems will be rigorously vetted. Businesses that aren’t able to answer questions about their cybersecurity arrangements or ratings will increasingly find themselves out in the cold.
Regulation starting to catch up with risk
For years, cybercriminals have acted with the knowledge that understanding – let alone policing – of their activities is weak due to the fast-changing nature of technology. With the cost of cybercrime to global economies set to top $6 trillion in 2021, this isn’t a situation that is sustainable. According to Security Magazine, 2022 is set to be the year when regulators pull out the stops in order to get on top of the situation. One consequence of this could be an expansion of penalties that currently only cover breach and loss to also cover vulnerabilities and exposure to potential damage. Another may be an increasing number of jurisdictions passing laws relating to making payments in response to ransomware attacks. We could also see a growing number of legal obligations handed to Chief Information Security Officers, in line with the responsibilities of Chief Financial Officers, in an attempt to limit the impact of data thefts, losses, and breaches on customers.
While this will inevitably increase the burden of those responsible for information security in businesses, in the long term, this will only be a good thing. Today, more than ever, building consumer trust is essential for organizations that want us to give them the privilege of access to our valuable personal information.