More Predictions on Cybersecurity in 2022 – Part 3

2021 saw some spectacular cyber attacks, such as the colonial pipeline, the attack on a florida water supply company or the vulnerability in Microsoft’s Exchange server – not to mention the log4j vulnerability. Can we expect more of this in the coming year? We spoke to cybersecurity experts to get their opinion on what criminals will be up to in 2022.  

James Blake, field CTO security at Rubrik:

“One of the things that has become a greater presence with the rise of ransomware attacks is the commoditization of Ransomware as a Service (RaaS). The growing availability of RaaS is largely to blame for the vast increase in ransomware attacks. With these easy to access kits available on the dark web, there are more attackers without the heavy cyber skill backing that criminal groups have. This results in a more ‘sprayed attack’ approach rather than targeted attempts. With the increase of RaaS, solutions for recovery and cyber resilience will be even more crucial.” 

Companies need to focus on resilience to build the right level of capability to deal with ransomware efficiently and effectively as a business-as-usual activity.

Jason Stirland, CTO at DeltaNet International, is predicting a rise in phishing attacks: 

“Phishing is not going away anytime soon, and attackers will keep finding ways around new policies or procedures that are put in place. As a result, cybercriminals will continue to capitalise on the effects of the pandemic and have learnt this method is effective and pays well. With phishing attacks becoming increasingly sophisticated, there be a rise in email chain hijacking or conversation hijacking. This type of phishing is harder to spot. One of the best ways to combat any phishing attack is by regularly educating, updating and testing employees. If employees who are at the front line of an organisation’s interface can spot a phishing attack, this takes away a great deal of power from the attacker.”   

He also warns that even new forms of security, such as multi-factor authentication, will be attacked increasingly:  

“Attackers will be further looking to exploit those organisations that implemented two-factor authentication (2FA). 2FA is fast becoming the new norm for end-users. Attackers will be increasingly using this to perform ‘man in the middle’ attacks, which use phishing methods to trick users into going to fraudulent websites, gain their 2FA authentication information and then bypass the user’s 2FA. While organisations should ensure they are implementing 2FA, they must not forget to educate their users on spotting a phishing email or message when they receive one.” 

Chris Berry, CTO and GM of Security Solutions, PDI Software:

“In 2022, we’ll continue to see the proliferation of ransomware hitting all sizes of businesses. But we’ll also see an escalation of the ransomware attack model with extortionware. With more businesses maintaining secure backups to avoid paying a ransom to unlock encrypted data, cybercriminals are now threatening to publicly expose sensitive data.

Doing so can cause significant business risk, especially when the blast radius extends to customer, partner, or vendor data. That’s why it’s so important to make sure you’re preventing threats by securing your perimeter. But you also need the capabilities to detect potential threats and respond in real time if you suspect you’ve been breached.

Unfortunately, a large number of businesses still aren’t adequately protected against today’s sophisticated threat landscape. If you don’t have the internal cybersecurity staff or expertise to maintain 24/7/365 coverage, you might want to seek out a managed security services provider to supplement your own team’s efforts.”