5 of the biggest threats to Cyber Security in 2022

The cybersecurity landscape has changed significantly over the past two years. The COVID-19 pandemic has changed the way in which many of us work and unfortunately, this has led to new opportunities for cybercriminals to take advantage of new working practices. In this post, we are going to take a closer look at some of the biggest threats to cyber security in 2022 and beyond and look at how this landscape has changed over the past two years.

One of the biggest challenges many businesses have faced is a change in working practices that have meant that it is has been difficult for them to operate as securely as they usually would. With employees based from home, securing personal networks for all members of staff is problematic. This has provided new challenges for cybersecurity teams and new opportunities for cybercriminals.

Despite the rise in the number of people working from home, many businesses have not adapted their cybersecurity policy to provide a “cyber-safe” remote-working environment.

Deloitte reported that “Prior to the pandemic, about 20% of cyberattacks used previously unseen malware or methods. During the pandemic, the proportion has risen to 35%.”

The report goes on to say, “Some of the new attacks use a form of machine learning that adapts to its environment and remains undetected.”

The sophistication of these attacks means that cybersecurity measures need to adapt and change as well. Businesses that are leading the way when it comes to cybersecurity are using AI and big data analytics to help cybersecurity specialists to identify threats, however, many businesses are simply not able to keep up with the ever-changing cyber threat landscape.

The Changing Landscape of Cyber Security

Before we get into some of the biggest threats to cybersecurity to look out for, we wanted to look at the cyber security landscape as a whole and assess how this has changed.

The non-profit Information Security Forum, which describes itself as “the world’s leading authority on cyber, information security and risk management,” warns in its annual Threat Horizon study of the increased potential for:

• Disruption — over-reliance on fragile connectivity creates the potential for premeditated internet outages capable of bringing trade to its knees and heightened risk that ransomware will be used to hijack the Internet of Things.
• Distortion — the intentional spread of misinformation, including by bots and automated sources, causes trust in the integrity of information to be compromised.
• Deterioration — rapid advances in intelligent technologies plus conflicting demands posed by evolving national security and individual privacy regulations negatively impact organisations’ ability to control their own information.

Cyber Security Professionals shortage

In this ever-changing landscape, with damage related to cybercrime set to be worth an estimated $10.5 trillion USD annually by 2025 (Source: Cybersecurity Ventures), the industry is suffering from a lack of cyber security professionals. CNBC reported in March 2019 that a serious shortage of cybersecurity experts could cost companies hundreds of millions of dollars.

According to the report, there were 2.93 million cybersecurity positions open and unfilled around the world. Here in New Zealand, Stuff reported that UCOL launched a new Diploma in Cybersecurity programme in February this year to help tackle the growing shortage of cybersecurity professionals. This came off the back of cyberattacks on leading NZ businesses in 2021 including New Zealand Post, Inland Revenue, MetService, ANZ and Kiwibank.

Without trained security staff, organisations do not have the right controls or processes to detect and prevent cyberattacks.

This lack of trained cyber security professionals creates an issue for cyber security worldwide and contributes to the five biggest threats to cyber security that we have highlighted below.

1.     Cloud vulnerability

According to the Oracle and KPMG Cloud Threat Report 2020,  cloud vulnerability is and will continue to be one of the biggest cybersecurity challenges faced by organisations as we head into 2022 and beyond.

As enterprises continue to rely more on more on cloud applications for the storage of sensitive data relating to their employees and business operations, the more they rely on the security of cloud-based solutions to keep that data secure.

This creates new problems for cyber security professionals as they are fighting cyber security threats across multiple areas of the business.

Back in 2019, Forbes predicted that 83 per cent of enterprise workload would be on the cloud by 2020. The reality, however, is perhaps not that straightforward. IBM reported in the same year that the transition to the cloud is not as simple as it might seem and that in reality, enterprises are only 2-0 per cent of the way into their cloud journeys. The actual number probably lies somewhere in between with Statista reporting that as of late 2020, 50 per cent of enterprises have workloads in the public cloud.

These organisations make tempting targets for malicious hackers. Data breach, misconfiguration, insecure interfaces and APIs, account hijacking, malicious insider threats, and DDoS attacks are among the top cloud security threats that will continue to haunt firms failing to invest in a robust cloud security strategy.

One such strategy that is becoming more commonplace as we head into 2022 is the adoption of “zero trust” cloud security architecture. Zero Trust systems are designed so that only authenticated and authorised users and devices and permitted access to applications and data rather than the old model of “access granted by default”.

2.     Social engineering

Social engineering remains one of the most dangerous hacking techniques deployed by cybercriminals as it relies on human error rather than technical vulnerabilities. Social engineering attacks can include phishing scams, deepfake attacks, ransomware and whaling attacks.

Phishing attacks are the most common type of social engineering attack. In a post by Tessian looking at the most common types of social engineering attacks, phishing scams made up eight out of the top 15 examples of social engineering attacks.

Phishing attacks, in which carefully targeted digital messages are transmitted to fool people into clicking on a link that can then install malware or expose sensitive data, are becoming more sophisticated.

Phishing is one of the oldest forms of cyberattack, and as employees and individuals have become more aware of the dangers of email phishing or clicking on suspicious-looking links, cybercriminals have had to up the ante.

Machine learning is now being used by cybercriminals to quickly craft and distribute convincing fake messages that can compromise an organisation’s networks and systems.

These types of attacks enable hackers to steal user logins, credit card credentials and other types of personal financial information, as well as gain access to private databases.

3.     IoT-based attacks

The number of internet-connected “smart” devices in homes and businesses are starting to increase. The problem is that not all these smart devices have strong security installed—creating openings for attackers to hijack these devices to infiltrate business networks.

FireEye’s annual threat report outlined the threat of IoT-based attacks, stating that:

“Reaper, a malware that exploited vulnerabilities in IoT devices to gain access and spread itself. The end result of these types of attacks is that threat actors can enlist millions of compromised IoT devices to drive largescale attacks, including the distributed denial-of-service (DDoS) attacks that commonly disrupt and take down websites, gaming, and other internet services.”

Simply put, an IoT attack is any cyberattack that leverages a victim’s use of internet-connected smart devices (such as Wi-Fi-enabled speakers, appliances, alarm clocks, etc.) to sneak malware onto a network. These attacks target IoT devices specifically because they are often overlooked when it comes to applying security patches—making them easier to compromise.

According to a report Kaspersky reported on IoT World Today, IoT cyberattacks more than doubled year-on-year during the first half of 2021.

From January to June 2021, some 1.51 billion breaches of Internet of Things (IoT) devices took place, Kaspersky reported, an increase from 639 million in 2020.

Kaspersky found that more than 872 million of IoT cyberattacks — or 58% – leveraged telnet, many with the intent of cryptocurrency mining, distributed denial-of-service (DDoS) shutdowns or pilfering confidential data.

With the number of IoT-connected devices continuing to grow, Gartner predicts that over a quarter of all cyberattacks against businesses will be IoT-based by 2025.

4.     Ransomware

Ransomware attacks are believed to cost victims billions of dollars every year, as hackers deploy technologies that enable them to literally kidnap an individual or organisation’s databases and hold all the information for ransom. The rise of cryptocurrencies like Bitcoin is credited with helping to fuel ransomware attacks by allowing ransom demands to be paid anonymously.

As we move into 2022, ransomware attacks are likely to focus more on businesses than individuals. As noted by ITPro Today, “The rate of detections within businesses rose from 2.8 million in the first quarter of 2018 to 9.5 million in the first quarter of 2019. That’s nearly a 340% increase in detections.”

In a 2021 survey of 1,263 cybersecurity professionals, 66% said their companies suffered significant revenue loss as a result of a ransomware attack. One in three said their company lost top leadership either by dismissal or resignation, and 29% stated their companies were forced to remove jobs following a ransomware attack.

One reason why businesses are being targeted more than private citizens now is that they have more money and motivation to pay ransoms.

Ransomware attacks generally involve the attacker infecting a victim’s systems with a piece of malware that encrypts all their data. The victim is then presented with an ultimatum—either pay the ransom or lose their data forever.

5.     Vehicle cyberattacks

As more cars and trucks are connected to the Internet, the threat of vehicle-based cyberattacks rises.

The worry is that cybercriminals will be able to access vehicles to steal personal data, track the location or driving history of these vehicles, or even disable or take over safety functions.

While the driverless car is close, but not yet here, the connected car is. A connected car utilises onboard sensors to optimise its own operation and the comfort of passengers. This is typically done through embedded, tethered or smartphone integration. As technology evolves, the connected car is becoming more and more prevalent; by 2030, an estimated 96 per cent of new cars will be connected to the internet, according to Statista.

The Verge reported one of the most high-profile IoT security breaches back in 2016. A pair of hackers compromised the Jeep Cherokee, taking complete control of the steering, braking and transmission. This was done as a testing experiment, but it highlighted the flaws with internet-connected devices and IoT security threats.

Summary

COVID-19 has heightened the threats posed by cybercriminals, however even before the global pandemic took control, many of these threats listed above, plus many more were already posing a threat to individuals and businesses throughout the world. Some of these other threats include:

• Third-party vendors, contractors, and partners
• Smart medical devices
• IoT attacks
• State-sponsored attacks
• Cyber-physical attacks
• Election security
• Disinformation in social media
• AI threats
• Deep fakes
• Data privacy

As a cyber security specialist here in New Zealand, we are often asked, “what is the biggest threat to cyber security?” and in these challenging times, there is no definitive answer other than to say that a lack of cybersecurity measures to tackle increasing sophisticated methods of attack is perhaps the biggest risk to companies.

A mentality of “it will never happen to me” is also a huge red flag as cybercriminals do not discriminate. Whether you are a multi-national or a small local business, every business is open to the threat of cybercrime without adequate defence mechanisms and policies in place.

If you haven’t reviewed your cyber security policy recently, now is the time to review the potential threats to keep on top of emerging methods of attack

We find ourselves in challenging times where the threat posed by cybercriminals is greater than ever. Currently, it is important to ensure that your own security is as tight as possible. If you want to talk about cyber security solutions for your business, get in touch with one of the team today and keep your business and employees safe from cybercrime.