In a lot of ways, 2022 has been very much like many of the past five or so years. CVEs published to the National Vulnerability Database are on track for another record year in terms of volume. Ransomware actors have been as audacious as ever, with the extra frisson of geopolitical conflict in the mix. And organizations continued to struggle as threat actors took advantage of new working patterns normalized during the pandemic.
There are many ways to slice and dice 2022. But here are my top five standout trends – and most importantly, the takeaways that organizations can use to enhance corporate security for 2023.
Ransomware attempts may have dipped slightly from a record-breaking 2021, but that still equates to hundreds of millions of attacks in the year through October. Moreover, year-on-year volumes increased in the UK (20%) and EMEA (38%) during that period. As long as the ransomware-as-a-service (RaaS) model continues to generate profits, and affiliates and developers remain sheltered by hostile states, it’s difficult to see an end in sight. Some Australian politicians have suggested banning payments to the criminal groups behind attacks. But in reality, that would simply send reporting underground – and may even incentivize attacks on critical service providers.
Instead, the best response IT leaders can follow is best practice cyber-hygiene combined with enhanced user awareness programs and Zero Trust.
Many of us still don’t take the threat from inside our organization seriously enough. Usually, it’s down to negligence rather than intended malice. But that doesn't mean it’s without impact. More concerning still is the fact that younger workers look more likely to take risks with company data – such as failing to apply updates on time, reusing passwords across professional and personal accounts, and taking personal device security more seriously than corporate device protection.
Hybrid working will accentuate these trends as workers have more latitude to follow their own rules on security at home. Policies will need to be rewritten to align with this new reality, underpinned with the right technologies and user education. From multifactor authentication (MFA) to Zero Trust and secure access service edge (SASE) deployments, security controls must be both powerful and virtually friction-free.
Ransomware and state-sponsored attacks undoubtedly garnered the most column inches this year. But that’s not to say these were the only threats facing corporations. Less sexy but just as important are application and cloud security. Exploitation of web app vulnerabilities like SQL injection attacks are a favorite of hackers, potentially providing a direct route to lucrative customer and employee data. And as APIs become an increasingly important part of digital transformation, they’ll gain favor with threat actors looking to hijack accounts, steal data, and more.
A report out this year revealed that 95% of organizations experienced an API security incident over the previous 12 months, with 12% suffering over 500 attacks per month on average. It’s time to get serious about securing this part of the digital environment.