By Jaime Coreano, Vice President of Sales – Flexxon
The annual cost of cybercrime is set to hit $10.5 trillion by 2025. The losses caused by theft, fraud and embezzlement are compounded by the disruption that follows. Forensic investigations, restoration and deletion of hacked data and systems, lost productivity and, inevitably, reputational harm all add to the bill.
Of course, cybercrime is a shape-shifting enemy that quickly adapts to its surroundings. As more of our national, corporate and personal business goes digital, new threats emerge and priorities shift.
Fore-warned is fore-armed, however! So, to ensure we have the right cybersecurity technologies in place and carry out meaningful techstack reviews, here are the top five cybersecurity trends that X-PHY has identified for 2022.
#1: Firmware level attacks will increase
The much-cited Security Signals Report published by Microsoft in March 2021 noted that at least 80 percent of enterprises in major economies had suffered at least one attempted firmware attack in the previous two years.
Firmware attacks are daunting precisely because firmware sits ‘below’ the operating system, where the most common and familiar tools for detecting and quarantining malware cannot see them. But until now, firmware threats have not been treated seriously enough by enterprise security teams. As the Security Signals Report tells us, only 29 percent of security budgets were allocated to protect firmware.
That has to change.
There are many ways that firmware attacks can be launched against network devices and cause untold amounts of damage. Equally, there are plenty of basic housekeeping and security steps that can eliminate a number of potential vulnerabilities. AI-enabled security at the firmware level for example, allows real-time data protection against all sorts of software-based malware, ransomware, and viruses without human intervention.
#2: More firms will be subject to an inside job
The measures security professionals take to narrow the attack surface are based on the simple idea that the threat is ‘out there.’ But this focus on preventing and detecting external attacks can create a significant blind spot: the threat from inside.
Whether from malicious intent or clumsy accident, trusted employees and partners can cause more damage than ever before. New ways of working and greater digital engagement change the nature of the company network and its assets. According to Ponemon Institute’s 2022 Cost of Insider Threats: Global Report the incident rate is up by 44 percent in the past two years, with costs per incident now at $15.38 million. There is little sign that this is slowing down.
In this environment, the zero-trust model – which leaves no room for protocol, courtesy or respect for seniority – treats every insider with suspicion. That means proper, multi-factor authentication for every access to every system or service, plus monitoring, logging and effective pattern detection to detect any anomalous insider behavior. It may be an uncomfortable idea for many, but it is a necessary one.
#3: Supply chains will be the big ransomware target
In July 2021, a medical management services provider in New York experienced a ransomware attack that affected more than 1.2 million individuals – one of the largest breaches of health data reported to the federal regulators in 2021.
We are all familiar with the threat of ransomware. What is changing is the number of cyberattacks – like this one – that target trusted third-party vendors who offer services or software that are vital to the supply chain, but which attack agents regard as softer targets.
IT decision-makers believe that these kinds of supply chain attacks are to become one of the biggest threats to their organizations in the coming year. But most have not vetted either their current or prospective suppliers in the past 12 months.
To stay ahead of it, now is the time for organisations to put a response strategy into place. Until they do, this will remain an attractive target.
#4: Increased risk for SMBs
The world has changed but the age-old mantra still applies: attack agents will always go for the easiest target. That is what is driving the growth in supply chain attacks – and is also behind the increasing frequency of attacks on SMBs.
In its 2020 Internet Crime Report, the FBI recorded 791,790 complaints of suspected internet crime among small businesses (300,000 more than in 2019), and total losses of more than $4.2 billion.
SMBs may not have the resources or expertise to protect themselves adequately, but they still have valuable information residing within their systems. That’s why they are subject to growing numbers of targeted and complex attacks.
In addition, the recent mass shift toward remote and hybrid working practices has seen people’s private and professional lives becoming intertwined, often resulting in a less than diligent approach to cybersecurity. With that, SMBs have experienced a jump in cyberattacks as a result of human error. In fact, human error is responsible for a staggering 95 percent of data breaches, an issue that has only been heightened by the effects of the pandemic.
As such, it has become clear that just like everyone else, SMBs need robust cybersecurity that includes all layers, from software to the physical and everything in between.
Enter, AI-infused cybersecurity solutions. AI has the power to reduce human intervention, allowing data to be secured without the need for extensive knowledge or training.
#5: Vulnerabilities in critical Infrastructure will be recognized
At the other end of the scale is critical national infrastructure, which is increasingly digitalized but reliant on security measures for control systems that were developed before data, sensors, and networking was embedded in core control systems.
Critical infrastructure is no more immune to the natural laws of cybersecurity than any other sector of the economy: surges in technological development create the perfect environment for cybercrime to flourish, and the targets with the highest value but weakest security will be top of the list.
An attack on just the building management system of just one New York City office block via a connected vending machine caused damage estimated at $350m. The economic impact of a severe cyber-attack on the US power grid could be at least $240bn.
But the motive to hit critical infrastructure isn’t just financial. It can be political too. Hacktivists, terrorists and foreign agents see energy grids, health systems, and transport logistics, as useful bargaining tools. Intelligent, bullet-proof solutions are needed, ideally a zero-trust architecture with AI-embedded cyber-secure SSD as the last line of defense.
This is X-PHY’s final, unofficial, prediction for 2022. Offense is getting smarter. So will the defense. This is the year that zero-trust architecture becomes the lens through which all cybersecurity solutions are viewed.
About the Author
Jaime Coreano is Vice President of Sales at Flexxon. As a Sales and Business Development executive with 25 years of experience in semiconductors, electronic components, and cybersecurity, his vision and strategy have greatly impacted the success of his clients in the Americas. Most recently, he has been involved in emerging Cyber Security solutions based on hardware level AI based protection against ransomware, data cloning, and physical attacks.
our company website https://www.flexxon.com/
