The continuous advancement of cyber threats has made the job of security professionals immensely difficult. The high pressure to keep the infrastructure secure in a dynamic and uncertain environment poses a more significant cybersecurity challenge for security professionals.
Given the surge in the number of cyber-attacks in the past two years, security professionals have been under constant stress to treat or mitigate them while facing scrutiny from the board. With cybercriminals continuing to advance their attacks, the pressure of new threats and breaches will continue to loom over security professionals. But, there is still hope.
As organizations understand the drastic impact a threat can have on their business operations, more and more enterprises are increasing their cybersecurity budgets. Additionally, the shortage of skilled professionals also means that organizations will have to up-skill their security professionals or seek outside consultants to help them address their cybersecurity issues. Since the cybersecurity environment continues to witness dynamic changes, there are certain trends that will define the overall impact it will have on organizations and security professionals. Here are three emerging trends security professionals should watch out for in 2022:
Also Read: Strategies to Enlighten Employees about Information Security
-
2022 will be an inflection point in an emerging cyber pandemic
“Looking ahead to 2022, it is critical to recognize that our digital economy has become fragile and faces an inflection point for how we adapt to a potential, if not already forming, cyber pandemic,”
says Chris Morales, CISO and Head of Security Strategy at Netenrich. He adds, “Organization attack surfaces have been growing continuously for years as data, infrastructure and applications shift to the center of business and society. This trend, along with continued hybrid work approaches, has resulted in IT and security teams losing their visibility into what devices have access to high-value data, the state of connected devices, and the applications on those devices. Meanwhile, the adoption of third-party tools that could help has been outpaced by increasingly well-funded and professionalized bad actors. Regardless, the answer to these problems will be unfulfilled with third-party services if the internal priorities, teams and operations are not aligned with the goal at hand. Enterprises would be wise to consider their shortcomings in these domains to ensure a strong security posture as they move into the new year.”
-
Creative use of cyber threat intelligence in litigation
“We expect some creative usage of cyber threat intelligence data in 2022,”
says Ilia Kolochenko, CXO at ImmuniWeb. He adds, “President Joe Biden’s Executive Order on Improving the Nation’s Cybersecurity expressly mentions the importance of sharing cyber threat intelligence among governmental agencies and private sector to bolster overall resilience and preparedness to continuously evolving cyber-attacks. Indisputably, modern cyber threat intelligence may be very different, spanning from unverified public threat feeds that generate useless noise and avalanche of false positives – to governmental TAXII servers vetted and curated by state or federal agencies with highly restricted access to the data. The more intrusion data is publicly shared, the more chances one has to scrutinize TTPs (Tactics, Techniques and Procedures), other shared data or its context and successfully infer some unobvious details or events that the disclosing party actually did not aim to share with the community. For instance, aggressive law firms that bring class actions in large-scale data breaches may ferret out invaluable evidence about reportable security incidents and intrusions that – for a reason – remain undisclosed. Be careful what you share in 2022.”
Also Read: Crime-as-a-Service is Getting More Advanced and Companies are not Ready
-
Find the bad, fix the bad
“The prevalent cybersecurity testing model that I call, ‘find the bad, fix the bad,’ will continue to dominate in 2022, and many organizations will remain steps behind the threat,” says Joe Vest, Tech Director – Cobalt Strike by HelpSystems. He adds, “If we could patch our way out of this problem, we would’ve solved security many years ago. Unfortunately, much of the advice and testing models keeps us steps behind the threat. There’s a great deal of time, money and energy spent designing and operating a security operations program. By only concentrating on fixing flaws, we just measure our ability to prevent – and 100% prevention is unrealistic. The motto, ‘prevent first, detect always,’ must be adopted as a core preset for secure security operations programs. Remember, the goal of security is not to stop a hack. The goal is to prevent, detect and respond to a threat actor before they successfully achieve their goal. It’s time we pushed back on the threat and moved beyond fixing the flaws.”
For more such updates follow us on Google News ITsecuritywire News
