Ask the Experts
The question: What are the most critical cyber threats of 2022? was posed to a panel that included Blue Team Alpha cyber experts Joe Kingland – CEO; Dan Wolfford – Deputy CISO; Peter Martinson – Director of Incident Response; and Sean Sullivan – Senior Incident Responder. Below is a summary of their responses based on their extensive working experience and knowledge in the field of cybersecurity.
What Are the Most Critical Cyber Threats of 2022?
Complexity of Systems
Computer systems these days are incredibly complicated, and most are comprised of a lot of different parts. Many people aren’t aware of the size of their digital footprint or the intricacies of the supply chain. Additionally, they don’t know all the software they have or the dependencies of that software. Together, this disconnect creates a problem of vulnerability in the cyber world. Systems become so complex that the humans involved with them can’t keep up, which leaves openings for vulnerabilities and then attacks like business email compromise.
Business Email Compromise (BEC)
While much of the notoriety and media attention goes to ransomware, BEC is a bigger cause for dollars lost. This is a trend that will likely continue because of how cyber insurance companies operate. They are getting stricter with what they will pay and how easy it is for a company to get cyber insurance. These insurance companies have a list of basic security measures that companies need to prove they have in place (like multi-factor authentication, end-point security, etc.) before the agents will write a policy.
Data Consolidation
Data consolidation is a systemic problem we predict will soon become a big issue. This is because when a large amount of data is put in one place, it becomes a crown jewel for hackers. A security apparatus designed to protect a massive amount of data in one place will be necessary to have to combat the risks that will come along with data consolidation, but will be very difficult to achieve.
Web 3 Technology Vulnerabilities
Most organizations are placing their attention security-wise on web 1 and 2 technology (older items like operating systems, social media, websites etc.). This means that when more modern technology and modern software are developed (web 3) like blockchain, open-source tech, etc., security is often not a key component of the initial design and is instead an afterthought. Based on this, these new web 3 technologies will likely see far more vulnerabilities, turning into more attacks on companies.
Humans
Humans remain one of an organization’s most critical threats based on the number of cyber incidents caused by employee error. Organizations need to properly train employees—especially when it comes to phishing (in 41% of incidents, phishing is the initial access exploit). Employees are a company’s first line of cyber defense, and they can only defend successfully if they are properly trained in security protocols and given the minimum level of access needed to do their jobs.
Accidental Aftereffects of Russia-Ukraine Conflict
There has been—and will be—a lot of spillover from the attacks between Russia and Ukraine. A technology, like malware, that one nation-state develops to use on another country gets released “into the wild” and can then be used on other organizations not involved in the original attack.
