Cybersecurity Predictions for 2022: Ransomware, Supply Chains and Insurance

Filip Cerny, who works on enterprise application experience at Progress, looks back at a year in which cyberattacks were rarely out of the news and sets out what he expects organisations to face in 2022.

What 2021 left behind

Ransomware was the defining threat of 2021, Cerny notes. It spread widely and hit physical infrastructure as well as conventional IT services. Criminals kept using the rest of their repertoire too, including malware, phishing, business email compromise (BEC), data theft and cryptocurrency mining.

Supply chain attacks also drew headlines. Some went after software tools directly. Others targeted smaller companies within a supply chain as a way to reach bigger organisations, using methods such as phishing and drive-by malware.

Many analysts, he writes, expect attackers to apply what they learned in 2021 to make their campaigns considerably more powerful in 2022. The past year proved they can move fast on new opportunities and rework their methods, and that will not change even as defenders use the same lessons to strengthen their own protections. He picks out the following areas as the ones to watch.

Where the attacks will come from

Ransomware stays on top. Ransomware gangs have made a great deal of money and will keep going. Police are moving against the best-known groups, but because simple tools let even non-specialists launch attacks, Cerny expects new groups to take the place of any that are shut down. Many hostile states will also borrow ransomware techniques, with disruption as the goal in place of payment.

Patching remains critical. Updates and security fixes need to go out as soon as they are published. Criminals track newly released patches and immediately scan the internet for servers that have not applied them, which turns every unpatched server into what is effectively a zero-day opening. Cerny sees fast patching as essential in 2022 and after.

A hotter cyber Cold War. Some governments tolerate criminal gangs working from their territory, which has prompted other governments to warn that attacks coming from those places will be treated as terrorism. Countering ransomware has been placed on the agenda of summits between heads of state. Analysts expect the rhetoric to intensify in 2022, and some commentators suggest attacks on critical infrastructure or health systems could draw military responses against the gangs or against national assets.

Supply chain partners as the weak link. Attackers know supply chains are full of weak points that can be used to reach partner organisations. Cerny argues that company defences must therefore take account of the security posture of business partners and suppliers, since protecting only an organisation's own infrastructure and endpoints will no longer be enough.

More software supply chain attacks. Flaws in open-source tools and libraries, microservices and commercial software will remain both a target and a way in for capable attackers, and nation-state teams backed by hostile regimes will keep using the approach.

New ways of working, new targets

Remote and hybrid work. Most information workers are unlikely to return to an office-first routine as it was before the pandemic, so organisations will adopt more mobile endpoint technology. Security perimeters will stretch so far that the idea of a network perimeter will be close to meaningless. Attackers will go after mobile and home-based staff with both technical and social engineering attacks, and Cerny expects wider use of zero-trust networking and more frequent security awareness training in response.

Mobile devices. Phones and tablets are everywhere and hold a great deal of information attackers want. More apps built to steal that data will appear. Apple and Google both work hard to keep such apps out of their stores, but criminals are skilled at disguising malicious apps as ordinary ones, so controlling which apps may be installed on devices that connect to corporate networks becomes even more important.

Defenders' tools in criminal hands. Security firms run penetration-testing tools to find weaknesses in clients' networks, and many of those tools resemble what criminals use. Lately the traffic has started going the other way, with criminals adopting suites built for defenders, and many commentators expect more of this in 2022.

Hybrid attacks. Attacks that combine several vectors and techniques at once will become more common. Cerny's advice is that when one attack vector is found, organisations should assume other methods are also under way and have not yet been detected.

Machine learning on the attacking side. Researchers expect attackers to use ML systems to produce convincing text and images for fake sites used in phishing and other social engineering, and to run ML-driven brute-force password guessing more widely. Organisations will need fast ML-based security tools to support their human staff.

Skills, insurance and regulation

The skills gap widens. The pandemic made the worldwide shortage of skilled cybersecurity staff worse, with many people changing jobs or leaving the field altogether. HR specialists expect the shortage to deepen in 2022.

Cyber insurance gets harder to buy. The cost of ransomware will reshape the cyber insurance market. Companies wanting to take out or renew cover will have to show they have taken every possible precaution. Much higher premiums and deductibles were reported towards the end of 2021, and that trend is expected to continue. Industry experts think this pressure from insurers will push businesses to improve their security practices overall.

More regulation. As governments pay closer attention to attacks on critical infrastructure, they will also want to govern how affected organisations respond. Mandatory reporting of ransomware attacks and data breaches, and possibly a ban on paying attackers, are likely to become law in several countries during 2022.

Cerny expects 2022 to be another difficult year, and argues that security teams and managed security service providers should use these forecasts to prepare for it.