Over the last few years, the way we work has changed beyond recognition. According to McKinsey, “the overall idea of what a workplace is, and what it is for, needs to be reimagined”. But the way we work isn’t the only thing evolving. Along with the shift to a dispersed workforce, we’ve also seen a rapid move towards digitalisation and a mass migration to the cloud, writes Rob O’Connor, Cyber-security practice lead at Insight UK.
While businesses are busy reimagining the workplace, cybercriminals are even busier reimagining ways to steal data. They are taking advantage of the changing world of work to find new and ever-more sophisticated ways to launch attacks. In this fast-moving world, business leaders cannot afford to be complacent. These six must-know cybersecurity trends will help you stay one step ahead in 2022.
1.Privacy and trust can make or break your reputation
Businesses won’t be the only ones thinking about data security in 2022. The public are becoming increasingly savvy about the way businesses gather and use their data – and when they’re unhappy, they vote with their feet. Social media platforms that play fast and loose with personal data, for example, may find users clicking the unlike button.
That doesn’t mean that you shouldn’t use data to deliver a seamless and personalised experience. But there’s a thin line between providing a personalised experience and appearing to ‘stalk’ your customers with targeted ads. Be upfront about what data you’re collecting and how you are using it for the customer’s own benefit, and you’ll have a recipe for success.
2.Security models: out with the old, in with the new
The old security model, where an organisation’s security controls are hosted in a single data centre, is no longer fit for purpose. An enterprise that used to have 10,000 people located in ten offices across the globe, for example, now has 10,000 people working from 10,000 offices. Routing all those communications through a single data centre no longer makes sense. Increasingly, we will see organisations adopting a SASE (Secure Access Security Edge) model, where security is delivered over the cloud, much closer to the end user.
Under the SASE model, vendors will bundle cloud security solutions with their software suites – and as a result, companies will have to re-think the way they purchase software. Instead of picking and choosing individual pieces of software from different vendors, organisations will need to choose between multiple suites of solutions that may not interoperate very well. IT decision makers, business leaders and CISOs will need to work together to take a long-term view of which suite of software solutions (in terms of both productivity and security) will best meet company needs.
3.Dragnet cyberattacks mean that no business is safe
The SolarWinds cyberattack of 2020 showed just how sophisticated hackers have become. It began with the introduction of malicious code into a Texas-based software company’s system and went on to compromise a host of United States government agencies in “the largest and most sophisticated attack the world has ever seen,” according to Microsoft President Brad Smith.
But, alongside these highly targeted multi-stage attacks, cybercriminals are crawling the entire internet looking for any opportunity to compromise and steal data. This dragnet approach doesn’t care what your organisation does, it targets all businesses indiscriminately. Even if you don’t think your business is high profile, you should consider yourself a target.
Another growing threat is ‘double extortion’. In a standard ransomware attack, hackers encrypt the victim’s data, then demand a hefty ransom in exchange for the decryption key. But with double extortion, hackers also steal the data, and threaten to make it public unless they receive payment. So, even if you’ve backed up all your data in a safe environment, you could be at risk.
Defend yourself from this kind of threat by deploying CSPM (Cloud Security Posture Management) software, to constantly scan your cloud environments for weaknesses. Because if you aren’t scanning your cloud configurations constantly for security loopholes, you can be sure that the hackers are.
4.Developer decisions will enhance security
As businesses launch new applications at an ever-increasing pace, they need to re-think their approach to security. The old sequential process, where developers wrote code and then handed it over to security experts for testing, is too slow. In today’s world when new features go live every week, code often needs to go straight into production. To keep up with this rapid pace of change, developers need to build security into their code as they write it.
But you can’t expect developers to learn secure coding overnight. You need give them tools that align with their working processes and help them to detect mistakes during the coding without slowing down the process. And that means giving developers greater decision-making power when it comes to security spending.
5.Security is for all, not just IT
In 2022, IT teams will shift some of the more time-consuming security tasks to team leaders within the wider business. In the past, for example, the IT team would have regularly gone through a list of all employees to review their access permissions. Modern cloud-based productivity tools (such as Microsoft 365) enable IT teams to push these access reviews out to line managers, who are much closer to their teams and better placed to make the decisions.
Similarly, employees will become more involved in self-classification of the data they produce according to whether it is for internal or public use, or confidential. AI will guide them through this process. As with access reviews, this approach moves the security decision to the person who can best answer the question. So, as well as freeing up valuable time for your IT team, pushing security admin tasks back to team leaders will enhance security.
And responsibility doesn’t stop there. Now that working from anywhere has become the norm, all employees need to play a role in keeping the business secure by identifying and reporting phishing emails and unusual activity. Cybersecurity training – during on-boarding and as an ongoing education process – will become a standard business practice.
6.Trust nobody
In a world where your users and data reside outside the corporate network, location is no longer an indication of security. You need new ways to keep control of critical assets that lie outside of your traditional sphere of control. For example, how do you know it’s your CFO (along with all her access privileges) logging in? That’s where the zero-trust approach comes in. You must question any request for access to data or an application – regardless of where it is from.
As you plan your technology roadmap, consider which cloud-based solutions will best enable you to implement a zero-trust approach to security. Look for a provider that can help you implement SASE and maintain a comprehensive, identity-based approach to security.
