Major Cybersecurity Threats and Challenges in 2022

Cybersecurity has been a major priority since the second half of the ‘1990s when the dot-com boom brought the world together via online channels. More than 20 years later, unprecedented events like COVID-19 pandemic contested elections, and spiking sociopolitical unrest have led to an explosion in the number and severity of cybercrimes over the course of just a few years. We’re likely to see security threats become more sophisticated and therefore more expensive over time: experts predict that the global costs of cybercrime will reach $10.5 trillion by 2025, up 15% from $3 trillion in 2015. Proactive protection is the key to avoiding a cybersecurity attack. Take a look at what experts say are the top cyber security threats facing the world in 2022, and learn what you can do to protect yourself and your business from becoming targets.

Social Engineering: Social engineering remains one of the most dangerous hacking techniques employed by cybercriminals, largely because it relies on human error rather than technical vulnerabilities. This makes these attacks all the more dangerous—it’s a lot easier to trick a human than it is to breach a security system. And it’s clear that hackers know this: according to Verizon’s Data Breach Investigations report, 85% of all data breaches involve human interaction. In 2022, we are likely to see social engineering attacks like phishing and email impersonation continue to evolve to incorporate new trends, technologies, and tactics. For example, cryptocurrency-related attacks rose nearly 200% between October 2020 and April 2021, and are likely to remain a prominent threat as Bitcoin and other blockchain-based currencies continue to grow in popularity and price.

Ransomware attacks: Ransomware attacks have become popular in the last few years and pose one of India’s most prominent Cyber Security challenges in 2020. According to the Cyber Security firm Sophos, about 82% of Indian organizations were hit by ransomware in the last six months. Ransomware attacks involve hacking into a user’s data and preventing them from accessing it until a ransom amount is paid. Ransomware attacks are critical for individual users but more so for businesses who can’t access the data for running their daily operations. However, with most ransomware attacks, the attackers don’t release the data even after the payment is made and instead try to extort more money. In a 2021 survey of 1,263 cybersecurity professionals, 66% said their companies suffered significant revenue loss as a result of a ransomware attack. One in three said their company lost top leadership either by dismissal or resignation, and 29% stated their companies were forced to remove jobs following a ransomware attack. Ransomware has only become more sophisticated, more widely available, and more convenient for hackers over time. In fact, cybercriminals can now subscribe to “Ransomware-as-a-Service” providers, which allow users to deploy pre-developed ransomware tools to execute attacks in exchange for a percentage of all successful ransom payments. The rise of RaaS means ransomware attacks are now significantly more affordable for small-time cyber criminals, which in turn means the number of ransomware attacks will only continue to climb.

Software Vulnerabilities: Even the most advanced software has some vulnerabilities that might pose significant challenges to Cyber Security in 2020, given that the adoption of digital devices now is more than ever before. Individuals and enterprises don’t usually update the software on these devices as they find it unnecessary. However, updating your device’s software with the latest version should be a top priority. An older software version might contain patches for security vulnerabilities that are fixed by the developers in the newer version. Attacks on unpatched software versions are one of the major challenges of Cyber Security. These attacks are usually carried out on a large number of individuals, like the Windows zero-day attacks.

Configuration Mistakes: Even professional security systems more than likely contain at least one error in how the software is installed and set up. In a series of 268 trials conducted by cybersecurity software company Rapid7, 80% of external penetration tests encountered an exploitable misconfiguration. In tests where the attacker had internal system access (i.e., trials mimicking access via a third party or infiltration of a physical office), the amount of exploitable configuration errors rose to 96%. In 2022, the continued combined impact of the COVID-19 pandemic, socio-political upheavals, and ongoing financial stress is likely to increase the number of careless mistakes that employees make at work, creating more exploitable opportunities for cybercriminals. According to a Lyra Health report, 81% of workers have experienced mental health issues as a result of the pandemic, and 65% of workers say their mental health has directly impacted their work performance. This strain will only exacerbate an existing issue: Ponemon Institute reports that half of IT experts admit they don’t know how well the cybersecurity tools they’ve installed actually work, which means at least half of IT experts already aren’t performing regular internal testing and maintenance.

Poor Cyber Hygiene: Cyber hygiene refers to regular habits and practices regarding technology use, like avoiding unprotected WiFi networks and implementing safeguards like a VPN or multi-factor authentication. Unfortunately, research shows that Americans’ cyber hygiene habits leave a lot to be desired. Nearly 60% of organizations rely on human memory to manage passwords, and 42% of organizations manage passwords using sticky notes. More than half (54%) of IT professionals do not require the use of two-factor authentication for access to company accounts, and just 37% of individuals use two-factor authentication for personal accounts. Less than half (45%) of Americans say they would change their password after a data breach, and just 34% say they change their passwords regularly. New in 2022 Thanks to an uptick in remote working, systems protected by weak passwords are now being accessed from unprotected home networks, sticky note passwords are making their way into public coffee shops, and workers are logging in on personal devices that have a much higher chance of being lost or stolen. Companies and individuals that don’t improve their cyber practices are at much greater risk now than before. Surprisingly, IT professionals often have even worse cyber hygiene habits than the general population: 50% of IT workers say they reuse passwords across workplace accounts, compared to just 39% of individuals at large.

IoT Attacks: According to IoT Analytics, there will be about 11.6 billion IoT devices by 2021. IoT devices are computing, digital, and mechanical devices that can autonomously transmit data over a network. Examples of IoT devices include desktops, laptops, mobile phones, smart security devices, etc. As the adoption of IoT devices is increasing at an unprecedented rate, so are the challenges of Cyber Security. Attacking IoT devices can result in the compromise of sensitive user data. Safeguarding IoT devices is one of the biggest challenges in Cyber Security, as gaining access to these devices can open the doors for other malicious attacks. Researchers predict that the number of smart devices ordered will double between 2021 and 2025, creating an even wider network of access points that can be used to breach personal and corporate systems. The number of cellular IoT connections is expected to reach 3.5 billion in 2023, and experts predict that over a quarter of all cyberattacks against businesses will be IoT-based by 2025.

Mobile Device Vulnerabilities: Another pattern caused by the COVID-19 pandemic was an uptick in mobile device usage. Not only do remote users rely more heavily on mobile devices, but pandemic experts also encouraged large-scale adoption of mobile wallets and touchless payment technology in order to limit germ transmission. A larger population of users presents a larger target for cybercriminals. Mobile device vulnerabilities have been exacerbated by the increase in remote work, which led to an uptick in companies implementing bring-your-own-device policies. According to Check Point Software’s Mobile Security Report, over the course of 2021, 46% of companies experienced a security incident involving a malicious mobile application downloaded by an employee. Cybercriminals have also begun to target Mobile Device Management systems which, ironically, are designed to allow companies to manage company devices in a way that keeps corporate data secure. Since MDMs are connected to the entire network of mobile devices, hackers can use them to attack every employee at the company simultaneously.

Machine Learning and AI Attacks: While Machine Learning and Artificial Intelligence technologies have proven highly beneficial for massive development in various sectors, it has its vulnerabilities as well. These technologies can be exploited by unlawful individuals to carry out cyberattacks and pose threats to businesses. These technologies can be used to identify high-value targets among a large dataset. Machine Learning and AI attacks are another big concern in India. A sophisticated attack might prove to be too difficult to handle due to the lack of Cyber Security expertise in our country.

Poor Data Management: Data management is about more than just keeping your storage and organization systems tidy. To put things in perspective, the amount of data created by consumers double every four years, but more than half of that new data is never used or analyzed. Piles of surplus data lead to confusion, which leaves data vulnerable to cyber-attacks. Breaches caused by data handling mistakes can be just as costly as higher-tech cybersecurity attacks. In a 2018 case, Aetna was ordered to pay $17 million after mailing sensitive health information in the wrong type of envelope. Due in part to the exponential explosion of data that’s taken place over the past decade, experts predict that 2022 will bring an increased shift away from “big data” toward “right data,” or an emphasis on storing only data that is needed. To sort right data from unnecessary data, teams will increasingly rely on automation, which comes with its own set of risks. Automated programs are like spiderwebs—a small event on one side of the web can be felt throughout the entire structure. And while the data processing itself relies on artificial intelligence, the rules and settings the AI is instructed to follow are still created by humans and are susceptible to human error.

Blockchain and cryptocurrency attacks: While blockchain and cryptocurrency might not mean much to the average internet user, these technologies are a huge deal for businesses. Thus, attacks on these frameworks pose considerable challenges in Cyber Security for businesses as it can compromise customer data and business operations. These technologies have surpassed their infancy stage but have yet not reached an advanced secure stage. Thus, several attacks have been attacks, such as DDOS, Sybil, and Eclipse, to name a few. Organizations need to be aware of the security challenges that accompany these technologies and ensure that no gap is left open for intruders to invade and exploit.

Insider Attacks: While most challenges of Cyber Security are external for businesses, there can be instances of an inside job. Employees with malicious intent can leak or export confidential data to competitors or other individuals. This can lead to huge financial and reputational losses for the business. These challenges of Computer Security can be negated by monitoring the data and the inbound and outbound network traffic. Installing firewall devices for routing data through a centralized server or limiting access to files based on job roles can help minimize the risk of insider attacks.

Third-Party Exposure: Cybercriminals can get around security systems by hacking less-protected networks belonging to third parties that have privileged access to the hacker’s primary target. One major example of a third-party breach occurred at the beginning of 2021 when hackers leaked personal data from over 214 million Facebook, Instagram, and Linkedin accounts. The hackers were able to access the data by breaching a third-party contractor called Socialarks that was employed by all three companies and had privileged access to their networks. In 2022, third-party breaches will become an even more pressing threat as companies increasingly turn to independent contractors to complete work once handled by full-time employees. According to a 2021 workforce trends report, over 50% of businesses are more willing to hire freelancers as a result of the shift to remote work caused by COVID-19. The cybersecurity firm CyberArk reports that 96% of organizations grant these external parties access to critical systems, providing a potentially unprotected access route to their data for hackers to exploit.

Conclusion

To protect your devices and data against cyber threats, you can adopt simple measures such as using the latest hardware and software or do Cyber Security Certification and training for your digital needs. You will also need to adopt advanced measures such as installing a firewall to add an extra security layer. We hope that this article, outlining the major challenges and threats of Cyber Security, has made you aware of the threats and hope that you will take corrective actions at an individual and organizational level to safeguard against such security problems.