{"id":892,"date":"2022-01-05T13:17:00","date_gmt":"2022-01-05T13:17:00","guid":{"rendered":"https:\/\/dev.cryptoloc.au\/?p=892"},"modified":"2023-10-03T06:15:55","modified_gmt":"2023-10-03T06:15:55","slug":"the-cybersecurity-trends-you-need-to-know-about-in-2022","status":"publish","type":"post","link":"https:\/\/127.0.0.1\/the-cybersecurity-trends-you-need-to-know-about-in-2022\/","title":{"rendered":"The cybersecurity trends you need to know about in 2022"},"content":{"rendered":"\n<p><em>By Jamie Wilson, Founder and Managing Director of Cryptoloc<\/em><\/p>\n\n\n\n<p><strong>In this article:<\/strong><\/p>\n\n\n\n<ul>\n<li><a href=\"https:\/\/cryptoloc.com\/blog\/the-cybersecurity-trends-you-need-to-know-about-in-2022#Rules\">Rules and regulations are coming<\/a>&nbsp;<\/li>\n\n\n\n<li><a href=\"https:\/\/cryptoloc.com\/blog\/the-cybersecurity-trends-you-need-to-know-about-in-2022#Responsibility\">Cybersecurity will be treated as a company-wide responsibility&nbsp;<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/cryptoloc.com\/blog\/the-cybersecurity-trends-you-need-to-know-about-in-2022#Professional\">Cybercriminals are becoming more professional, and more predatory<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/cryptoloc.com\/blog\/the-cybersecurity-trends-you-need-to-know-about-in-2022#Supply\">Supply chain attacks are set to escalate<\/a>&nbsp;<\/li>\n\n\n\n<li><a href=\"https:\/\/cryptoloc.com\/blog\/the-cybersecurity-trends-you-need-to-know-about-in-2022#Insurance\">Cyber insurance will become harder to obtain<\/a>&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>In 2021, no sector of the Australian economy was safe from cybercrime. From government agencies to family businesses, and every type of organisation in between, it\u2019s been one of the worst years on record \u2013 so it\u2019s important to stay ahead of the curve and be aware of what\u2019s coming down the pipeline in 2022.&nbsp;<\/p>\n\n\n\n<p>The explosion in remote work and the accelerated pace of digitalisation have opened plenty of doors for cybercriminals to walk through. The Australian Cyber Security Centre (ACSC) received a report of a cyber attack&nbsp;<a href=\"https:\/\/www.cyber.gov.au\/acsc\/view-all-content\/reports-and-statistics\/acsc-annual-cyber-threat-report-2020-21\" target=\"_blank\" rel=\"noreferrer noopener\">once every eight minutes<\/a>&nbsp;over the 2020-21 financial year, up from once every 10 minutes the previous year, and unfortunately, those attacks will probably only become more frequent in the new year.&nbsp;<\/p>\n\n\n\n<p>But when it comes to cybercrime, a little planning and preparation go a long way \u2013 so here are the trends your organisation should be focused on in 2022.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"Rules\">Rules and regulations are coming&nbsp;<\/h3>\n\n\n\n<p>One of the reasons that cybercriminals have been able to operate with virtual impunity is that they\u2019ve felt secure in the knowledge that technology has always been a step ahead of regulators.&nbsp;<\/p>\n\n\n\n<p>But with the total economic impact of cybercrime estimated at&nbsp;<a href=\"https:\/\/www.aic.gov.au\/publications\/sb\/sb34\" target=\"_blank\" rel=\"noreferrer noopener\">$3.5 billion in Australia alone<\/a>, and&nbsp;<a href=\"https:\/\/www.csis.org\/analysis\/hidden-costs-cybercrime\" target=\"_blank\" rel=\"noreferrer noopener\">$1 trillion worldwide<\/a>, the law is finally catching up to the threat these criminals pose \u2013 and in 2022, we can expect to see much greater regulatory pressure to address the risk of cybercrime.&nbsp;<\/p>\n\n\n\n<p>We\u2019ve already seen legislation for consumer privacy pick up steam, beginning with the EU\u2019s General Data Protection Regulation (GDPR) and followed by Brazil\u2019s General Personal Data Protection Law (LGPD) and the California Consumer Privacy Act (CCPA). It\u2019s a sure thing that jurisdictions around the world \u2013 at a national level, but also at a state and local government level \u2013 will continue to pass legislation along these lines.&nbsp;<\/p>\n\n\n\n<p>But that\u2019s just the beginning. In Australia, we\u2019ve seen the recent introduction of&nbsp;<a href=\"https:\/\/cryptoloc.com\/blog\/why-australia-enacting-emergency-cybersecurity-laws\">emergency laws<\/a>&nbsp;that require the operators of \u2018critical infrastructure\u2019 to report cyber attacks to the Australian Signals Directorate (ASD) as they happen. The laws give the ASD the power to plug into the networks of these organisations to help them fend off attacks.&nbsp;<\/p>\n\n\n\n<p>Those laws were just a prelude to a second bill, expected to be introduced in 2022, that will impose positive security obligations on businesses, requiring them to develop risk management plans and reach certain cybersecurity standards. Under these laws, company directors could be made personally liable for cyber attacks.&nbsp;<\/p>\n\n\n\n<p>I expect we\u2019ll also see the Government move to make the payment of ransomware illegal \u2013 Labor has already introduced a bill that would require ransomware victims to disclose whenever they make a payment, and my sense is that both sides of the aisle are keen to disincentivise and defund hackers by criminalising payments altogether. (Whether or not this would actually help victims is a more complicated question.)&nbsp;<\/p>\n\n\n\n<p>In their totality, these laws could make the regulatory landscape more confusing and\/or costly for organisations that aren\u2019t prepared for them. But they should also have the effect of raising the cybersecurity floor, and setting a new standard that, quite frankly, most organisations should be meeting already.&nbsp;<\/p>\n\n\n\n<p>In much the same way that tougher legal obligations made workplace health and safety a top priority for employers, we\u2019ll see businesses lift their game when it comes to cybersecurity, and start taking their stewardship of data more seriously in order to comply with new rules and regulations.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"Responsibility\">Cybersecurity will be treated as a company-wide responsibility&nbsp;<\/h3>\n\n\n\n<p>I was recently speaking to the CEO of a large organisation with 10,000 employees. I asked him how many people were in his cybersecurity team \u2013 \u201810,000\u2019, he responded, without missing a beat.&nbsp;<\/p>\n\n\n\n<p>That\u2019s the attitude every employer should have moving forward. Cybersecurity awareness and training for all staff will be absolutely crucial \u2013 because while not everyone on your team needs to be an IT professional or a cybersecurity specialist, everyone&nbsp;<em>will<\/em>&nbsp;need to be regularly briefed on the latest techniques being utilised by cybercriminals, and be aware of best practices.&nbsp;<\/p>\n\n\n\n<p>Businesses have never been more at risk, and the widening of attack surfaces that\u2019s resulted from the COVID-19 pandemic is a major factor. With more employees using more of their own devices, it\u2019s harder than ever to secure the perimeter.&nbsp;<\/p>\n\n\n\n<p>IBM and Ponemon\u2019s&nbsp;<a href=\"https:\/\/www.ibm.com\/security\/data-breach\" target=\"_blank\" rel=\"noreferrer noopener\">Cost of a Data Breach Report 2021<\/a>&nbsp;found that data breaches are 17.5 per cent more costly where remote work is a factor, and that organisations that have more than half of their workforce working remotely take 58 days longer to identify and contain breaches, on average.<\/p>\n\n\n\n<p>That\u2019s why every member of your team will need to be trained to&nbsp;<a href=\"https:\/\/cryptoloc.com\/blog\/employees-home-wifi-connection-data-risk\">make their connection more secure<\/a>, and made aware of the importance of updating passwords and patches, avoiding public networks, backing up data regularly, and recognising the signs of social engineering scams like phishing emails.&nbsp;<\/p>\n\n\n\n<p>It\u2019s always been the case that when it comes to cybersecurity, your people have the potential to be your biggest weakness \u2013 because if they can be tricked into granting access to an intruder, all the perimeter security and monitoring in the world won\u2019t be able to protect your system from being compromised.&nbsp;<\/p>\n\n\n\n<p>But now, with the ever-increasing interconnectivity and borderless nature of the modern workplace, it\u2019s more important than ever that every link in your chain is as strong as it can be.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"Professional\">Cybercriminals are becoming more professional, and more predatory<\/h3>\n\n\n\n<p>It\u2019s no secret that ransomware is on the rise. In June 2021, the Director-General of the Australian Signals Directorate told the Parliamentary Joint Committee on Intelligence and Security there had been a&nbsp;<a href=\"https:\/\/www.aph.gov.au\/Parliamentary_Business\/Hansard\/Hansard_Display?bid=committees\/commjnt\/27d1412f-0716-454a-9b40-c8e8276eb931\/&amp;sid=0005\" target=\"_blank\" rel=\"noreferrer noopener\">60 per cent increase<\/a>&nbsp;in ransomware attacks on Australian businesses over the previous 12 months.&nbsp;<\/p>\n\n\n\n<p>What\u2019s less understood is the fact that the organisations behind these attacks are becoming increasingly sophisticated. Rather than operating as lone wolves, hackers have developed&nbsp;<a href=\"https:\/\/cryptoloc.com\/blog\/cyber-crime-rise-of-cyber-cartel\">cyber cartels<\/a>&nbsp;that operate much like the mafia, collaborating as affiliates to pool resources, pass on stolen data, and exploit security vulnerabilities within hours of their disclosure.&nbsp;<\/p>\n\n\n\n<p>The tradecraft of ransomware is evolving at a rapid rate. In 2020, ransomware group REvil popularised the tactic known as double extortion, which not only requires organisations to pay a ransom to unlock their files, but also requires them to pay an additional ransom to prevent those files being leaked.&nbsp;<\/p>\n\n\n\n<p>The double extortion tactic quickly became ubiquitous, and has now evolved into&nbsp;<em>triple<\/em>&nbsp;extortion, in which ransom demands are also directed at a victim\u2019s clients or suppliers \u2013 a method we expect to see plenty of in 2022. In effect, ransomware has become less of a singular&nbsp;<em>attack<\/em>, and more of a series of rolling demands springing forth from the initial intrusion.&nbsp;&nbsp;&nbsp;<\/p>\n\n\n\n<p>Cyber cartels have also begun offering ransomware-as-a-service (RaaS) to would-be cybercriminals lacking the expertise to pull off attacks on their own, even going so far as to provide them with 24\/7 technical support, in return for a slice of the unskilled attacker\u2019s profits. This has effectively lowered the barrier to entry to the \u2018industry\u2019 \u2013 and the more cybercriminals are active, the greater the chance that your organisation may be targeted.&nbsp;<\/p>\n\n\n\n<p>A major factor in the increasing complexity and professionalisation of these cartels is that many of them operate freely within nation states that are willing to turn a blind eye to their activities, and even provide them with tacit support.&nbsp;<\/p>\n\n\n\n<p>These \u2018contract hackers\u2019 are carrying out state-sponsored activities, while at the same time extorting businesses for their own financial gain. In 2021, the United States took the unprecedented step of naming and shaming the Chinese government as the benefactors of the hackers responsible for the Microsoft Exchange attack \u2013 but the cyber cold war has only gotten hotter since then, and you can expect more high-profile breaches and raids on hospitals, universities and state-owned utilities in 2022.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"Supply\">Supply chain attacks are set to escalate&nbsp;<\/h3>\n\n\n\n<p>It\u2019s one thing to ensure your own organisation is secure. But in 2022, we can expect to see attacks on supply chains \u2013 including widely used software products and services \u2013 expand in scope and frequency.&nbsp;<\/p>\n\n\n\n<p>In 2021, the high-profile Solar Winds and Kaseya hacks helped to popularise this attack vector. Closer to home, a recent attack on external payroll software provider Frontier Software enabled hackers to access the records of&nbsp;<a href=\"https:\/\/www.abc.net.au\/news\/2021-12-10\/thousands-of-sa-government-employees-affected-by-cyber-attack\/100690564\" target=\"_blank\" rel=\"noreferrer noopener\">up to 80,000 South Australian government employees<\/a>, including their names, dates of birth, tax file numbers, home addresses, bank account details, remuneration and superannuation contributions. The records, which were stolen and published on the dark web, may even have included Premier Steven Marshall\u2019s details.&nbsp;<\/p>\n\n\n\n<p>The&nbsp;<a href=\"https:\/\/www.pwc.com\/gx\/en\/issues\/cybersecurity\/global-digital-trust-insights.html\" target=\"_blank\" rel=\"noreferrer noopener\">PWC 2022 Global Digital Trust Insights Survey<\/a>, which polled 3,602 high-ranking business, technology, and security executives around the world, found that 56 per cent of respondents are expecting a rise in breaches via their software supply chain in 2022.&nbsp;<\/p>\n\n\n\n<p>The advantage of this approach, from an attacker\u2019s point of view, is that they can compromise a large number of organisations in one hit, making the potential reward for a successful attack quite significant. The downside for you is that your organisation might be one of those affected, even if you may never have previously been on the attacker\u2019s radar.&nbsp;<\/p>\n\n\n\n<p>Given the high risk of collateral damage if a supplier falls victim to an attack, it will be up to organisations to closely scrutinise the security credentials and protocols of the third-party vendors they entrust with access to their data.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"Insurance\">Cyber insurance will become harder to obtain&nbsp;<\/h3>\n\n\n\n<p>Given the increasing frequency of cyber attacks, and the losses that organisations stand to incur if their data is compromised, it makes sense that cyber insurance has become highly sought after.&nbsp;<\/p>\n\n\n\n<p>The problem is that most insurers never had any real risk matrix for cybercrime, and therefore no real sense of what they\u2019d be left paying out. As ransomware has gone through the roof, they\u2019ve been left scrambling to put limits on the coverage they\u2019re willing to offer.&nbsp;<\/p>\n\n\n\n<p>Cyber insurance premiums for Australian businesses have&nbsp;<a href=\"https:\/\/cryptoloc.com\/blog\/why-are-cyber-insurance-premiums-going-up\">shot up by up to 30 per cent<\/a>, and are expected to keep rising in 2022. Some insurers are refusing to take on new clients, or capping their coverage at about half of what they used to offer.&nbsp;<\/p>\n\n\n\n<p>To obtain coverage at reasonable rates in 2022 and beyond, organisations will need to be able to demonstrate that they meet strict cybersecurity standards and are following best practices, which may include providing cyber security education for all employees, using multi-factor authentication, implementing zero trust policies, securely backing up and encrypting their data, and having data breach incident response plans in place.&nbsp;<\/p>\n\n\n\n<p>Of course, my stance is that cyber insurance should only be used as a last resort, and that organisations should have these policies and practices in place anyway \u2013 because if there\u2019s one thing we know for sure about cyber security in 2022, it\u2019s that cyber criminals aren\u2019t going to take the next year off, so you can\u2019t afford to, either.&nbsp;<\/p>\n\n\n\n<p><em>With its unique three-key encryption technology, Cryptoloc is the most secure way to store, share and transfer data. To show you take cyber security seriously, visit&nbsp;<\/em><a href=\"https:\/\/127.0.0.1\/\"><em>cryptoloc.com<\/em><\/a><em>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>By Jamie Wilson, Founder and Managing Director of Cryptoloc In this article: In 2021, no sector of the Australian economy was safe from cybercrime. From government agencies to family businesses, and every type of organisation in between, it\u2019s been one of the worst years on record \u2013 so it\u2019s important to stay ahead of the [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":1125,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/127.0.0.1\/wp-json\/wp\/v2\/posts\/892"}],"collection":[{"href":"https:\/\/127.0.0.1\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/127.0.0.1\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/127.0.0.1\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/127.0.0.1\/wp-json\/wp\/v2\/comments?post=892"}],"version-history":[{"count":2,"href":"https:\/\/127.0.0.1\/wp-json\/wp\/v2\/posts\/892\/revisions"}],"predecessor-version":[{"id":1134,"href":"https:\/\/127.0.0.1\/wp-json\/wp\/v2\/posts\/892\/revisions\/1134"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/127.0.0.1\/wp-json\/wp\/v2\/media\/1125"}],"wp:attachment":[{"href":"https:\/\/127.0.0.1\/wp-json\/wp\/v2\/media?parent=892"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/127.0.0.1\/wp-json\/wp\/v2\/categories?post=892"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/127.0.0.1\/wp-json\/wp\/v2\/tags?post=892"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}