This blog is an excerpt highlighting just some of the cyber risk trends from the latest report, Cyber risk in 2022: a 360° view, produced together with the Voyager18 team. You can read it here.
The cyber threat landscape evolves rapidly. Over the past year, it is safe to say that security breaches, data leaks, and scams have become the norm.
Cyber risk management has grown as a challenge for security teams, especially with the increased dependence on remote work. The post-COVID reality has left organizations forced to modify their IT architectures and business operations to accommodate work-from-home initiatives.
Threat actors take advantage of these changes, including cloud computing, remote access, and other tools used to enable seamless operations.
However, as the threat evolves, teams struggle to keep up with attacks. It is concerning because the average cost of a data breach rose to $4.35 million, up by 2.6% from 2021.
The evolution of cyber risks has a substantial impact on cyber-security trends. This makes it critical for organizations to adapt quickly to respond to the latest threats. Below are just some of the cyber risk trends we saw in 2022:
- Malware on the rise
- Rise of ransomware attacks
- Zero-day attacks
- Remote code execution
- Attack surface expansion
- Digital supply chain risks
- Cyber-security mesh
- Zero trust
1. Malware on the rise
Malware attacks continue to plague businesses across industries. According to McAfee, malware and spyware represent the highest cost of damage for organizations, followed by data breaches. Malware attacks worldwide reached 2.8 billion during the first half of 2022. That number is almost half of the 5.4 billion malware attacks detected in 2021.
However, on the whole, malware attacks have fallen since 2018, when 10.5 billion cyber attacks were recorded worldwide.
2. Rise of ransomware attacks
Ransomware shows no signs of going away. In recent years, ransomware has grown into the most common and visible threat.
Ransomware encrypts the files on a system until the “ransom” is paid in cryptocurrency for a decryption key that is needed to restore access to those files. However, this does not always happen, even if the victim paid the ransom.
These attacks are evolving rapidly, incorporating new methods of attack and new ways to extort money from victims. Today, threat actors steal the data before encrypting it (in some cases, releasing part of the data on the dark web). Bad actors also threaten to initiate distributed denial of service (DDoS) attacks to apply more pressure on victims to make them pay the ransom demand.
Security teams seemed to be getting better at defending against ransomware attacks. During the second and fourth quarters of 2021, ransomware attacks decreased from nearly 189 million cases to 133 million. However, we have already surpassed that number in 2022, with a total of 236.1 million ransomware attacks in the first half alone.
3. Zero-day attacks
The first half of 2022 had a total of 18 zero-day exploits (and counting). Half of these exploits were preventable flaws left unpatched. The good news is that this number is significantly lower than the 80 zero-day exploits recorded in 2021, and almost 40% of all zero-day exploits recorded over the last decade.
This suggests that security teams are getting better at managing cyber risk. However, it’s best to avoid making connections between the decrease of zero-day threats and published vulnerabilities. The number of zero-days can vary wildly from year to year, as does the number of published vulnerabilities. However, this doesn’t necessarily mean that every one of these vulnerabilities will be exploited.
4. Remote code execution
As the name suggests, remote code execution attacks allow threat actors to execute malicious code on a device remotely. These attacks can lead to malware execution that provides the attacker with complete control over the compromised machine.
The rise of cryptocurrencies also drives remote code execution attacks. As much as 90% of these attacks were related to cryptomining.
5. Attack surface expansion
With hybrid working models on the rise, the attack surface is increasing daily. So it is no surprise that network attacks have grown to be more prevalent and severe. Edgescan reports that remote access exposures across the attack surface accounted for 5% of all exposures in 2022.
6. Digital supply chain risks
According to Gartner, as many as 45% of organizations around the world will experience attacks on their software supply chains by 2025. That number represents a three-fold increase from 2021.
Going forward, it is important for security teams and risk management leaders to strategize and prioritize digital supply chain risk. This approach will help put some pressure on software partners across the supply chain to demonstrate security best practices.
7. Cyber security mesh
Cyber-security mesh architecture is growing increasingly popular, as it offers a standard integrated security structure and posture to protect all digital assets in the cloud or on-premises.
According to Gartner, organizations that adopt cyber-security mesh architecture will help minimize the financial impact of individual cyber-security events by an average of 90%.
This cyber-security trend will be driven by security product consolidation, essentially accelerating the integration of security architecture components. As cyber risks evolve, cyber-security mesh architecture will help CISOs advance their roles to respond better to future security and cyber risk management challenges.
8. Zero trust
Zero trust is the best approach to mitigating risk in our new reality with a hybrid workforce. Zero trust helps mitigate cyber risk significantly by reducing the attack surface. However, security teams must keep up with the latest cyber-security trends and regularly update and patch their systems.
After all, according to Google’s Project Zero, 9 of the 18 zero-day vulnerabilities exploited during the first six months of 2022 were simply variants of previously patched bugs. This makes it important to maintain an up-to-date security posture that forces threat actors to start from scratch before trying to initiate an attack.
Looking beyond the trends
Recapping the biggest cyber risk trends of 2022 is a valuable exercise, one which provides a useful overview of some of the year’s biggest stories and challenges.
But as security practitioners, we’re often required to go deeper, which is why we’ve produced our latest report, Cyber risk in 2022 – a 360° view. With original research from our Voyager18 team, this report explores the stories behind the stories from the past year, and offers actionable recommendations for better security posture in 2023.
One last thing…
As technology evolves, so will cyber threats. In fact, the rapidly changing threat landscape and enterprise IT architecture has exposed organizations to significant security risks. Taking a proactive approach to cyber security is therefore critical to get ahead of the cyber risk trends..
Security teams can mitigate cyber risk and fortify enterprise infrastructure whenever they take steps to increase awareness and leverage cutting-edge security technology.
The Vulcan Cyber® risk management platform allows development teams to prioritize cyber risks and mitigate them collaboratively. Book a demo today.
