As the COVID-19 pandemic extends into a new year, having a remote workforce will continue to challenge IT and security teams, cybersecurity experts predict.
The cyber pros who submitted predictions to SC Media say threat actors will use social media and social engineering to target employees and executives working from home to try to infiltrate corporate networks.
Recruiting and retaining cyber talent will also continue to be a challenge for the industry, while compliance and data leaks, including leaked chats, will prove a headache for human resources, say some experts.
Here’s how the experts predict the human side of the industry will play out in 2022.
Remote work
Home networks poses a threat to the crown jewels, says Nathan Wenzler, chief security strategist at Tenable:
“While threat actors have historically leveraged large-scale events like the Super Bowl or Tax Day to launch attacks on unsuspecting, distracted users, 2021 has changed the playing field. Now, remote work has become the perfect ongoing distraction for attackers to build social engineering attack campaigns around. After all, only one-third of remote workers strictly follow their organization’s security guidelines, and remote workers have an average of eight devices connecting to their home network, creating plenty of targets of opportunity for attackers to take advantage of.
“As we look ahead to 2022, threat actors will continue to take advantage of the opportunities that lie within this new world of work, setting their sights on compromising any device in the home network to get to the crown jewels on the corporate network. All it takes is one employee falling victim to a single, well-crafted social engineering stunt, which makes end users the perfect target for today's adversaries who are aiming for access to corporate networks, databases and other valuable assets.”
Threat actors will exploit the human layers, says Peter Bauer, CEO of Mimecast:
“After years of high-volume breaches combined with employees sharing excessively via social media, the trove of personal information and intelligence available to attackers is extraordinary and beyond disturbing. This will enable adversaries to craft even more convincing attacks. They will exploit the human layer aggressively, resulting in significant business disruptions and a corrosion of trust. Email and cloud communication systems continue to provide attackers the ideal venue for to target their victims.”
Remote work expanded the threat to organizations, says Moshe Zioni, vice president of security research at Apiiro:
“Remote work has been a challenge for many businesses. While some industries and enterprises have been fast to respond in order to retain business continuity, this actually exposed them to a more complex threat model. More specifically, this transition set a slew of new standards and highlighted more robust attack vectors that these organizations aren’t normally used to.”
Security teams will improve as leaders become aware of the hybrid threat, says Mike Heredia, vice president of EMEA & APA, XM Cyber:
“In 2022, leaders will become aware of the hybrid security threat. Organizations will improve their security operations approach to holistically perceive the threat and move beyond policy/compliance to security.”
Recruiting and retaining cyber talent
The industry must do more to train and mentor talent, says Tal Mozes, co-founder and CEO of Mitiga:
“…The industry has complained for years about the lack of talent in cybersecurity, and yet it’s not valuing new graduates and bootcamp students. Entry level jobs require three to five years of experience, leaving many students who learned how to pen test and hack with time on their hands and no job opportunities. Unless the industry finds ways to train and mentor these eager students — and helps them transition successfully into the field, they’ll find the cybercriminal industry all too ready to take them in.”
The shortage of talent will lead to automation and outsourcing, says. Boaz Gorodissky, CTO and co-founder of XM Cyber:
“A shortage of expert cybersecurity personnel will expedite the development of automatic systems capable of replacing humans or drastically reducing the need for human interaction. A growing number of companies will outsource their cybersecurity activities to protect critical company data from cyber threats.”
To overcome the cybersecurity skills gap, organizations will look for talent in more cost-effective locations across the U.S., says Andrew Maloney, co-founder and chief operating officer at Query.AI:
“The cybersecurity skills gap still exists and, according to research from Information Systems Security Association and Enterprise Strategy Group, 95% of companies believe the gap has not improved in recent years. Not only are there not enough skilled cybersecurity professionals to fill the number of vacant positions, but organizations are tired of battling the competitive talent pool in traditional tech hotspots, such as Silicon Valley and Austin. This frustration, in combination with the newfound remote workforce, will spawn a talent migration in 2022. And, we’ll start to see more organizations build out their teams and close the cybersecurity skills gap by tapping talent in more cost-effective locations across the U.S.”
Compliance and employee misconduct
Organizations will scrutinize video meetings and webinars for compliance and misconduct issues, says Devin Redmond, co-founder and CEO of Theta Lake:
“Based on compliance, security, and liability concerns, organizations will begin to broaden archiving and risk-centric review of video meetings and webinars across regulated employees as well as groups such as sales (pre-and post- sales), customer service, human resources, and legal teams.
“More examples of liability from leaked chats, online meetings, and similar digital channels will hurt organizations across industries. This is likely to include sensitive and private data from individuals as well as organizations along with examples of bad behavior leading to investigation, censure, employee termination, and more.
“Regulatory scrutiny of the controls for remote and hybrid working will proliferate worldwide as instances of misconduct, market abuse and data leakage come to light.”
