🚨 Cybersecurity in 2022 - what we learned this year so far
🚨 Cybersecurity in 2022 - what we learned this year so far
A few takeaways from an action packed first half of year.
It’s the 14th of July, which means we are halfway through 2022 and it’s a good time to think about what has been going on since the beginning of the year.
Here are the 3 biggest takeaways from 2022 so far:
Takeaway #1 - War goes Hybrid in Ukraine
Russia has been using a mix of Digital warfare together with on the ground troops to achieve its objectives in Ukraine. The modus operandi is identical on both fields: destroy critical infrastructure such as railways, power grids or water supply systems.
Since March, Russia was associated with many attacks to critical infrastructure systems, sometimes at the same time as they attack physical infrastructure. An example happened back on 1st of March when a missile strike against Kyiv's TV tower coincided with widespread destructive cyberattacks on Kyiv-based media.
"We have seen the Russians having an integrated approach to using physical and cyberattacks, in an integrated way, to achieve their brutal objectives in Ukraine," senior White House cybersecurity official Anne Neuberger told a conference (Reuters).
Defending how they can
One of the ways Ukraine tried to defend its systems was to send important Government data abroad. Recently, they moved ca. 10 Petabytes of data to AWS in order to safeguard government records. This project conducted together with Amazon’s teams resulted in president Volodymyr Zelenskyy awarding AWS the Ukraine Peace Prize for the support AWS has shown the Ukraine government and the Ukrainian people.
If there’s uncertainty about how the war is going to evolve, one thing is a fact: it will continue to be fought digitally and on the ground.
💡 It’s a good time to reconsider the location of your data, not only because of Russia but also to avoid similar situations in other regions of the globe.
Takeaway #2 - Governments turned (more) serious on Cybersecurity
After the war started at the end of February, the White House published recommendations to companies together with a budget increase to support Cybersecurity initiatives. With the communication also came a fact sheet with many measures that Companies need to apply: multi-factor authentication, data backups and encryption, etc.
Following this announcement, on 13 May 2022, the EU also agreed on measures for a high common level of cybersecurity across the European Union. The initiative is called NIS2 that includes the following measures:
Risk analysis and information system security policies
Incident handling (prevention, detection, and response to incidents)
Business continuity and crisis management
Supply chain security
Security in network and information systems
Policies and procedures for cybersecurity risk management measures
The use of cryptography and encryption
The NIS2 also talks about consequences for non-compliant actors:
Fines up to 10 million EUR or 2% of the total global annual turnover
Management liability
Temporary bans against managers
Designation of a monitoring officer
Sources:
💡 This Government push will certainly be translated in increased costs for companies. Make sure to budget accordingly.
Takeaway #3 - Tech companies are betting in Cybersecurity
As cybersecurity gains importance in companies and governments, corporations like Google and Microsoft are trying to cement their positions in this market by expanding their service offering.
The acquisition of Mandiant by Google for 5.4 billion was one of the biggest industry news of the first half of 2022. Meanwhile, Microsoft released three new managed services: Defender Experts for Hunting, Defender Experts for XDR, and Security Services for Enterprise.
Satya Nadella's company also created a new Security, Compliance, Identity, and Management organization and added that “Security is a top priority for every organization undergoing a digital transformation”.
💡 If you are an IT Manager, two things look clear a) your technology partners will try to sell you new products and b) this publicity will increase Cybersecurity awareness at management level which will likely result in more questions being asked. Be prepared.
Extra: things I’m looking for in the second half of 2022
The first half of 2022 brought novelties in the Cybersecurity landscape that likely resulted in a shift of priorities for a lot of people. Assuming the second half will be at least as fun, here’s a few things that are going to matter in the rest of this year:
Compliance and regulations efforts from governments will likely increase costs to companies in the EU
Phishing will still be the first vector of attack
Raising threats from multiple dimensions are making it hard to decide where to allocate resources. Prioritization is key
Supply chain attacks
Rethinking data location as companies think if the service cuts happening in Russia can also happen somewhere else
To finish on a positive note: according to SonicWall, from mid-2020 to 2021, the number of CEOs who said cybersecurity risks were the biggest threat to short-term growth nearly doubled. This reveals how high-profile the issue has become. You batter have your responses ready.