LAST UPDATED Dec 14, 2021
We’re wrapping up another year and facing the inevitable questions of, what do you predict will happen in cybersecurity in 2022? What are the new trends? Honestly, looking ahead to 2022, I see more of the same. I expect cyberattackers will keep operating as they have been because what they’re doing is working, and they’re making money. Why change? Cyberattackers continue to find success with phishing and web app/API attacks that lead to ransomware and other financial gains, which continues to be the main goal of most threat actors. And they’re finding that success because organizations are still prioritizing functionality over security. We’re seeing that now with APIs, which organizations are rapidly deploying with a primary focus on functionality and release dates, and a cursory, at best, focus on security. In turn, APIs are becoming popular attack targets.
Additionally, many organizations simply don’t understand just how exposed they are, making it not only an enforcement issue, but an educational one as well. For example, while most companies are benefiting from the use of APIs, the majority also don’t realize how many are outdated, making it an easy access point for attackers. Unfortunately, organizations are often focused on building the next great piece of code, and may lose focus when it comes to sunsetting and deprecating their old API endpoints. If these aren’t properly removed, they can leave organizations with outdated, vulnerable endpoints that attackers can exploit to wreak havoc.
What will change this situation? Consumers demanding security would spur change, but that is unlikely. Standards or regulations, like PCI, could help, but in the end, ransomware, PII leaks, and other attacks resulting in financial loss are better motivators. In the past year, we’ve seen firsthand that organizations don’t worry about security until they’ve already had an incident.
Ultimately, as with most things in life, the solution isn’t easy, and it centers on prevention. Coding from the beginning with security in mind is the best weapon against cyberattacks and should be the goal of every organization. But that’s a big task that involves not only multiple teams, but often a change in workflows and processes. In the meantime, we like to say that we are your “best first step.” ThreatX gives you an immediate safe perimeter – with your systems secured from direct lines of attack via HTTP and HTTPS. Having built that perimeter, you can then take the time to conduct a full asset inventory, train your developers on defensive coding, and develop that deeper program of application security. A 2022 prediction I can make with 100% certainty: We won’t have a smaller attack surface or more complacent cyberattackers. Avoiding a breach requires security in depth, and we can help with the first step.
