Industry executives and experts share their predictions for 2022.  Read them in this 14th annual VMblog.com series exclusive.

A Safer Supply Chain,"Security First" and AI-Driven Detection and Response Will Empower Organizations

At this time last year we were saying farewell (or "good riddance!") to 2020 with hopes for a better 2021.  Our wishes came true, but of course nothing is perfect.

This extends to cybersecurity, a discipline that always requires new responses to new threats. Looking ahead to 2022, here are four predictions about the challenges to come, and the innovations which will help us meet them:

Organizations will defend an increasingly targeted supply chain. In terms of economic survival, they'll have no other choice. Supply chains/third-party relationships serve as an extension of the enterprise attack surface. In fact, 93 percent of companies have suffered from a breach because of supply chain and/or third-party vendor issues, with the average number of annual breaches rising from 2.7 per victim organization in 2020 to 3.7 in 2021. Fortunately, more of these companies are prioritizing the protection of their supply chain, with nine of ten indicating that they are boosting their budget for third-party cyber risk management.

This will be money well-spent, given that resources are increasingly moving to outside the organization. There are more people working from home than ever, for example, so chief information security officers (CISOs) need to think of these employees as a cog in the supply chain as well. They must incorporate strategies and day-to-day practices that defend their entire, global supply-chain ecosystem - all the way down to the small components which support operations - to avoid attacks and disruptions that bring very real and harsh economic consequences.

Cryptocurrency will go mainstream - as will cryptocurrency hacks. The global value of the cryptocurrency market has reached $2.37 trillion, surpassing the $2.33 trillion market capitalization of Apple. Major banks and governments are starting to dip their toes in the water, with lots of exploratory talks and efforts underway. Yet, cyber criminals go where the money is, so cryptocurrency is ripe for attacks - especially since it's difficult to secure something that very few people understand in the first place. In August, we saw one of the biggest cryptocurrency incidents ever when finance platform Poly Network was robbed of $610 million. In this case, the hackers actually returned the money to Poly Network. In 2022, victim organizations won't be so lucky.

Developers will commit to "security first." Why? Because they know that - every time they introduce a new version of an app or software - they could introduce a new exploit. Development is about discovery, after all, so they're constantly learning as they go . This community is slowly recognizing that thinking of security as an afterthought only encourages vulnerabilities, attacks and subsequently, damaging turbulence.

By committing to "security first," developers will build protection into products from the start instead of bolting it on after the fact. They'll come up with pocket-sized versions of detection - micro detection - that they embed into apps at the source. In this sense, we can think of these apps like tiny streams feeding into large rivers and, ultimately, oceans. You want to stop "pollution" at the stream level before it reaches the river, not after. The same thinking applies to the safeguarding of apps and software before they are widely distributed within our enterprises.

Artificial intelligence (AI)-enabled security will emerge as a "must have," as opposed to a "nice to have." CISOs and their teams know they can't keep up with threats on their own. They're getting blitzed every day with unknown attacks, with 1 billion malware samples out there and millions more on the way. They are also drowning in alerts, with 5,000 a day leading to a wealth of false positives. In 2022, they will come to the inevitable conclusion that they need to partner with AI machines to apply "super powers" to their monitoring, detection, prevention and mitigation capabilities.

Through sophisticated algorithms and predictive intelligence, AI systems instantly hunt down malware, run pattern recognition, and find and thwart even the slightest traces of attacks before they have a chance of doing any damage. In addition, they inform teams of new anomalies, threats and prevention strategies. Given the benefits, it's no surprise that seven of ten senior executives believe AI will play a necessary role in responding to attacks, with the vast majority indicating that AI will allow their organization to more accurately detect threats and more swiftly respond to them, at a lower cost.

It's very difficult to keep up with cyber crooks when they're constantly deploying new tactics/tools and finding new exploits within supply chains, cryptocurrencies and other targets. But by committing to "security first" and arming themselves with fully automated AI, CISOs and their teams will give themselves a clear advantage - and this bodes well for more improvement in 2022.

##

ABOUT THE AUTHOR

As Chief Operating Officer and CTO, Onkar Birk oversees product delivery, engineering, threat management, R&D, and security operations for Alert Logic.
 
Birk has built his reputation as a leader focused on delivering products to market with customer success, swift execution, and the development of talent on his teams.
 
Previously, he led technology transformation for global clients, driving revenue generation through customer success. Prior to his seven years in consulting, Birk was General Manager and CTO for the Avaya Services & Contact Center Solutions Division, where he helped achieve the leader position from Gartner.