Industry executives and experts share their predictions for 2022. Read them in this 14th annual VMblog.com series exclusive.
Revamping Cybersecurity to Accommodate for the Future of Work
By Devin Ertel, Chief
Information Security Officer, Menlo Security
2021 was a transformative
year for the security industry as ransomware and cyberattacks plagued companies
large and small across all verticals, which ultimately skyrocketed
cybersecurity from a "nice-to-have" to a top boardroom focus. While companies
looked to quick fixes that allowed employees to work from home at the start of
the pandemic, they're now realizing that the solutions they implemented more
than a year and a half ago will not protect them against current and future threats.
Now that organizations are
aware of the risks they face if they don't have a solid security strategy in
place, 2022 will be centered around actioning on plans and implementing new
solutions that will secure the future of work as hybrid work environments are
here to stay. There are three main changes that will take place in the year
ahead:
Consolidation of security
solutions
Organizations will move to
consolidate their security solutions in 2022. In fact, we know from our own recent research
that 75% of organizations are re-evaluating their security strategy as remote
and hybrid working remain for the long-term.
With three-quarters of
organizations re-evaluating their security strategies, business and security
leaders will need to ensure that they don't get left with two disparate security
solutions: One that existed before a remote workforce and the one that was
implemented when everyone switched to remote working. To avoid double the work
and reporting - and any other associated tasks for security teams -
organizations will implement a common approach for their security solution, or
they'll be left with disjointed systems that are sure to leave them vulnerable
and will open backdoors for bad actors.
As a result, there will be an
even greater focus on applying a Zero Trust network access strategy whether your
organization is in the office, distributed remotely, or anywhere in between.
Implementation of Zero Trust
We've seen attacks on ferry
services, meat plants, critical infrastructure, and payroll systems to name a
few in 2021 alone. It's clear that it doesn't matter what you do or what
industry you're in, security is now everyone's problem, and the sooner
organizations recognize that the better.
Bad actors aren't going
anywhere and they're only getting more sophisticated and proficient in their
attack methods. There will be a collective push towards the implementation of
Zero Trust, which the White House's focus and identification of widespread security failings has helped bring to light. Consequently, many
companies - in both the public and private sectors - will be forced to change
their ways and move more quickly when it comes to security.
Businesses will realize that
they must seek an alternative and prioritize cybersecurity strategies that are
rooted in the Zero Trust framework, or they risk becoming the next victim. The government's
emphasis on the move to a Zero Trust-focused approach will serve as a blueprint
for organizations as we move into the new year.
Ransomware prevention
rather than remediation
There have been many
conversations in the security industry regarding remediation strategies.
However, remediation is not possible with ransomware. Remediation doesn't work,
as you must restore everything and set up separate systems.
Organizations must instead focus
on prevention because you cannot detect and remediate ransomware. Once
ransomware has you, there's no going back. Locking up your systems is the last
action attackers take and they've likely been in your networks for weeks,
months, if not years figuring out what they can steal. Hackers are patient and have
been taking your credentials evaluating what they can use. Locking up your business
is the last resort they take to see if they can extort a few more million
dollars from you - which is why a focus on prevention will be paramount in
2022.
As we look to the future, one
thing remains certain: Security leaders must move quickly to revamp their cyber
strategies, or they'll face becoming the next target on a bad actor's list. While
2021 was a year of learning and self-reflection for many organizations
regarding their security posture, businesses must make a distinct effort in
2022 to make changes and take action on what they learned to better protect
themselves, their networks and their employees.
##
ABOUT THE AUTHOR
Devin Ertel has nearly 20 years of information security
experience and currently serves as Chief Information Security Officer at Menlo Security, where he is responsible
for providing internal cybersecurity guidance and policy insights to both the
company and its customers. He is also focused on reducing the company's risk
and security exposure.
Devin's previous experience includes security positions
in several Fortune 100 organizations, in addition to Mandiant and the Federal
Reserve, where he had hands-on experience mitigating large, high-profile
breaches and dealing with highly motivated global threat actors.