Industry executives and experts share their predictions for 2022.  Read them in this 14th annual VMblog.com series exclusive.

Security Adoption, Open Source, and “Human” Based Attacks

By Tzury Bar Yochay and Justin Dofrman of Reblaze

2021 was a monumental year for cybersecurity, as the industry worked to protect against increasingly complex attacks. There’s no question that attackers will continue evolving in order to evade traditional security methods, thus enhancing the need for an elevated security strategy. In 2022, we will see an increased focus on security technology and open source adoption in order to remain protected.

##

Tzury Bar Yochay, co-founder and CTO, Reblaze

Security Adoption Will Evolve

I expect that organizational leaders will become more proactive in evaluating new technologies to strengthen their security postures. In the past, security was often an afterthought; today there’s a growing awareness of how bad the threat environment has become.

Cybercrime is now a mature and well-financed industry, especially in the area of ransomware. According to the US Treasury, ransomware operators collected $590 million in payments in the first half of 2021 alone.

The hacker groups are well-organized and have access to financial resources that far exceed the security budgets of most organizations. At the same time, the potential damage from an incident has skyrocketed. According to the Ransomware Task Force, the average time to recover from a successful attack is over nine months.

This problem isn’t new, but it’s never been this bad, and it’s continuing to get worse. As more high-profile incidents occur and more organizations become victims, I expect that other executives will become more aggressive about adopting the best security technologies and getting ahead of this problem.

DevSecOps is Becoming a Standard

For many organizations, there’s an ongoing drive to integrate security throughout development and operations. The old approach of having security as an add-on at the end of the process creates more vulnerabilities, and they’re more expensive to fix. So, baking security into devops is becoming a competitive advantage. It’s not a fast or easy process, but it’s essential.

Cyber Attacks Will Become More Human

We’re seeing a growing trend of direct human participation and orchestration of web attacks.

In past years, the abundance of cheap illicit resources on the darkweb-things like rental botnets, malware as a service, off-the-shelf attack tools, and so on-meant that most attacks were automated. Hackers would launch them, and then they would either succeed or not.

Today, this is changing. The biggest cybercrime gangs are pulling in millions of dollars per year, and they have access to resources that they didn’t have before. Not only are they able to hire top programming talent (for which they advertise openly on job boards in CIS countries) so they can develop better attack tools, but they can also afford to hire and assemble teams of skilled hackers to operate the tools directly.

Most attacks are still automated today. But for our high-profile customers, we can see direct human participation in many of the attacks. The hackers probe our defenses, systematically trying different tactics to try to figure out something that will work. Often, they are quite creative in the things that they try, and they pay close attention to results. When they try a new tactic and we block it, they respond immediately with something different. They can be quite persistent; sometimes this back-and-forth process goes on for weeks until they finally give up.

These attacks used to happen only against targets with the highest perceived value. However, as the gangs are pulling in more money, they can afford to do this more often and against smaller targets.

In this environment, it’s important to have a solid team of security professionals that actively monitor your defenses and respond to attacks, creating and deploying countermeasures when new tactics are used. Many executives would prefer to treat their web security as “configure and forget,” but that approach isn’t good enough anymore.

##

Justin Dorfman, Open Source Program Manager, Reblaze

In 2022, companies will continue to adopt open source projects either directly or indirectly via dependencies on other technology. With this accelerated adoption, I hope to see more companies contributing to sustaining the digital infrastructure we all rely on, to benefit the open source community as a whole.

Major Tech Providers Will Increase Security Spending

Open Source Supply Chain Security was one of the biggest talking points of 2021. With Google recently making a $10 billion commitment to advance cybersecurity over the next 5 years, I predict this will become contagious and other FAANG companies will follow suit. The impact of this will mean greater protection for all, as one of the biggest threats to open source is a vulnerable supply chain.

Zero Trust Tools Will Be Increasingly Important
Open source tools such as Sigstore, Allstar, OpenSSF Security Scorecards, and SLSA security framework will play a big role applying Zero Trust principles to supply chain security. Startups like Chainguard, founded by Dan Lorenc, ex-Googler who led their Open Source Security Team, will also become more popularized.

Cloud-Native Technologies Will Change

Serverless functions will start to play a bigger role in the cloud native ecosystem. Andrew Martin who is a Cloud Native security consultant and wrote the book on Hacking Kubernetes, has said, “we certainly see that with some of our customers now, there is a hybrid deployment approach when they’re trying to build global platforms in multinational organizations, where they’re interested in targeting everything from a virtual machine, through a Kubernetes into a serverless platform.”

Additionally, since 2018, Kelsey Hightower has been a serverless / functions advocate, by showing the Kubernetes community the benefits of solutions like Amazon’s Lambda. OpenFaaS could be the driver for those who are looking to run functions on bare metal or hybrid cloud infrastructures.

##

As the cybersecurity landscape evolves to outsmart existing protections, organizations will need to focus on spending, collaboration and technology adoption in order to remain protected.