The speed of development and change in cyberspace in recent years is amazing not only for inexperienced users but also for experienced specialists in the field of IT and information security. There is an exponential development not even in the amount of data processed, the number of devices or applications or services connected to the Internet, but also in the concepts and technologies themselves, and the comprehensive digitalization and the transition of most businesses online due to the pandemic have only accelerated this trend.
Cyber threats are multiplying at the same rate, as attackers use the same highly effective development tools, but for their purposes. This brings the level of cyber countermeasures to a new level: earlier the confrontation with intruders could be described as a struggle of minds and customized means of protecting information; now it can be called a full-fledged ‘war of machines’, where artificial cyber intelligence is fighting. In this article, we will talk about current cybersecurity trends in 2022: attacks on supply chains and third parties (3rd parties), attacks on elements of the Internet of Things and issues of protecting cloud infrastructures, security of personal data.
How to deal with 3rd parties attacks
Such things can be easily prevented – it is enough just to apply the principle of Zero Trust to all entities that appear in your IT infrastructure. This includes checking and controlling all accounts, all devices, all network connections and running processes, regardless of who initiates them. For each entity, be it a manager’s account, an engineer’s smartphone, or even a printer in a meeting room, you should set network interaction rules and calculate a certain scoring risk score, which increases when connecting from suspicious locations, after hours, if there are active cyber incidents on this device.
Attacking ‘Internet of things’
IoT includes a large number of consumer-grade electronics elements continuously connected to various networks, incl. to the Internet, to interact with each other, with the owner and with a variety of Internet services.
To protect IoT devices from cyberattacks, attention should be paid to the following:
- Country of manufacture of the device and manufacturer: the more known the manufacturer, the higher the likelihood of timely software updates and the lower the likelihood of unpatched vulnerabilities that are known to the vendor.
- Availability of legal documents on the official website: provisions on the confidentiality of processed data, personal data processing policies, statements of compliance with certain legislative norms, etc.
- Ability to configure firmware to control external Internet connections to the device – remote control, administration, status viewing, etc.
- Availability of firmware updates on the official website of the manufacturer, frequency of their release, date of release of the last update.
- The presence of a community of amateur enthusiasts who release unofficial, “customized” firmware for this device.
When using IoT devices to perform business tasks, you should carefully consider the choice of manufacturer, giving preference to one who regularly releases firmware updates, offers extended technical support and on-site visits of its specialists, provides a long warranty and recommendations for protected configuring the device, as well as having up-to-date documents describing the implemented information security measures and accepted secure development techniques.
Personal data security
The issues of ensuring the confidentiality of personal data began to be raised almost immediately after the start of the widespread use of computer technology for processing information relating to individuals.
Talking about business, the protection of personal data of customers and employees is an important task not only in the context of compliance with the law – today it is often the accumulated data about consumers that is one of the main intangible assets of a company, and the loyalty of employees and customers is formed, among other things, by measures taken the company to protect their accounts, personal data, payment information.
