2021 saw an increase in the number and complexity of cyber attacks.
2021 saw an increase in the number of high-profile security breaches, many involving devastating ransomware attacks. Attackers preyed on traditionally softer targets like hospitals, software companies, schools, and local governments in addition to the continued focus on the supply chain. Although the root cause for many of these cyber-attacks varies, all took advantage of single factor authentication, weak multi-factor authentication (e.g., OTP), and exposed secrets (e.g., SAML signing keys).
The impact these attacks has had on critical infrastructure has spurred the White House into action with an executive order mandating adoption of robust security practices including the use of MFA by Federal agencies.
In 2022, Ricardo Resnik, CEO of the MultiPoint Group, expects the trend of extorting victims with ransomware due to enlarge part to the success that ransomware groups had in 2021. Additionally, it’s expected that there will be additional emphasis on regulations to help accelerate maturing information security practices and principles within vulnerable industries.
Here are the MultiPoint Group top information security recommendations of 2022:
Zero Trust architecture needs to be a primary initiative for companies
The SolarWinds incident and the recent Log4j vulnerability highlighted those critical internal systems for some companies have permissive access to the internet and untrusted systems despite decades of advocating for least privilege and isolation.
Zero Trust security models further the conversation but with the fundamental change in how we approach information security. Instead of assuming the internal environment can be trusted, Zero Trust starts with the presumption that the environment is hostile. Trust is established through inspection and strong authentication but is ephemeral in that trust must be re-establish periodically. In theory, this should limit the impact of a successful breach due to a limited window of opportunity and increased isolation.
The Zero Trust Maturity Model that the US government released in September outlines seven tenets of Zero Trust and leaves no doubt that companies will have to act to comply with those pillars to stay secure from increasingly sophisticated and widespread cyberattacks in 2022.
Companies must adopt phishing-resistant MFA
Phishing, credential stuffing, and other password-based authentication threats will continue to present significant risk to companies. Attackers have demonstrated they can gain access to internal networks where single factor authentication and weak MFA is still prevalent. Stolen credentials provide attackers with the means of persisting in the environment without the need to exploit vulnerabilities or other actions that would increase the likelihood of detection.
Tools that support multiple authentication protocols can provide a bridge for companies interested in an incremental transition from single factor authentication and legacy MFA like OTP to modern FIDO-based protocols that are resilient to common attacks like phishing.
Companies need to get over the fear of the cloud
Some companies and industries continue to see the cloud as a threat due in large part the perceived security benefits in maintaining control. Whether true or not, the cloud does offer a robust set of security features and protocols. When used appropriately, many of the threats large organizations are struggling with today, like ransomware and business email compromises, are largely mitigated. The combination of federated identity, strong multi-factor authentication, and cloud-based file storage is powerful for companies large and small. Mutual TLS-based authentication and encryption can usually be enabled with nothing more than a checkbox where the complexities of PKI are managed and automated in the backend. Additional oversight and control is also available to those that are interested in and are mature enough to manage their own secrets.
Wholesale cloud adoption is not required to gain the benefits of federated identity and strong multi-factor authentication. Most modern identity provider offerings support the FIDO protocols, SAML, and OpenID Connect to assist with integration on and off-premises applications. A comprehensive list of identity providers that support FIDO2/WebAuthn can be found at the MultiPoint’s site for the different regions.
Plan for ransomware
Organizations with traditional perimeter models and legacy infrastructure based on technologies like Active Directory must have a robust response plan in place to respond to a ransomware attack. The plan must consider topics beyond detection and recovery like insurance coverage, outside council, and plans to pay the ransom if recovery fails. Insurance plans may only cover the cost of hiring a third party but only when an approved vendor is used. There may also be limits to what is covered. We’ve recently seen changes to coverage based on whether the attacker is a nation-state or not.
Once a plan is in place, it should be tested, especially any backups.
Supply chain security requires more care
In 2021, the SolarWinds incident and the log4j vulnerability not only reminded us about how fragile our supply chains are but also highlighted that business critical and highly sensitive systems still can arbitrarily connect to untrusted systems on the internet. We should remind ourselves that we have mutual responsibility in ensuring the secure design, development, and operation of technology. Vendor assurances process littered with non-standard questionnaires alone cannot secure the supply chain.
Companies involved in a supply chain will have to establish mutual trust, established by implementing good information security practices throughout their development process and can demonstrate them externally. Ideally, the entire development process from code commit to release would be secured with strong authentication, robust integrity controls, and least privilege authorization models. Companies implementing that technology must follow industry accepted practices (e.g., Zero Trust) to ensure that technology stays secure with isolation, patching, and resilient access control models.
The log4j vulnerability potentially highlighted the importance of securing commonly used and critical open-source software. When the software is freely available, who is responsible for its security?
User privacy will continue to be a focus for regulators
Gartner recently predicted that by the end of 2023, modern privacy laws will cover the personal information of 75 per cent of the world’s population. As more laws like GDPR and CCPA continue to be implemented around the world to tackle the security and privacy of millions of people, the new issue organizations will face is managing multiple data protection legislation in various jurisdictions.
Companies must be protecting regulated information throughout its lifecycle and not just at the point of entry. While CCPA and GDPR do not impose requirements for authentication, we expect to see more and more prescriptive requirements as other jurisdictions develop their own set of requirements.
Talk with our MultiPoint experts regarding the discussed topics.
The Multipoint Group is focused on Cyber Security and Cyber Intelligence. Call our experts of the company in your region: Europe, GCC countries or Israel. We have the solution to every problem or threat that you may have through the best software of cyber manufacturers from all around the world.
