Ransomware attacks are growing in sophistication, with threat actors employing new technologies and affiliate models. Last year saw new models like Ransomware as a Service, with specialists working together to support ransomware attacks. They are now observing the OT-IT merger and looking for vulnerabilities to exploit in operational technology (which is not as secure as information technology). That is why organizations must prepare for more such attacks in 2022.
By Muhammad Tariq Ahmed Khan, Head of Information Security Audit, Internal Audit Department, Riyad Bank, KSA
Here are my three trends.
1. The Surge in Ransomware Attacks. Ransomware attacks have become worse in the last two years, and it is expected that the curve will continue surging in 2022. While the volume of ransomware attacks is alarming, the usage of technologies adding up their capabilities is a matter of concern that will continue to target the organizations. This is probably due to the growing convergence of Information Technology (IT) and Operational Technology (OT) networks, which has enabled attackers to target organizations through the vulnerable home and remote workers’ devices.
2. Evolving Artificial Intelligence. Since artificial intelligence is evolving unprecedentedly and providing more opportunities to organizations, the cybercriminals will continue leveraging AI to circumvent all controls, gain privileged access to organization’s data and erase traces to avoid detection. It is expected that cybersecurity vendors will combine the strengths of AI, Machine Learning Algorithms (ML) and Deep Learning (DL) networks, enhancing the capability of AI making it more effective and efficient.
3. Scarcity of Cybersecurity Talent. With the increase of cybersecurity threats and the diversity of the attack landscape, cybersecurity talent is expected to remain scarce in 2022. The demand of cybersecurity professionals will rise to cope with the constant battle against cybercrime. This imbalance will result in salary hikes for cybersecurity professionals.
Also read:
Ransomware! Ransomware! Ransomware! The Problem of Blind Reductionism
About the Author
Muhammad Tariq Ahmed Khan is Head of Information Security Audit, Internal Audit Division, Riyad Bank, KSA. He has over 21 years of experience in the Banking industry, in areas such as Information Technology, Cyber & Information Security, Business Continuity Management & Disaster Recovery and related Audits. He has a solid understanding and application of Risk-Based Audit methodology, ISMS (ISO 27001), ISO 22301, NIST and COBIT, IT & Information Security regulatory compliance.
He is double Graduate (Finance and Computer Science) with one Master’s Degree in Computer Science. In addition, he holds a number of professional certifications such as CISA, CISM, CRISC, CDPSE, CISSP, PMP, CEH, ISO 27001 ISMS Lead Implementer & ISO 22301 BCMS.
Tariq has published articles on different topics of Cyber & Information Security and IT Audit and also spoken at regional and international seminars and conferences.
Disclaimer
Views expressed in this article are personal. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.
