Top 5 Types of Security Threats to Look Out for in 2022

As modern technologies evolve constantly and we grow increasingly dependent on them, we also become more and more likely to be hit by cybersecurity threats, which, in turn, are increasing exponentially and becoming more sophisticated. Cyberattacks, like hacking and compromising confidential information, can have devastating effects on any organization. Even giants of the virtual world like Facebook and Microsoft face such risks on a daily basis.

The COVID-19 pandemic has accelerated digital transformation for many organizations. As remote working increased, so did the new risks that employees and organizations had to face. Cybersecurity is one of the biggest threats for organizations and a major concern of top priority in the global risk landscape. As such, it is crucial that the entire organization, including all employees, are trained and prepared to protect themselves against cybercrime. A prepared IT Department will not be enough to protect an organization.

Some of the training courses that would greatly help individuals in this regard are:

ISO/IEC 27001 Information Security: This training course would help individuals to establish, implement, maintain, and continually improve an information security management system (ISMS) based on the requirements of ISO/IEC 27001. An ISO/IEC 27001 certified individual would be able to demonstrate that they have the necessary skills to support that the organization in implementing information security policies and procedures. In addition, they become aware of types of security threats which would help them be aware of the potential risk beforehand.

ISO/IEC 27032 Cybersecurity: This training course helps individuals protect and maintain long-term sustainability of business processes. Certified individuals would be able to develop policy frameworks to identify processes that are most vulnerable to cyberattacks and ensure that the organization will not be at risk.

According to Gartner, organizations adopting a cybersecurity mesh architecture can reduce the financial impact of security incidents by an average of 90%.

Top 5 types of security threats that everyone should consider and be aware of are listed below:

1. Ransomware

According to Cybersecurity Ventures, the cost of ransomware damage is expected to reach $265 Billion by 2031. Their report predicts that there will be a new attack every 2 seconds, as ransomware perpetrators progressively refine their malware payloads and related extortion activities.

In this type of attack, the victim’s computer is locked, typically by encryption, blocking them from using the device and everything stored in it. In order to regain access to the device, the victim has to pay ransom, often in the form of virtual currency.  There are different types transmitting such threats. However, most of the time, ransomware are spread through malicious email attachments, infected software apps, compromised websites, or infected external storage.

How to prevent ransomware?

• Back up computing devices and update software
• Avoid links in emails from unknown sources
• Avoid opening email attachments
• Do everything possible to avoid paying ransom
• Couple a traditional firewall that blocks unauthorized access to computers or networks
• Limit the data a cybercriminal can access

2. Insider threats

This is one of the most common types of security threats. It usually occurs when employees intentionally or unintentionally misuse authorized access in a way that affects the organization’s system negatively.

In most of the cases, this is due to noncompliance with the organization’s policies and procedures. As such, they are prone to email customer data to external parties or share their login information with others. Such types of attacks would elude cybersecurity protocols to delete, sell, or steal data. This can disrupt operations and cause great damages to data.

How to prevent insider security threats?

There are different activities that the organization might consider to prevent potential risks from insider threats. Organizations can:

• Limit employees’ authorized access
• Train employees on security and make them aware of its importance 
• Inform employees on different types of security threats and how they should act if they occur
• Follow the requirements of international standards, such as ISO/IEC 27001 or ISO/IEC 27032
• Implement two-factor authentication
• Install employee monitoring software

3. Phishing attacks

Phishing attacks are one of the most prevalent information security threats in today’s business environment. According to Verizon’s 2021 Data Breach Investigations Report (DBIR), phishing is the top “action variety” seen in breaches in 2020, with 43% of breaches having involved phishing and/or pretexting.

Phishing aims at tricking users to compromise important and confidential information. Usually, attackers use fake emails that are made to seem as reliable or from legitimate sources. 

The main idea is to push users to take some actions (e.g., clicking on a link or opening email attachments) that allow attackers to install malware on their devices. 

How to prevent phishing?

One of the most effective preventive measures is training and awareness. Employees should be trained and become aware of different types of security threats in general, as well as specific strategies used for phishing.

4. Cloud attacks

Cloud has become a critical part of our everyday life. However, we should be aware that not all cloud services provide secure authentication and encryption. Misconfiguration can cause several incidents, including intrusions, network vulnerabilities, and data leaks. 

According to IBM, over half of cloud security breaches are caused by simplistic issues. While, two thirds of cloud security incidents could be avoided by checking configurations.

How to prevent cloud attacks?

• Educate/Train your employees 
• Secure a data backup plan 
• Identify who can access your data 
• Use penetration testing 
• Establish cloud governance policies and procedures 

5. Malvertising attacks 

Malicious advertising, alias malvertising, is a new up and coming form of cybercrime. Through this technique, cybercriminals inject a malicious code within digital ads which would redirect users to malicious websites or install malware on their devices. It is very difficult to be identified by internet users and publishers. Thus, these are usually served to consumers through legitimate advertising networks. Any advertisement displayed on websites can present a risk of infection.

Even some globally known companies have inadvertently displayed malicious ads in their websites. 

How to prevent malvertising?

Again, awareness is of utmost importance. There are some steps that should be followed to reduce the risk of infection. These include to:

• Ensure that software and extensions are updated
• Install antivirus software and ad blockers
• Avoid using Java or Flash programs

On the other hand, publishers have a responsibility to protect their web visitors from malicious advertising. They should take the following steps to reduce risk:

• Evaluate third-party ad networks responsible for choosing, inspecting, and running ads 
• Scan ads that they plan to display
• Avoid using Flash or JavaScript in ads

About the author

Albana Iseni is a Senior Product Marketing Manager for ISR at PECB. She is in charge of conducting market research while developing and providing information related to ISO standards. If you have any questions, please do not hesitate to contact her: marketing.ism@pecb.com.