3 Key Trends for Cyber Leaders for the Rest of 2022

By Fred Kwong

October 19, 2022
6 min read

As cyber leaders continue to grapple with the speed at which the cyber landscape continues to evolve, they should take stock of 3 key trends: 1 - threats, 2 - best practices and 3 - pressures. I was fortunate to be joined by some of my peers--Amy Bogac (CISO, The Clorox Company), Kim Baumann (Executive Partner, Gartner Executive Programs) and Bobby Christian (COO, Deepwatch)--at our State of Cyber: Today’s Threats to Watch virtual event recently to talk about just those things and how cyber teams should prepare for the remainder of 2022.

Threats

It should come as no surprise that we have an increasing number of threat actors, especially given the geopolitical situations creating headwinds for us in 2022.

Those in cybersecurity roles need to understand the variety of threat actors that now exist. Threat actors are no longer just individuals. Entire organizations or networks are being stood up that are trying to breach organizations.

Protection of the Infrastructure

Every company is reliant on its infrastructure on a daily basis. Those in head cybersecurity roles understand that it takes a village to keep a company profitable and running strong, but also safe and secure.

The major threats out there are:

  • Attacks on small players

    We're beginning to see more attacks on smaller companies. Say you are a company that relies on a specific product as part of your supply chain. That product may come from a supplier with underdeveloped cybersecurity practices. A simple attack on that company could mean your supply chain may be significantly impacted. Those targeting the weakest link pose a major threat to your infrastructure as a whole.

  • Ransomware

    Believe it or not, even ransomware is still a major threat. The majority of ransomware still comes from phishing emails,2 so the best defense comes down to the education of your user base. Consider doing a trend analysis to identify insider threats. Endpoint protection has never been more important as there are so many folks that are connecting to your network from smartphones, tablets and other devices.

Never underestimate the power of security awareness training. Companies can no longer rely solely on their once-a-year annual training and a more focused approach is necessary.

Prepare for Incident Response

Cybersecurity talent needs to be in a position where they can identify threats and inform on best practices. There needs to be a sold risk awareness and response plan in place should the unthinkable happen on the cyber warfare front.

The C-suite is beginning to recognize the impact of a cybersecurity breach on the overall operations of businesses, so they're likely open to investing in more in incident response. You need to evaluate your business and the critical areas: What is the most critical component of your business and what generates your revenue? You must know what is in your environment and what is critical to protect.

Once you do that, it's time to put a maturity baseline in place

  • Take your security budget and begin to apply it against the maturity baseline.

  • Have a third party help you navigate the landscape, as most CISOs won't be able to identify and understand all the risks.

  • From there, test your incident response plan. If you run into issues, you want to be able to patch, validate the patch and then continue to test. When you can test your incident response plan, you and your team will feel more confident that you have an plan you execute under pressure.

When you're outlining your incident response plan, ensure you're considering your offsite sources like vendors and cloud networks.

Other Pressures

Given how quickly the need for cyber professionals has grown coupled with the relative newness of cyber as a function within business, a gap has resulted in available cyber talent. Cyber roles have a faster than average projected growth rate of 33%, on a national level, in cyber jobs from 2020 - 2030.3 Companies Cyber leaders must recognize that the cyber team members they have are some of the most desirable talent, so you should ensure you're having career growth conversations with them and investing in their continued success within your organization.

While recruiting may be challenging, consider those already at your organization. As Bobby Christian said, "we're going to have to create these people and we have to look in different pockets now than we've ever looked before." Source people from across your organization and consider reskilling them so they can move into a cyber career track. With better training, more foundational knowledge, and a talent pipeline built for the future, the gap can begin to close.

1https://www.cfr.org/blog/tracking-cyber-operations-and-actors-russia-ukraine-war
2https://www.itproportal.com/features/the-four-most-popular-methods-hackers-use-to-spread-ransomware/
3https://www.bls.gov/ooh/computer-and-information-technology/information-security-analysts.htm

About Fred Kwong

VP, Chief Information Security Officer

Dr. Fred Kwong has been in the information security and technology field for the past 20 years working in the education, financial, telecommunication, healthcare, and insurance sectors. He is an award-winning thought leader in security and currently works at DeVry University where he serves as the VP and Chief Information Security Officer. 
Send a message
hyperlink icon
View full profile
hyperlink icon
Related Content

DeVry University State of Cyber Recap