Business
Cybersecurity threats challenging businesses in 2022
Published by Jessica Weisman-Pitts
Posted on November 24, 2021
5 min readLast updated: January 28, 2026
Global Banking & Finance Review®
Company
Published by Jessica Weisman-Pitts
Posted on November 24, 2021
5 min readLast updated: January 28, 2026
Ransomware and other cyber threats pose significant risks to businesses in 2022. Effective security controls and staff training are crucial for protection.
By Dan Tremeer, NET Reply
Ransomware and the damage it causes is rightly making a lot of headlines right now and is the leading cyber risk to companies. Digging deeper, exploitable risks that require addressing are as follows
2. How do bad actors exploit the risk(s)? What techniques do they use?
There are highly organised crime syndicates with numerous roles of varied sophistication. Gaining legitimate account credentials is the first step, so phishing and credential stuffing are two initial techniques which bear fruit and are sold or passed up the food chain. Bad actors with evasive hacking capabilities gain a foothold into target business they expect will have either highly sensitive data, or cannot operate significantly without their digital infrastructure (health services being one example). With companies offering so many access points for attackers to probe and analyse for weaknesses from the outside, businesses have to consider an attacker will have at least low level credentials, making the typical outside equals bad and inside equals good mindset is not a viable strategy, if it ever was in the first place! Another consideration is how capable a business is to defending against a major attack, this leads to smaller organisations being a tastier target for attackers than you might think. Larger organisations will more likely be able to activate DR, or have better controls to detect and respond.
With adversaries becoming increasingly sophisticated and prevalent, modern security services are necessary for businesses to have a chance of successfully defending against persistent attacks across adapting and complex infrastructures. To identify bad actors earlier, Net Reply recommends businesses move to automated, machine learning solutions that leverage real time behavioural analysis and threat intelligence feeds, wrapped with effective controls, processes and staff training. Businesses should develop a data driven approach to understanding the effectiveness of their security controls by continuously testing their infrastructure and people. For the former, continuous security testing is a new service offering which solves many limitations of vulnerability scanning and manual penetration testing. There are a few different names – Threat Modelling, Breach & Attack Simulators (BAS) and Automated Penetration Testing provide consistent and constant testing and many provide clear reporting and remediation support. For the latter, developing a layered security awareness campaign using various formal and non-formal training techniques creates a culture of good security inside the organisation which have far reaching business value such as reduced overheads on service-desk and security staff.
Businesses also need to test their DR plans and also carry out yearly incident preparedness exercises. Table-top walk-throughs are a minimum level of preparation, but practical testing is more likely to reveal problems. No-one wants to activate untested procedure for the first time during a real and live attack.
Over the past many years it has been demonstrated that crime does pay and Ransomware is likely to continue to be a major risk for businesses and agencies. We are seeing a trend that security vendors are working more collaboratively together to help reduce the impact of bad actors. and it’s now on government leaderships agenda’s so there are some signs it’s getting more attention, relying upon effective state level support is not a recommended strategy however as their chances of eradicating the problem are slim to none. We will see an unprecedented level of technology advancement in many fields which will have an impact on security such as AI, quantum computing etc. which will of course be leveraged by bad actors as well. With everything becoming connected, how long will it be until threat actors figure out ways to disable medical devices such as pace-makers, automatic blood sugar patches or insulin delivery etc. or gain access to a water facility, all could have drastic harmful consequences.
Businesses are becoming more understanding of the areas of risk they maintain and are doing more about it such as putting assurance and governance processes in place to cover supply chain risk, cyber risk, insider threats, and disaster recovery planning, Staff are having to become more security savvy in their home and digital lives and will welcome having more advice from the business will go a long way to help businesses be more resilient to attackers
The article discusses cybersecurity threats challenging businesses in 2022, focusing on ransomware and other risks.
Businesses can protect themselves by implementing automated security solutions, enhancing staff training, and conducting continuous security testing.
Smaller businesses may lack the resources for robust security measures, making them more attractive targets for cyber attackers.
Explore more articles in the Business category
