View source for 2022 Will Be An Epic Fight To Protect Data

id="article-body" class="row" section="article-body" data-component="trackCWV"><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br>Buckle up. This year is likely to be even worse for cyberattacks.<br><br>Getty Images<br><br>[/year-ahead/ This story is part of The Year Ahead, CNET's look at how the world will continue to evolve starting in 2022 and beyond.]<br><br><br>[/topics/security-blog/ Security] threats will likely accelerate in 2022 as cybercriminals refine tried-but-true ransomware methods and look to exploit weaknesses in the software that knits together the internet. US elections will also present a tempting target for spreading misinformation. <br>The expectation of a ramp-up in hacks, attacks and data theft comes after a [/tech/services-and-software/ransomware-rises-as-a-national-security-threat-as-bigger-targets-fall/ massive jump in ransomware] - takeovers of computer systems that remain locked down until a ransom is paid - that spilled into consumers' lives in 2021. Cyberattacks that shut down oil transporter [/tech/services-and-software/colonial-pipeline-ceo-tells-senate-decision-to-pay-hackers-was-made-quickly/ Colonial Pipeline] and meat packer [/tech/software/jbs-paid-11m-in-bitcoin-to-resolve-ransomware-cyberattack/ JBS USA] contributed to temporary gas price increases and meat shortages in parts of the US.<br><br><br><br><br><br>Get the CNET Home newsletter<br>Modernize your home with the latest news on smart home products and trends. Delivered Tuesdays and Thursdays.<br><br><br><br>The December discovery of the Log4j bug, a [/tech/services-and-software/log4j-software-bug-cisa-issues-emergency-directive-to-federal-agencies/ critical flaw in logging software] that's widely used around the internet, offered a glimpse of the vulnerability in the software supply chain, which had already taken a hit with [/tech/services-and-software/solarwinds-hackers-accessed-dhs-acting-secretarys-emails-what-you-need-to-know/ 2020's SolarWinds hack]. Security experts say hackers are likely looking for ways to take advantage of Log4j and other weaknesses in the interconnected services we rely on.<br><br>The anticipated attacks come against the backdrop of a seemingly never-ending pandemic that creates additional weaknesses. With many people still working from home, attackers will seek to exploit remote connections to infiltrate corporate networks. Some scammers will also target everyday folks, who are spending more and more time in front of computer screens, in order to nab banking information, personal passwords and other data that can be used to compromise accounts.<br><br>Andrew Useckas, chief technology officer and co-founder of the cybersecurity firm ThreatX, says part of the problem is that companies don't know the size of the problem, because so much information is on corporate networks.<br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br>"Many organizations simply don't understand just how exposed they are," Useckas said. <br><br>Many cybercrimes, both big and small, go unreported, making it difficult to track overall data. Still, experts say a handful of key metrics jumped last year, ringing alarms.<br><br>Notably, data breaches publicly reported in the first nine months of 2021 exceeded the total for all of 2020, according to the [ Identity Theft Resource Center]. Suspected ransomware payments reported by banks and other financial institutions [/tech/services-and-software/suspected-ransomware-payments-total-nearly-600-million-for-first-half-of-2021/ totaled $590 million] for the first six months of last year, according to an October [ report] by the Department of the Treasury. The figure easily surpassed the $416 million in suspicious payments reported for all of 2020.<br><br><br>See also<br><br><br>[/tech/services-and-software/log4j-software-bug-cisa-issues-emergency-directive-to-federal-agencies/ Log4j software bug: What you need to know]<br><br>[/tech/services-and-software/hacks-ransomware-and-data-privacy-dominated-cybersecurity-in-2021/ Hacks, ransomware and data privacy dominated cybersecurity in 2021]<br><br>[/tech/mobile/apple-sues-nso-group-over-pegasus-spyware/ Apple sues NSO Group over Pegasus spyware]<br><br><br><br><br><br>President Joe Biden's administration [/personal-finance/your-money/us-treasury-hits-back-at-ransomware-attacks-with-sanctions/ has taken steps] to curtail ransomware and other cyberattacks. The White House recently held a [/tech/services-and-software/white-house-is-hosting-a-global-ransomware-summit-without-russia/ global online counter-ransomware event] and promised sanctions against crypto exchanges and other financial institutions that facilitate ransomware.<br><br>In the wake of Log4j, the White House plans to hold a [ gathering of software company executives] later this month to look for ways to boost software security.  <br><br>Congressional elections in November could also result in new security priorities if the balance of power in the House and Senate change. The election will bring its own security risks, and experts warn that a flood of [/news/the-year-conspiracy-theories-yielded-deadly-consequences/ misinformation] will swamp social media platforms as Nov. 8 nears.<br>Cyberattacks keep coming, but will the government take action?<br>Ransomware attacks that affect only corporate back office operations often escape public notice. But when hackers shut down companies that consumers rely on, everyone is aware. <br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br>[/personal-finance/your-money/us-treasury-hits-back-at-ransomware-attacks-with-sanctions/ The Treasury Department] said in September that it would start sanctioning cryptocurrency exchanges and other entities that launder ransomware payments. The idea behind the move: cracking down on shady activity surrounding crypto - the currency of choice for ransomware payments thanks to its largely untraceable nature - will discourage ransomware attackers.<br><br>Meanwhile, lawmakers in the US and other countries started crafting [/tags/legislation/ legislation] that would require companies to disclose when a ransomware or other cyberattack has occurred. Many ransomware attacks go unreported, making it tough for [https://www.wiklundkurucuk.com/ law firm turkey] enforcement to keep track of how many attacks are happening, who's being targeted and how much money is going to cybercriminals.  <br><br>If the attacks and the demands continue to increase, politicians will need to push legislation in an attempt to show they're combating the issue, said Tony Anscombe, chief security evangelist at the antivirus company ESET. That legislation might expand to include the prohibition of ransomware payments.<br><br>"This could then become a race around the world to enact legislation as cybercriminals will target those territories where paying is still permitted," Anscombe said.<br>Worries about the software supply chain<br>A bug in Log4j, a widely used Java library that logs error messages in network applications, highlighted how reliant everything from government agencies to the consumer-focused internet of things is on freely used software that's incorporated into a host of other software products. <br><br>The simple exploit, which allows attackers to take control of internet-connected devices running the affected software, is an example of vulnerabilities in the software supply chain. Often it can be unclear exactly what devices are running the software. Like cars, software relies on a supply chain. Engineers build software with premade parts that are often made up of smaller components.<br><br>Once a piece of software is finished, it can be tough to determine all of its individual parts and where they all came from.<br><br>Justin Cappos, an associate professor at New York University's Tandon School of Engineering, says the current setup of the software supply chain isn't transparent because so many products rely on open-source code. Even if you're buying software from a major company, you don't know what original code might have gone into it. <br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br>Cappos says the software industry would benefit if it disclosed the sources of the components it uses, sort of like food makers listing ingredients. "Software companies can contract out to a company, who then contracts out to another company," Cappos said. "You don't know where the source code is coming from."<br><br>Experts also expect more hacks of the software supply chain in the coming year. Instead of exploiting existing flaws, cybercriminals could insert malicious code into commonly used software to infect corporate systems. <br><br>That happened two years ago, when hackers stealthily placed bad code into an [/tech/services-and-software/fbi-nsa-and-cisa-say-solarwinds-hack-was-likely-of-russian-origin/ update of SolarWinds' popular Orion IT software products]. Corporate customers then incorporated those products into their own systems, giving cybercriminals access to their systems. Thousands of customers installed the tainted update, though SolarWinds says far fewer companies were actually hacked.<br><br>US officials say Russia was behind the attack. The Russian government has denied involvement.<br><br>"The fact that a nation-state actor went to these lengths to target [SolarWinds] is very concerning," Cappos said. "I think, unfortunately, this is the start of a trend rather than a one-off incident."<br>Misinformation grows ahead of midterm elections<br>Already a scourge, misinformation is going to get worse in 2022. Misinformation, or false information that's spread regardless of whether it's meant to deceive, could take many forms. <br><br>Conspiracy theories about vaccines, global cabals and election shenanigans have already flooded social media. Facebook, Twitter and other social media platforms have tried to get a handle on it but can't keep up with what's become a never-ending game of whack-a-mole. Fact-checkers from the media and other organizations have also tried to offset the streams of lies. More misinformation is undoubtedly on the way. <br><br>Sophisticated deepfakes, manipulated video and audio clips that bend reality to make someone appear to say something he or she didn't, are getting cheaper and easier to use. Though they haven't been widely used other than for demonstrations, their existence alone could be enough to make some people distrust what they see online.<br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br>Part of the problem is that as the US becomes more polarized, people are inclined to believe information that supports their world view, regardless of the info's accuracy. News media have become more siloed and sometimes skip stories that don't fit an agenda, Cappos says.<br><br>That works to split an already divided America even more, undermining trust in the government and democracy ahead of the midterm elections. <br><br>"People believe all kinds of weird stuff that they want to believe," Cappos said. "In a lot of cases, they won't listen to fact-checkers."<br><br>Russia, China and other US adversaries are happy to see the polarization, even if they aren't behind the campaigns. Anything that causes infighting and gridlock; slows the American political process; or undermines faith in democracy can work to their advantage.<br><br>Jon Clay, vice president of threat intelligence for the cybersecurity company Trend Micro, said he expects disinformation attacks from Russia and others to ramp up ahead of the November election. It'll be up to consumers to tell the truth from the lies.<br><br>"People are going to have to be very critical about information and where they get their information," he said, adding that this will be tough, given how fast information travels on social media regardless of its accuracy.<br>Scams get scarier, go mobile<br>COVID forever changed the way we work. Even in the highly unlikely event that the pandemic winds down this year, many people will keep working from home at least part of the time.<br><br>Cybercriminals will be working, too. They'll be hunting for new ways to take advantage of the connections and devices that workers use to dial in remotely. <br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br>NYU's Cappos says the cybersecurity industry will likely get a better handle on how to [https://www.change.org/search?q=manage%20hybrid manage hybrid] work situations, introducing new recommendations and products that boost security and make it easier for workers to connect.<br><br>Consumers will also need to up their security game, Clay says. Good methods of two-factor authentication, such as biometrics and push notifications, are going to be a must. Simpler verification methods, like codes sent as SMS messages, just can't be trusted anymore.<br><br>That goes for [/topics/phones/products/ smartphones], too. Phishing, the practice of sending deceptive emails in order to get personal information, is going mobile. Similar attempts using SMS, known unimaginatively as smishing, and voice calls, which are called - you guessed it - vishing, will become more common this year as people move more of their online activity to mobile devices, Clay says. In addition, the use of scam QR codes, or quishing, is also on the rise. <br><br>"The attackers are going to continue their activities and they're going to be targeting consumers," Clay said. "People are going to need to secure their data."<br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br>[/tech/ Tech]<br><br>[/topics/politics/ Politics]<br><br><br>[/tags/hard-news/ Hard News]<br><br>[/tags/privacy/ Privacy]<br><br>[/apple/ Apple]<br><br><br><br>[/online/cybersecurity/  Notification on Notification off Cybersecurity]