Cyber Defense eMagazine March Edition for 2022

#1: Firmware level attacks will increase
The much-cited Security Signals Report published by Microsoft in March 2021 noted that at least 80
percent of enterprises in major economies had suffered at least one attempted firmware attack in the
previous two years.
Firmware attacks are daunting precisely because firmware sits ‘below’ the operating system, where the
most common and familiar tools for detecting and quarantining malware cannot see them. But until now,
firmware threats have not been treated seriously enough by enterprise security teams. As the Security
Signals Report tells us, only 29 percent of security budgets were allocated to protect firmware.
That has to change.
There are many ways that firmware attacks can be launched against network devices and cause untold
amounts of damage. Equally, there are plenty of basic housekeeping and security steps that can
eliminate a number of potential vulnerabilities. AI-enabled security at the firmware level for example,
allows real-time data protection against all sorts of software-based malware, ransomware, and viruses
without human intervention.
#2: More firms will be subject to an inside job
The measures security professionals take to narrow the attack surface are based on the simple idea that
the threat is ‘out there.’ But this focus on preventing and detecting external attacks can create a significant
blind spot: the threat from inside.
Whether from malicious intent or clumsy accident, trusted employees and partners can cause more
damage than ever before. New ways of working and greater digital engagement change the nature of the
company network and its assets. According to Ponemon Institute’s 2022 Cost of Insider Threats: Global
Report the incident rate is up by 44 percent in the past two years, with costs per incident now at $15.38
million. There is little sign that this is slowing down.
In this environment, the zero-trust model – which leaves no room for protocol, courtesy or respect for
seniority – treats every insider with suspicion. That means proper, multi-factor authentication for every
access to every system or service, plus monitoring, logging and effective pattern detection to detect any
anomalous insider behavior. It may be an uncomfortable idea for many, but it is a necessary one.
Cyber Defense eMagazine – March 2022 Edition 96
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.