Today, in 2022, organizations and individuals face a serious and increasing digital threat. 

Cyber incidents, referred to as 'hacking', are more and more common. These incidents cause suffering from business disruption and loss of data, and the victims also need to contend with the subsequent aftermath. 

This aftermath could be the loss of trust in their clients or a drop in share price for public companies. Furthermore, these organizations can also receive punitive fines if specific data types are lost, costing Office hundreds of millions of pounds. 
 
With this threat occurring every day, the cyber security industry has risen worth £10.1 billion in the UK in 2021, rising 77% from £5.7 billion in 2017. 

Cyber Security Industry

Due to this situation, the security industry has created multiple standards and frameworks to follow, as well as software solutions, services, membership, and government organizations to conferences. 

Whilst each of these provide advice and solutions to digital risks. They may have multiple mitigation strategies, not all of which have empirical evidence of their effectiveness; with varied communication and implementation, there is substantial room for different and diverse levels of effectiveness.

One example that comes to mind is controls pertaining to malware protection. Whilst security standards make recommendations requiring organizations to install "anti-malware" protection, not all antivirus vendors have the same capabilities; if we turn to hackers' Tactics, Tools, and Procedures (TTPs), we can start to dissect some of the real differences between providers. 

Malware Protection

Standard practice for hackers is to "live off the land" and use a power shell to run malicious commands in memory in an attempt to evade antivirus functionality through reflective expressions. To counter this tactic, Microsoft created Antimalware Scan Interface (AMSI) to detect and mitigate this kind of attack.

However, at the time of writing, only approximately 81% of antivirus providers have this functionality enabled; whilst the adoption rate of this technology is concerning, a greater concern should be highlighted as AMSI was released in 2015, but the majority of the antivirus providers took between three to six years to implement the interface standard.

Whilst this missive acts as a cautionary tale, using a small example in a wide-reaching industry. The lesson here is to ask the right questions and understand the gaps between the advice you are following and your invested tools.

This article was contributed by our expert Patrick Wake

Frequently Asked Questions Answered by Patrick Wake

Q1. What are the latest advancements in cyber security?

Whilst machine learning and AI have been heavily advertised, and their benefits have been widely researched. Tremendous advances have been made in heuristic detection and behavioural analytics, looking for malicious actors living off the land and using seemingly benign software.

Q2. What are some of the emerging IT security technologies?

Extended Detection and Response (XDR) is an emerging technology that looks to extend further an organisation's Endpoint Detection and Response (EDR) view of their technology estate. Where EDR typically looks after endpoints, XDR can utilise system logs and APIs from 3rd party vendors and cloud providers—allowing for better oversight and integration from defensive controls.

Q3. What are the top challenges to cyber security in 2022?

The real challenges seen in 2022 are focused on getting the foundations right. On too many occasions, I have seen organisations focusing on the latest trends and fads when patching, OS Hardening and asset management are put to the sidelines.

With technical elements put to one side, we also need to review the human element. Hiring and retaining skilled talent is still challenging, with the market seeing a rise in salaries and the need for a hybrid workforce.

Q4. Why are cyber-attacks increasing?

This is not a simple question to answer in a couple of lines, but one explanation is that the dissemination of knowledge and access to technologies are becoming easier. An example of this can be seen in ransomware as a service, where the authors of these technologies create simple how-to guides and rent access to their malicious tools and software as a subscription model.

Allowing a less skilled user base access to a technology stack that would have previously been out of their reach, whilst all the while, the authors and creators of these services remain out of the reach of law-enforcement agencies.

Q5. What is Blockchain technology in cyber security?

Whilst Blockchain technologies have grown in popularity since the late 2000s, focusing on decentralisation and encryption, there is yet to be a significant uptake in this technology within the cyber security industry. However, if the intent of Web 3.0 is to be realised, blockchain technology could play a large part in the general public's everyday lives.