What do the Gartner cybersecurity trends for 2022 mean for CISOs?

With the threat landscape evolving at a surprising pace, cybersecurity has become one of the top concerns for businesses. With security strategy becoming a priority, a CISO, whose primary role would have been to prevent security breaches, now also has to don the hat of a security strategist.

In a recent report, Gartner has outlined the top Security and Risk Management Trends for 2022. According to Gartner, security strategists need to up their game to match the emerging threats and protect their organizations.

What does the Gartner report say?

The hybrid work models across different organizations, rising cloud adoption, and shortage of cybersecurity talent pose a challenge that CISOs must find a way to overcome. A revolutionary change to cybersecurity is the need of the hour and Gartner defines three high-level trends to look out for.

1. New responses to sophisticated threats
2. Evolution and reframing of security practices
3. Rethinking technologies

These high-level trends can be broken down into 7 trends that Gartner reports, along with the takeaways CISOs to manage the risks associated.

1.    Attack Surface Expansion

For enterprises, the attack surfaces are expanding, exposing them to threats. Remote network access, cloud adoption, complex digital supply chains, increasing use of social media, rising amounts of data, etc. are increasing the scope of all the elements of processes, systems, and information that are vulnerable.

Traditional approaches to cybersecurity are rapidly becoming obsolete and there’s a need to employ new technologies to overcome the risks. Technologies to look forward to include:

• Cyber Asset Attack Surface Management (CAASM)
• External Attack Surface Management (EASM)
• Digital Risk Protection Services (DRPS)

2.    Identity Threat Detection and Response

Identity theft and misuse of credentials is a common security threat. A lot of organizations invest in authentication tools to strengthen security. However, they seem to lack in the department of threat response.

Gartner suggests that security strategists focus on Identity Threat Detection and Response (ITDR) tools which comprise the set of tools to detect a breach and trigger recovery and damage repair.

3.    Digital Supply Chain Risk

Software supply chains are at an increased risk since cyber attackers have realised that these attacks give them good returns. The Log4j vulnerability which is extremely widespread and critical is only the beginning. It’s a matter of time before more vulnerabilities emerge.

To counter these risks, companies now need to be more vigilant while dealing with external suppliers and third-party entities. Best practices include:

• Risk assessment for every third-party interaction
• Requesting evidence of security controls while dealing with external entities
• A major shift in the approach to risk management by being proactive in security

4.    Vendor Consolidation

Traditionally, companies have relied on multiple vendors to take care of different security threats. This often leads to complexity and increased costs for cybersecurity maintenance.

CISOs need to look towards Vendor Consolidation to bring all security measures under a single umbrella. Gartner predicts that by 2024, 30% of enterprises will engage the same vendor for multiple security products to cover all threats across different systems and networks.

5.    Cybersecurity Mesh

Vendor consolidation for security products calls for security architecture components to be integrated. It also needs consistent security policies across all security products to ensure consistency in security coverage as well as in the secure exchange of information between security products.

CISOs must look towards implementing a Cybersecurity Mesh Architecture (CSMA) to cover all systems – both onsite, remote, and in the cloud.

6.    Distributing Decisions

Cybersecurity is often seen as the responsibility of only the IT department in an enterprise. This means right from strategizing security to executing it is largely centralized. The security decisions, as well as accountability, lie only with a specific group of people.

To have a more exclusive security culture, Gartner suggests a more agile approach. It thus becomes the CISO’s job to bring everyone on board and help them understand their security liabilities. As far as the security decisions are concerned, the top leadership should be made duly aware of the risks so that they can make informed decisions.

7.    Beyond Awareness

Human error remains the top reason for security breaches. And even though companies are aware of this and take measures to prevent human errors, clearly, the approach isn’t working as expected.

Now, CISOs cannot rely on traditional awareness and training programs to help users be more aware of the risks. The current trend is to adopt Security Behaviour and Culture Programs (SBCPs) to promote a culture of security that becomes a part of the organizational culture. These programs go beyond just awareness and promote an internalized behaviour that is more in line with security needs.

The way forward for CISO strategy

These trends are a call for change in the security strategy in organizations. CISOs must look to create a new roadmap to achieve the organization’s security goals in a way that all bases are covered.

Digital transformation and advanced technologies are increasing the attack surfaces. At the same time, attack technology is also evolving. A proactive approach to security is what CISOs need the most today. Identity Access Management (IAM) and Privilege Access Management (PAM) are more relevant now to allow secure access regardless of location and device.

The other important takeaway that stands out is getting the thousands of users at an organization to understand risks and take ownership of managing them. CISOs need to find sustainable ways to make risk management and vigilance a core behaviour in users. When all stakeholders, from top leadership to workers on the ground, are actively involved in security initiatives, the organization is better poised to deal with threats.

Know more about how the 6clicks platform can help in GRC implementation by getting in touch with our team for a free tour of the platform.

Related useful resources

• 5 key questions every CEO must ask about the cybersecurity program

• Considerations when shopping for cyber insurance

• Responsibilities of top management for ISO 27001 implementation

• Responding to Australia's new critical infrastructure laws