Gartner highlights seven critical trends that security and risk management leaders should address in 2022 and beyond.
"Organisations worldwide are facing sophisticated ransomware, attacks on the digital supply chain and deeply embedded vulnerabilities," says Gartner research vice president, Peter Firstbrook.
"The pandemic accelerated hybrid work and the shift to the cloud, challenging CISOs to secure an increasingly distributed enterprise, all while dealing with a shortage of skilled security staff."
He says these challenges lend themselves to three overarching areas impacting cybersecurity practices, new responses to sophisticated threats, the evolution and reframing of the security practice and rethinking technology.
According to Gartner, the following seven trends will have a broad industry impact across those three areas:
1. Attack surface expansion
Enterprise attack surfaces are expanding. Risks associated with using cyber-physical systems and IoT, open source code, cloud applications, complex digital supply chains, social media, and more have brought organisations exposed surfaces outside a set of controllable assets. Organisations must look beyond traditional security monitoring, detection, and response approaches to manage a more comprehensive set of security exposures.
Digital risk protection services (DRPS), external attack surface management (EASM) technologies and cyber asset attack surface management (CAASM) will support CISOs in working out internal and external business systems and automating the discovery of security coverage gaps.
2. Digital supply chain risk
Cybercriminals have realised attacks on the digital supply chain can provide a high return on investment. As vulnerabilities such as Log4j spread through the supply chain, more threats are expected. Gartner predicts that by 2025, 45% of organisations worldwide will have experienced attacks on their software supply chains, a three-fold increase from 2021.
3. Identity threat detection and response
Sophisticated threat actors actively target identity and access management (IAM) infrastructure, and credential misuse is now a primary attack vector. So Gartner has introduced the term "identity threat detection and response" (ITDR) to describe the collection of tools and best practices to defend identity systems.
"Organisations have spent considerable effort improving IAM capabilities, but much of it has been focused on technology to improve user authentication, which increases the attack surface for a foundational part of the cybersecurity infrastructure," says Firstbrook. "ITDR tools can help protect identity systems, detect when they are compromised and enable efficient remediation."
4. Distributing decisions
Enterprise cybersecurity needs and expectations are maturing, and executives require more agile security amidst an expanding attack surface. So the scope, scale and complexity of digital business make it necessary to distribute cybersecurity decisions, responsibility, and accountability across the organisation units and away from a centralised function.
Firstbrook says the CISO role has moved from a technical subject-matter expert to an executive risk manager. "By 2025, a single, centralised cybersecurity function will not be agile enough to meet the needs of digital organisations. CISOs must reconceptualise their responsibility matrix to empower Boards of Directors, CEOs and other business leaders to make their own informed risk decisions."
5. Beyond awareness
In many data breaches, human error continues to be a large factor. This potentially demonstrates that traditional approaches to security awareness training are ineffective. Some organisations invest in holistic security behaviour and culture programs (SBCPs) rather than older compliance-centric security awareness campaigns. An SBCP focuses on fostering new ways of thinking and embedding new behaviour to provoke more secure working methods across the organisation.
6. Vendor consolidation
Security technology convergence is accelerating, driven by the need to reduce complexity, reduce administration overhead and increase effectiveness. New platform approaches such as extended detection and response (XDR), security service edge (SSE) and cloud-native application protection platforms (CNAPP) are accelerating the benefits of converged solutions.
Gartner predicts that by 2024, 30% of enterprises will adopt cloud-delivered secure web gateway (SWG), cloud access security broker (CASB), zero-trust network access (ZTNA) and branch office firewall as a service (FWaaS) capabilities from the same vendor. It says consolidation of security functions will lower the total cost of ownership and improve operational efficiency in the long term, resulting in better overall security.
7. Cybersecurity mesh
The security product consolidation trend is driving the integration of security architecture components. However, there is still a need to define consistent security policies, enable workflows and exchange data between consolidated solutions. A cybersecurity mesh architecture (CSMA) helps provide an integrated security structure and posture to secure all assets, whether they're on-premises, in data centers or the cloud.
"Gartner's top cybersecurity trends don't exist in isolation; they build on and reinforce one another," says Firstbrook. "Taken together, they will help CISOs evolve their roles to meet future security and risk management challenges and continue elevating their standing within their organisations."