Ministry of Science and ICT·KISA Release
'2021 Analysis and 2022 Outlook' on Cyber Threats
Corporate Security Integration Essential... Individuals Must Also Be Cautious
[Asia Economy Reporter Minyoung Cha] The year 2021 saw a sharp increase in cyber threats worldwide. Overseas, ransomware attacks targeted infrastructure facilities such as energy and food supply chains, while domestically, institutions and companies including the Korea Atomic Energy Research Institute and Korea Aerospace Industries (KAI) suffered hacking attacks. Personal privacy videos obtained by hacking apartment wall pads were traded on the dark web, and the Log4j vulnerability issue also surfaced. The government warned that "the cyber environment will worsen next year" and urged caution for both companies and individuals.
This Year’s Indiscriminate Ransomware and Wall Pad Hacking
The Ministry of Science and ICT, along with the Korea Internet & Security Agency (KISA), announced on the 26th the '2021 Cyber Threat Trend Analysis' and '2022 Cyber Threat Outlook,' which included these details. Major domestic security companies such as AhnLab, BitScan, ESTsecurity, Hauri, INCA Internet, and NSHC participated in the outlook for next year.
The main characteristics of this year’s cyber threats were ▲ransomware attacks indiscriminate of targets ▲the non-face-to-face service environment becoming a hacker target ▲and hacking of wall pads penetrating daily life.
Statistics on ransomware damage show that vulnerable small and medium-sized enterprises account for 93%, and regions outside Seoul account for 63%. In particular, 65% of cases were difficult to recover from ransomware damage due to lack of data backups. Cases exploiting vulnerabilities in remote security access programs, emails, and VPN solutions increased due to remote work and education environments. VPN solutions are internet line services that ensure security such as data encryption for remote environments like telecommuting. Many domestic apartment wall pads were hacked, and privacy videos were openly sold on the dark web.
Prolonged Log4j Issue... Increasing IoT and Cloud Threats
The government and major security companies expect cyber threats to continue next year. Key features include ▲the prolonged Log4j vulnerability issue and supply chain security threats ▲increasing cyber threats targeting various Internet of Things (IoT) devices ▲the ongoing battle against ransomware ▲cloud security threats to core infrastructure of the digital transformation ▲emergence of new threats targeting new technologies such as metaverse, non-fungible tokens (NFT), and artificial intelligence (AI) ▲and continued smishing and hacking emails exploiting social issues.
The Log4j vulnerability issue that struck the world this month also requires user caution next year due to the complexity of resolution. Log4j is an open-source (free) program used to record a series of logs during program operation. The Ministry of Science and ICT pointed out that "strengthening security throughout the software development life cycle (SDLC) from software development to maintenance from the user’s perspective is necessary."
As attack attempts targeting IoT devices such as wall pads continue, cyber threats to IoT devices in general?including AI speakers, smart TVs, IP cameras, drones, and smart cars?are expected to increase. According to IoT Analytics, the number of IoT connected devices is estimated to more than double from 13.8 billion in 2021 to 30.9 billion by 2025.
Ransomware issues will also persist. New types of crimes are expected to emerge in the fields of virtual assets, which are difficult to trace, and Ransomware as a Service (RaaS). RaaS is a service where ransomware development, distribution, and management are divided into specialized roles. The Ministry of Science and ICT explained, "Ransomware attacks will continue in forms that increase attempts to disable companies’ ransomware defense systems, especially backup systems, followed by dark web public threats as bait for recovery, and demands for virtual assets that are difficult to trace."
Security threats related to cloud, a core foundation of the digital transformation era, are also expected to increase. Cloud computing inherently contains security threats due to characteristics such as resource sharing and virtualization. IT resources and user information are concentrated, making them easy targets for hacking, DDoS attacks, and others. The scale of damage can also be larger when incidents occur.
Additionally, new cyber threats targeting new technologies such as metaverse, NFT, and AI are anticipated. With the COVID-19 situation and the March presidential election approaching, crimes exploiting social issues such as smishing and hacking emails are also a concern. Intelligent phishing crimes based on personal information are expected to increase, requiring individual caution.
Hong Jin-bae, Director of Information Security Network Policy at the Ministry of Science and ICT, said, “There are signs that resolving the Log4j vulnerability will be prolonged, and cyber environments will worsen due to smishing crimes exploiting social issues and new threats targeting new technologies such as metaverse. Companies must consider security by design as essential, and citizens should make it a habit to follow information protection practices to create a safer digital world together.”
© The Asia Business Daily(www.asiae.co.kr). All rights reserved.
