2021 Cyber Year in Review: Experts Weigh In
Atlantic Council experts reflect on SolarWinds, Log4Shell, and ransomware's dominance of 2021 and forecast continued ransomware risk in 2022.
Sourceatlanticcouncil.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2021-44228 as exploited in the wild.
This is a retrospective policy piece from the Atlantic Council's Cyber Statecraft Initiative, gathering expert commentary on the defining cybersecurity events and policies of 2021. It highlights the SolarWinds/Sunburst supply-chain espionage campaign disclosed in late 2020, the Log4Shell vulnerability disclosed in late 2021, and the surge of ransomware attacks affecting critical infrastructure (Colonial Pipeline) and food supply (JBS meat processing), which drove unprecedented public concern about cyberattacks.
Experts discuss the most impactful organizations and policies of the year, including a 17-country INTERPOL-coordinated ransomware law enforcement operation, the US Executive Order on Improving the Nation's Cybersecurity, and the Infrastructure Investment and Jobs Act's cybersecurity funding. Under-covered incidents mentioned include the Oldsmar water treatment plant intrusion attempt, NOBELIUM's exploitation of trusted cloud relationships for lateral movement (following the SolarWinds campaign), and the Howard University ransomware attack. The piece is largely a policy and trends discussion rather than a technical threat report, with consensus that ransomware will remain the dominant cybersecurity issue into 2022.
Mentioned in this report
Source reporting: https://www.atlanticcouncil.org/content-series/the-5x5/the-5x5-hindsight-2021-cybersecurity-is-hard
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs, actors, and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,572 reports from 147 sources, 724 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs