Atlantic Council reviews 2021 cyber landscape

Atlantic Council experts reflect on 2021's major cyber events including SolarWinds, Log4Shell, and ransomware surge, highlighting policy responses and identifying under-addressed threats for 2022.

In a year-end retrospective, Atlantic Council cyber experts assessed 2021's cybersecurity landscape, which opened with the Biden administration confronting the SolarWinds Sunburst supply-chain compromise and closed with the Log4Shell vulnerability—both highlighting systemic software supply-chain risks. Ransomware dominated public attention throughout the year, affecting critical infrastructure including Colonial Pipeline and JBS, with approximately 90 percent of Americans now viewing cyberattacks as concerning.

Experts identified varied organizations as most impactful, from the 17-country law enforcement counter-ransomware operation to the US government's policy push and cyber insurers' growing influence over security practices and ransom payment decisions. Key policy developments included Biden's Executive Order on Improving the Nation's Cybersecurity and the Infrastructure Investment and Jobs Act's $1.9 billion cybersecurity allocation. Under-covered incidents included the Oldsmar Water Plant intrusion and cloud environment compromises by NOBELIUM.

Looking toward 2022, experts emphasized unaddressed issues including remote workforce security gaps, mobile device vulnerabilities, and the need for better cyber risk quantification through initiatives like a proposed Bureau of Cyber Statistics. All agreed ransomware would continue dominating the threat landscape, requiring sustained multilateral action and attention to related policy areas like cryptocurrency regulation and mandatory security reporting.

Source reporting: https://www.atlanticcouncil.org/content-series/the-5x5/the-5x5-hindsight-2021-cybersecurity-is-hard