Before the coronavirus pandemic, working from home was often used as a company perk, a reward, or a one off when you had an important Amazon delivery. Now, in our post pandemic world, working from home has become the ‘new normal’. Many employers are still working 100% remotely and others are phasing back into the office with a hybrid model.
It has been a massive adjustment for most of us, and companies have had to accelerate their digital transformation, leaving their cybersecurity methods exposed.
Cyber attackers have used the pandemic as an opportunity to step up their criminal activity by exploiting home workers. Scarily, 47% of people fall for a phishing scam while working from home and there has been a 630% increase in cloud-based attacks between January 2020 – April 2020.
We spoke to two local Cybersecurity experts for their take on how the pandemic has affected their industry and tips on how we can mitigate these risks.
Has the pandemic impacted cyber security?
There is no doubt the Covid-19 pandemic has had a major impact on cyber security, a massive increase in remote working combined with the growth of consumers use of e-commerce has presented organisations with new challenges and increased risk. We have seen our own customers accelerate and reprioritise security related projects in response to these challenges.
Gary Skelton - Imperva
I don’t think there is a facet of our lives which the pandemic hasn’t touched, and cyber security is no different. Malicious actors are always looking for new and novel ways to exploit the gaps in knowledge or vigilance to their benefit. With more and more of our lives moving online, this increases the attack surface for attackers to aim for, whether that be in pandemic themed phishing or targeting applications which are seeing a rise in uptake during these troubled times
Colleen Bradley - Cygilant
What are the main risks you have seen?
Home working has become the new normal, with this comes increased risk due to the use of personal devices and network equipment for conducting business or accessing corporate networks and resources. We have also seen increased risk due to vulnerabilities in collaboration tools, the increased reliance on video conference software and also Covid-19 themed phishing scams.
Gary Skelton - Imperva
The risks from cyber security come from a lack of security awareness or security controls. All it can take is one user to click on the wrong link on a computer with outdated or absent endpoint protection and that can be enough of a foothold to enable attackers to wreak havoc.
Colleen Bradley - Cygilant
What are the most common hacking methods?
Specific to the pandemic, Covid-19 themed phishing scams have been quite prevalent along with ransomware campaigns. With our own customer base, the common vulnerabilities in the OWASP top 10 such as SQL injection and cross site scripting are still important threats they want to protect against as well as DDoS attacks and advanced bot mitigation.
Gary Skelton - Imperva
Most hacking methods which the average consumer or business will observe will be mass, automated attacks perpetrated by scripts and bots across the world. This is usually represented in threats such as attempts to guess passwords for accounts, phishing, and exploitation of common vulnerabilities in widely used software.
Colleen Bradley - Cygilant
When it comes to cyber security challenges, which of these issues are high on your agenda?
As a security vendor, I would have to say all of them, that’s what our customers expect. Our own threat research team are continually working to keep up to date on emerging threats and vulnerabilities to allow us to provide our customers with the best level of protection.
Gary Skelton - Imperva
Cyber security operates in layers, with different protections for different technologies or entry points for attackers. In the end, your cyber security strategy is only as strong as its weakest point. If you have a world clash phishing protection implementation but use commonly guessed credentials for your web facing hosts then your risk of overall breach hasn’t reduced substantially. Attackers only need to get lucky once, but as defenders we need to have a strategy to solve for the whole attack service to gain the level of protection we need
Colleen Bradley - Cygilant
What are the biggest cybersecurity threats right now? Which concern you most?
The increase in remote working and the challenges this poses to organisation’s security teams is probably the biggest threat right now. The pandemic has shown how productive and effective people can be doing their jobs from home, companies are considering a hybrid type work model for the future, security teams will have to adapt to this new normal.
Gary Skelton - Imperva
The continued rise of nation state activity impacting worldwide companies as collateral damage is a concern for all defenders in all sectors. The recent SolarWinds breach is a good example of this, and we all hope these are very rare sporadic high-profile incidents and not something we start to see in increasing frequency
Colleen Bradley - Cygilant
How has your company adapted their information security policies internally?
Yes, our own internal policies have had to adapt to the majority of the company’s employees carrying out their roles remotely. How we manage access to systems and resources, the increased use of our secure tunnels and the increase of online collaboration tools and video conferencing have played a significant part.
Gary Skelton - Imperva
All internal policies needed to be reconsidered in a world of remote working, including how to ensure that staff have appropriate breaks and wellbeing considered in how a business operates. Flexibility and allowing staff more autonomy in their work / life balance is key for maintaining good productivity in this new normal and is liable to be a strong factor going forwards
Colleen Bradley - Cygilant
How can organisations mitigate these risks?
Review their cyber security posture with remote working as a key consideration, also revise business continuity and incident response plans to help project themselves if critical systems do go down.
Gary Skelton - Imperva
A commitment to cyber security at the top of a business is one of the most common factors to mitigation of cyber risks across the board. If the leaders at the top state that it’s an important business goal then the rest of the organization will follow, and that’s a recipe for success in cyber as in almost any other venture.
Colleen Bradley - Cygilant
References
https://www.tessian.com/blog/why-we-click-on-phishing-scams/
https://www.dbxuk.com/statistics/cyber-security-risks-wfh