In a global survey commissioned by Barracuda, a prominent security company, 46% of global businesses have encountered at least one cyber scare since adopting a remote workforce as a result of the stay at home orders from COVID-19. While the security scares vary in severity, they all present a diverse range of new risks, threats, and challenges for organizations. These elements are only expected to increase as cybercriminals seize the situation to make a profit or nation-states try to gather intel.
Speed, the enemy of robust security
Several of the cybersecurity issues that arose from the new remote workforce are a result of the rushed transition. Many companies instantly implemented work from home without fully recognizing the plethora of security challenges. This predominantly came out of health and safety concerns for employees, but also legal insinuations. It is worth noting that the companies who executed a remote workforce without deliberately contemplating how their remote security posture would mold to factor in the new environment are not negligent, but simply you don’t know - what you don't know. Interestingly, Barracuda concluded that 55% of organizations would not have implemented remote working within the next 5 years, had it not been for the COVID-19 crisis. As such, it comes as no surprise that speed and urgency in an effort to continue standard business operations resulted in putting cybersecurity on the back burner.
Barracuda’s research exposed that two in five businesses (40%) have openly admitted to cutting their cybersecurity budget to cut costs during the pandemic. This is perhaps one of the worst times to reduce security efforts because ambitious hackers are on the lookout for vulnerable organizations who may have poor security because of the rapid remote adoption. When organizations deprioritize security, cybercriminals see this as the perfect opportunity to create havoc and benefit financially through stealing data, intellectual property, or other nefarious activities.
Because COVID-19 escalated so quickly, considering things like employees using personal devices to exchange and share sensitive data was never considered. Barracuda’s research found that 50 percent of employers allow employees to use personal email addresses to conduct company work. This comes as particularly terrifying news as phishing emails and COVID-19 themed scams have skyrocketed during the pandemic. Unfortunately, phishing emails are a common vector for ransomware deployment and data exfiltration.
Moreover, within the healthcare industry, organizations are relying on their information systems to treat patients. In which case the massive rise in attacks on already vulnerable IT systems in healthcare and an exacerbated pandemic is the perfect storm for a ransomware campaign. This is quite scary for healthcare organizations because a nurse or doctor literally cannot do their job without the technological infrastructure. In addition, the FBI and DHS issued warnings that China, Iran, and other countries are looking to steal American research on COVID-19 vaccines through launching cyber attacks. Nation state threat actors pose as severe threats because they often exercise advanced infiltration techniques that are difficult to protect, detect, and eradicate before severe damage has occurred.
Surviving the Pandemic
Barracuda’s research found that 51 percent of businesses say their workforce is not proficient or properly trained in the cyber risks associated with long-term remote work. This staggering number implies that many organizations are ill-prepared to survive the new norm. What’s more, is that cybercriminals are quick to exploit weak and vulnerable services like virtual private networks which are critical to facilitating remote work and thus this amplifies the criticality for organizations to secure their architecture. Managing a remote workforce does not have to be tiresome and boils down to basic security hygiene coupled with fostering a strong remote workforce culture.
One thing every business can do is review the endpoint devices employees are using. Is there adequate security on the devices connecting to the company network? This is a fundamental security concern as the security of employee configured and managed laptops vary significantly when compared to a company managed asset. Additionally, continual verification of endpoint security via patching, updates, and antivirus should be heavily considered when dealing with employee’s personal devices. It is also important to take industry and legal compliance into consideration to avoid repercussions like fines from storing confidential information on insecure devices.
As commonly echoed “communication is key,” cheesy as this sounds it couldn’t be closer to the truth. Maintaining constant communication in a secure manner is key to surviving the hurdle of a prolonged remote workforce. In addition, employees are the first line of defense as there is no longer a “go-to” IT security team in their home office. Threat actors will undoubtedly continue to launch sophisticated social engineering attacks as means for infiltrating your corporate network.
Employees who are not aware of resources and communication channels to report security issues or suspicious emails may try to find solutions that put themselves and your company at risk. Which leads us to the next concept of how companies are exercising oversight into their personnel in relation to the heightened cyber risks? A lengthy email may not be as engaging or effective in getting messages like phishing training across. In a previous blog, we dissected viable solutions for long term remote endpoint security, security training, patch management, facilitating secure remote connections, and other work from home considerations.
Instead of falling into the dangerous mindset that the pandemic will go away soon and thus, assuming security can hold off for a bit, organizations can focus on using this fast-moving situation to improve their cyber activities and even gain a competitive advantage. Even if the pandemic were approaching its end, which would be incredibly convenient with summer right around the corner, cyber-attacks will never cease or become any less of a risk. Additionally, with many companies going into the third and fourth months of remote working, now is the perfect time to refocus on security and acclimate how short-term setups can shift into long term business benefits post pandemic.
Silent Sector knows that allocating resources and support to improve cyber resilience can be a daunting task, however, we also believe that with our guidance a strong security posture is attainable for not only your remote workforce, but organizations in general despite COVID-19. Contact us today to hear how we can help your business incorporate fundamental security precautions through our state of the art security services to confirm the safety of your organization's devices, data, and infrastructure- thereby reassuring your customers and giving you freedom from additional worry.