As we adjust to the welcome easing of restrictions under lockdown level 3, we’re all acutely aware that life is still far from normal. COVID-19 will be with us for the foreseeable future, and measures like social distancing and face masks are the “new normal”. And so is remote working. Many sectors of the economy have re-opened, and numerous people have gone back to work (though plenty of businesses are operating at reduced staffing levels so that appropriate distance between workers can be maintained). However, most knowledge workers continue to work from home. All over the world, employees who can work remotely are being encouraged to do so.
What does this mean for the security of your information and your systems? What steps should you, as a business owner or senior executive, be taking to ensure your network and your data are not compromised by unintentional security lapses or weak links in your security chain? Do all your employees know how to keep your system safe?
In this article we’ll look at the threats to cybersecurity posed by COVID-19 and lockdown conditions, how to recognise if you’ve been penetrated, and…the good news…how you can prevent it.
Organisations are seeing an increase in cyber threats such as email phishing, endpoint security gaps and other problems, as they have had to pivot to a fully remote workforce with minimal time for preparation. What are the key points of concern for you?
COVID-19 has created a veritable playground for hackers and cybercriminals for multiple reasons. Firstly and most obviously, many people are working from home, all over the world. This means they are accessing their company networks via home-based WiFi networks, possibly on personal devices. Home networks often have weaker protocols than corporate systems. Different countries have different levels of security protocols as the norm. There are even some WEP networks still in existence, though fortunately very few. South African security standards are high, but the global nature of business means your employees may be interacting with colleagues or customers anywhere in the world.
Working from home during lockdown is not like remote working during “normal” times. Remote workers, as opposed to employees who occasionally work from home, tend to be fully equipped. They have a dedicated office space, corporately sanctioned devices and equipment (printers, etc.), and have an appreciation of the importance of IT security. Home workers, by contrast – particularly right now – are making the best of sub-optimal conditions. They may be working at a kitchen table, and juggling supervision of online school lessons or caring for infants or elderly relatives. Therefore, they may not always be seated at a desk, in front of a secure, company laptop. They may choose to check email on their cell phone or Zoom in on a meeting on a tablet. There are multiple endpoints involved in each day’s interactivity, and this creates huge opportunities for hackers.
Furthermore, as households become increasingly “smart”, the internet of things (IoT) creates additional endpoints that need securing. Most workers are unlikely to consider their fridge or music system a part of their corporate network, but these devices represent access points for hackers.
Anyone who claims to be immune from phishing scams is lying. Some of the most alert, conscientious people have found themselves prey to phishing. This is because scamsters use increasingly sophisticated techniques to convince us they are legitimate. It is always important to be on the look-out for phishing emails, but right now, the problem is acute. Why? Because the world is united with a single concern. Therefore cybercriminals can be lazy; they don’t have to home in on local concerns in any particular jurisdiction. The shared crisis of COVID-19 has created a universal weak spot.
Phishing attacks in the last three months have included lures to information on the pandemic as well as offers of cures, personal protective equipment (PPE), and even invitations to invest in companies producing vaccines or to donate to relief efforts (which seems particularly iniquitous, but it plays on emotional vulnerability and a general willingness of the better-off to help those in need – and is a great way to harvest cash as well as identity information).
Your employees are probably accessing your network via a VPN. But if you are using a hardware-based, legacy VPN, you could be inviting trouble. Legacy VPNs can be less than 100% secure.
It is vital that you train your employees on what to look out for. Workers who are used to an office environment which is policed and protected by the IT department may be unsophisticated when it comes to recognising threats in their home environment. Very few people are completely ignorant of cybercrime but having a Gmail address or Facebook identity hacked is probably the most serious penetration the domestic user has experienced. Cybercriminals are much more interested in corporate data because the potential for gain is so much greater. What, then, are the red flags your staff need to be aware of?
You can’t expect your employees to become IT experts overnight. After all, you employ them because they are experts in what they do. IT is simply a tool that enables them to do their job. However, everyone needs to have a certain level of IT literacy, especially right now. Teach your teams what to do in the event of a cyberattack. Encourage them to be on the look-out for these warning signs, and to inform your IT helpdesk immediately:
This may sound scary, but don’t let it keep you up at night. Hackers are endlessly innovative and spend all their time trying to get one step ahead, but you are not defenceless. There is something you can do about it. While you can’t eliminate all risk, you can identify the biggest threats to your business and put measures in place to contain them. We can help you safeguard your environment. Our Threat Intelligence Cyber Warfare Center has been designed as a multi-tenant managed security service provider (MSSP). We will help you secure your endpoints, manage IoT vulnerability, identify phishing requests, and detect and respond to threats, especially the ones you haven’t even thought of yet.
Like COVID-19, cybercrime has no nationality. It can cross borders undetected. NEWORDER can protect your organisation from serious information security threats from any source through our combination of leading-edge information security solutions and our professional skill set.
Evolving threats, expanding compliance risks, and resource constraints require a new approach to cyber and information security. The NEWORDER “Threat Intelligence Cyber Warfare Center” assist businesses to meet their cyber and information security needs by connecting them to award-winning security platform, cutting-edge threat intelligence, and expert defenders to provide the best business security solutions 24/7, regardless of their size or technology environment.
The NEWORDER “Threat Intelligence Cyber Warfare Center” has been designed to operate as a multi-tenant managed security service provider (MSSP) to integrate our professional security as a service (SECaaS) model into any organisation’s infrastructure on a subscription-based or SLA-based model.
Our managed service model is designed for maximum cost-effectiveness. The South African economy, along with all the world economies, has been hit hard by COVID-19. We know that businesses – many of them our clients – are struggling in the current environment. We will put together a package that meets your specific requirements and keeps you safe. You won’t pay for functions you don’t need. The consequences of cyberattacks are more than financial. Your reputation can suffer, and you can divert a lot of time and resources into putting things right. Your client data may be impacted, and your client relationships could even be jeopardised. Investment in your cybersecurity is money well spent.
A managed service contract allows you to budget and manage the cost of your information security proactively, so you can rest easy in the knowledge that your systems and your data are safe.
