increasingly being targeted by threat actors), in order to adapt to changes in working practices, as these technologies could compromise their security posture.
Lessons in Information Security: Post COVID-19 The COVID-19 pandemic has developed into a real and significant threat to a huge number of organisations around the world, forcing them to completely rethink how they operate – both on a day-to-day basis and over the long term.
A
recent survey found that 84% of organisations anticipate broader and permanent working from home (WfH) programmes.[1] With the expectation that WfH will increasingly be accepted as a reality by many organisations in the post-COVID-19 world, there are some valuable lessons relating to information security that can and must be learned in order to avoid the potentially increased risks associated with it. Some of these increased risks include: COVID-related Phishing Attempts and Malware Attacks Cyber criminals have embraced the opportunity that the virus has presented them, with reports of phishing attempts and malware attacks increasing by as much as 30,000% from January to March this year, and
26
the registration of 130,000 new suspicious domains featuring COVID-related keywords.[2] Business Email Compromise (BEC)/ Chief Executive Officer (CEO) Fraud BEC/CEO fraud is where a threat actor impersonates an organisation’s executives in order to deceive employees into sending money or sensitive information to a fraudulent third party. Mimecast’s global customer threat intelligence data highlights the fact that impersonation fraud increased by 30% in the first 100 days of COVID-19.[3] Misuse of Devices Increased use of an organisation’s devices for personal activities when WfH – and, conversely, when using personal devices for work activities – further exposes an organisation’s assets. According to the 2020 COVID-19 State of Remote Work Survey Report[4], employees are practising poor information security while WfH, with 33% having downloaded a personal application without approval, 36% accessing work applications from personal devices, 45% having shared their work device with their spouse, partner or children, and 17% visiting adult sites on a work device. Insecure Devices, Technologies and Remote Connections Insecure devices, technologies and remote connections increase the risk of being affected by malicious or inappropriate actions and the damage they cause. Implementation of New or Unproven Technologies Organisations should be wary of rushing to implement new or unproven technologies, such as cloud storage and collaboration tools (which are
Workspace Privacy When WfH employees will often have a relaxed sense of security, as well as facing numerous distractions that could cause issues with confidentiality and data integrity. Tripwire’s Remote Work and COVID-19 Cybersecurity Impact Report[5] found that 49% of organisations felt that they were not able to effectively secure employees’ home environments. Employee Stress Something that is often overlooked is that increased financial pressures, difficulty finding a work–life balance and concerns about loss of employment can have a negative effect on employees’ health, wellbeing and performance. They may also be more susceptible to being coerced, persuaded or exploited by competitors into disclosing sensitive information. The following actions can help reduce, if not entirely prevent, many of these risks: • Create secure working environments by: • • • • • • • • • • • •
implementing a clear desk policy locking screens having privacy screens using web cam covers using headphones establishing strong and unique passwords implementing two-factor authentication (2FA) or multi-factor authentication (MFA) securing Wi-Fi access points ensuring antivirus and firewall software is up to date using tried, tested and trusted cloud technologies and collaboration tools encrypting data at rest using a virtual private network (VPN) connection.
• Increase information security awareness training and advice on COVID-related fraud and phishing attacks. • Take a disciplined approach to using
