Cybercrime during COVID-19
The year 2020 has brought unprecedented disruption, change and the need for adaptation to businesses and organisations across the world. While business leaders have faced and confronted a slew of challenges that were unprecedented prior to COVID-19, cybersecurity issues continue to not only remain a concern, but become a more challenging force, causing organisations to re-examine their cybersecurity and remote work capabilities as they continue to move forward.
Cybercrime such as phishing attacks have increased by 300 per cent since the start of 2020 compared to the same period last year, with new research revealing that the reason is due to more people working from home.
This increase was seen as a result of confidential information being sent and received from personal devices rather than secure office networks, sensitive data became potentially exposed to a new wave of targeted attacks and scams.
Even though many employees have returned to the office, as businesses move forward through the virus and beyond, the consideration of continuing remote working for employees remains a favourable option for businesses wishing to modernise their processes. Although this will host a myriad of positive benefits including an improved work/life balance, improved mental health, and improved productivity, there is also cause for concern if your business and employees do not reflect best cyber security practices.
Phishing emails and other communication methods have improved over the years, with many scammers pretending to be from real and well-known businesses such as banks, travel agents, insurance providers, phone companies, and even from your business manager, using excuses around COVID-19 or similar concerns to either ask for your personal and financial information, lure you into opening malicious links or attachments, gain remote access to your computer, seek payment for a fake service, or ask you to pay for something you hadn’t purchased.
Businesses and employees need to be aware of not only how cybercrime can jeopardise business and personal data, but need to be aware of how to prevent being a victim of an attack.
What can businesses do to protect from cybercrime during COVID-19?
1. Take care of your technical hygiene
This is something you should be doing already, but if you’re not up-to-date, now is a good time for you and all staff to tick some basic items off, including:
- ensuring strong passwords are in place, not only for your computers but also for staff’s home Wi-Fi.
- ensure that you have reliable VPN technology (more on this below) installed to secure your remote connections.
- check that the software that you currently use is patched with the latest versions of fixes.
2. Be vigilant
Educate your staff that the incidence of cyber-attacks is rising, and the number of phishing emails and scams that are being circulated is increasing daily. If everyone within your business is vigilant, then they will more likely be cautious and check that emails or texts that they receive are coming from reputable sources before acting. Ask them to be particularly aware of poor grammar, design quality and a false sense of urgency in any communication they receive.
3. Turn on multi-factor authentication (MFA)
Multi-factor authentication (MFA) software helps improve security across a company by requiring additional authentication measures for access to sensitive information, systems, or applications. Instead of a simple username and password input, users are prompted to provide SMS code, biometric verification (such as facial recognition), or email confirmation actions to properly verify their identity. Businesses should use these tools to add a secondary confirmation that individuals accessing privileged information are who they say they are.
4. Back up your data regularly
Backups should be done and tested on a regular basis. A copy of your backup data should be stored off site as well in case the building burns down etc.
Additionally, if your backup solution is connected to your network it will also fall victim to a ransomware attack, therefore backups should be kept offline on hard drives or other external devices.
BONUS: Confirm your ability to manage logs remotely (if you have IT staff)
Ensure that your IT staff are able to monitor your security remotely so they can maintain visibility across the network when working from home. This will allow you to proactively monitor your cyber environment and respond quickly if a potential attack is in progress rather than waiting until after an incident to understand what has happened.
What can employees do to protect their devices and data while remote working?
1. Avoid public Wi-Fi; if necessary, use personal hotspots or some way to encrypt your web connection.
Public Wi-Fi introduces significant security risk and should be avoided if possible. If you need to access the internet from a public Wi-Fi location, a good option is to use a personal hotspot from a dedicated device or your phone. Although some of your web traffic could be unencrypted between the hotspot and its destination, using a hot spot does eliminate the problem of getting hacked by people on the same public Wi-Fi with man-in-the-middle attacks.
If implemented by your company, a VPN for remote access will provide a flexible connection to connect to the office from home. A VPN gives you online privacy and anonymity by creating a private network from a public internet connection. VPNs mask your internet protocol (IP) address so your online actions are virtually untraceable. Most important, VPN services establish secure and encrypted connections to provide greater privacy than even a secured Wi-Fi hotspot.
2. Keep work data on work computers
Thinking about taking care of a few emails at home before bed? If you take precautions like using your work computer, secure Wi-Fi, a VPN, encrypted drives, and endpoint protection, this may be totally fine. With that said, it can be tempting to use your personal computer if your work computer is in a different room or you forgot your charger at the office. This is a risk for you and the company!
If you work at an organization with an efficient IT team, they may be installing regular updates, running antivirus scans, blocking malicious sites, etc., and these activities may be transparent to you. There is a good chance you have not followed the same protocols with your personal computer as are mandatory at work.
If your employer gives you access to a portal or remote access environment such as Office 365, you can work online and avoid downloading or syncing files or emails to a personal device. It’s always a best practice to keep personal business on personal technology, and only use your work-issued laptop for work-related business.
3. Block the sight lines
If you are at a coffee shop, pay attention to your sightlines. If someone is behind you, they can see everything you are typing- this is known as shoulder surfing. Furthermore, someone with the right observational skills (like a cybercriminal) could easily watch what you are doing and identify confidential information. Additionally, keep your devices with you; in the time it takes you to use a restroom, your device could be quickly compromised by a cybercriminal with a USB stick that types pre-programmed sequences at 1000 words per minute.
4. Encrypt Sensitive Data in Emails and on Your Device
Sending emails with sensitive data is always going to be a risk. It could be intercepted or seen by a third party. If you encrypt the data attached to an email, it will prevent an unintended recipient from viewing the information. Also, be sure your device is set to have all stored data encrypted in the case of theft.
BONUS: Don’t use random thumb drives
A classic hacking technique is to drop a number of large capacity thumb drives near the company you are hoping to attack. The chances that an unwitting employee will pick up the thumb drive and use it are surprisingly high. All it will take is one staff member to open the files on the drive and then BINGO- the hacker is in.
Never use a thumb drive if you don’t know where it came from and do not continue to use one if you have plugged it into a system for whose safety you cannot honestly vouch.