Now Is the Time to be Vigilant Amidst Increasing Cyber Attacks

While remote work and working from home are convenient and just a way of life these days, the trend is opening the door to cyber attackers, nation states and part-time hackers to take advantage of the hysteria and cast a wide net in a bid to compromise our networks.

Across the board, companies are reporting a huge increase in phishing attempts, email-based malware attacks, email compromise, ransomware and more, and that is because many employees are away from the watchful eye of our coworkers and IT departments coupled with the ongoing coronavirus crisis and political turmoil, says Vince Crisler, founder and CEO of cybersecurity company Dark Cubed.

“Before, when you got that strange, suspicious email, you may look to the person next to you and say, ‘Hey, what do you think about this?’” says Crisler, a former U.S. cybersecurity official who spent time keeping the White House, and Department of Defense secure. “Now, you don’t have that option, and you’re probably busy and distracted by kids and who knows what else until you’re more likely to just click that link and cause some issues.”

Pandemic and politics = increasing attacks

According to several reports and studies, cyberattacks are increasing at an exponential rate, and remote work and the coronavirus play a major role in allowing that to happen.

Cybersecurity and antivirus company Bitdefender found that pandemic-related attacks increased five-fold in the first two weeks of March. In May and June, an average of 60% of all received emails were phony.

According to an FBI official’s interview with The Hill, the agency was at one point receiving more than 3,000 cybersecurity complaints each day, a huge leap from the typical 1,000 daily complaints.

And, Microsoft reported that nation states like Russia, China and Iran are targeting political groups, enterprises and other victims leading up to the U.S. election in November.

Cybercriminals are always advantageous and craft their attacks to take advantage of news cycles. For example, it’s not uncommon for malicious emails to pertain to COVID-19-related issues like vaccines, politics and even the U.S. government’s Paycheck Protection Program that offered businesses a forgivable loan to stem the tide of layoffs and mass unemployment.

“If you’re looking at the survival of your company with the PPP loan process and you get an email about your application being denied unless you click this link, people are going to click and respond to that urgency,” Crisler says.

In the face of rising attacks, there are several things your organization can do to keep networks secure and repel bad actors.

Training end users on these changing attack habits is more important now than ever before

Even if your company has properly deployed a VPN, has fully migrated to the cloud and invested in top-of-the-line cybersecurity defenses and backups to protect against ransomware, there will always be human error.

“It doesn’t matter if your submarine is good for 800 meters – if you install a screen door, it’s not a very good submarine,” says Joshua Liberman, president of New Mexico-based IT services firm Net Sciences, Inc. “You have to armor the end users as well as the endpoints, and that is the hardest thing to do.”

Managed services providers like Net Sciences, Inc. and their software and hardware partners with all of their advanced security tools can’t enforce good cybersecurity practices. That is left up to the end users and their in-house IT staff.

That takes buy-in from management, executives, ownership or some other high-level employee.

Most end users aren’t aware of the evolving threat landscape and how quickly cybercriminals adapt to technological, economic, societal and political changes.

The attacks can be subtle and at first glance, an attack might seem unsuccessful because the attacker didn’t come away with much information and it can be hard for IT professionals to figure out the end game.

“But with some of them, it’s part of a coordinated effort that has been pieced together through various means such as monitoring emails and social media, and cone they have enough information and the ability to spoof a sender, they can launch an effective hack,” Liberman says.

Before the pandemic, when everyone was in the office, end users could ask in-house IT staff or tech-savvy coworkers about a suspicious email. But now, they’re largely on their own.

However, unified communications technologies like videoconferencing and voice-over-IP are helping teams to stay connected, so end users should feel more empowered to ask for IT and security help when those issues arise.

“We have (Microsoft) Teams, we have Zoom, we have all these other video conferencing tools,” Liberman says. “And I think that if we continue to work remotely to a higher degree significantly – for a real period of time – we need to adapt to where we feel it’s easier to have that camaraderie or common sense checking that we can do for each other.”

Easy things IT professionals can do to better secure remote workers

According to Crisler, Liberman and other cybersecurity experts, these are steps that end users and organizations should immediately if they haven’t already:

Upgrade and update software. If your operating system and apps are out of date, update them immediately. That includes cybersecurity software like firewalls and anti-virus programs. Out-of-date solutions are goldmines for hackers to infiltrate. These updates should be set to automatically update in the background.
Log into your network infrastructure. Users can log into their home internet router and Wi-Fi router to change their password to keep hackers out. Default passwords are typically “admin.” Users can turn off traffic to certain services. IT staff should walk end users through this since it can be difficult.
Deploy a VPN. Virtual Private Networks (VPN) create an encrypted route between end users and a remote server operated by a VPN service. Internet traffic is routed through this and the location of endpoint devices are masked, so data is secure from prying eyes that otherwise could intercept it via a public Wi-Fi network.
Multi-factor authentication. MFA or two-factor authentication (2FA) is a great roadblock against phishing scams since it requires multiple sets of credentials in order to access certain systems or apps. Enable this on every app that offers it or invest in security solutions with integrated 2FA.