- As many companies adopt work-from-home policies in response to the COVID-19 pandemic, cybersecurity is a growing issue.
- Cybercriminals are seeking to exploit coronavirus to target companies and individuals.
- Here’s how businesses and employees can protect themselves online.
As we navigate the challenges posed by COVID-19 and the need to halt the spread of this deadly pandemic, many of us are settling into a routine of working from home. This can pose many difficulties, including how to maintain focus, how to balance other priorities, such as childcare, and how to be productive without requisite tools or dedicated office space – not to mention the struggle to avoid raiding the whole snack cupboard in one day.
There are compromises to be found for many of these challenges in what we hope will be a relatively short-term arrangement. What we must not compromise on is security.
Responding to the COVID-19 pandemic requires global cooperation among governments, international organizations and the business community, which is at the centre of the World Economic Forum’s mission as the International Organization for Public-Private Cooperation.
Since its launch on 11 March, the Forum’s COVID Action Platform has brought together 1,667 stakeholders from 1,106 businesses and organizations to mitigate the risk and impact of the unprecedented global health emergency that is COVID-19.
The platform is created with the support of the World Health Organization and is open to all businesses and industry groups, as well as other stakeholders, aiming to integrate and inform joint action.
As an organization, the Forum has a track record of supporting efforts to contain epidemics. In 2017, at our Annual Meeting, the Coalition for Epidemic Preparedness Innovations (CEPI) was launched – bringing together experts from government, business, health, academia and civil society to accelerate the development of vaccines. CEPI is currently supporting the race to develop a vaccine against this strand of the coronavirus.
Many cybercriminals are seeking to exploit our thirst for information as a vector for attack. Most commonly, as with other high-profile events, attackers are using COVID-19-themed phishing e-mails, which purport to deliver official information on the virus, to lure individuals to click malicious links that download Remote Administration Tools (RATs) on their devices.
In addition, there have been multiple reported cases of malicious COVID-19-related Android applications that give attackers access to smartphone data or encrypt devices for ransom. The global pandemic has also led to the creation of more than 100,000 new COVID-19 web domains, which should be treated with suspicion, even though not all of them are malicious. (Palo Alto Networks is continually updating the latest COVID-19 related cyber threats here.)
Attackers are also taking advantage of the fact that many people who are working from home have not applied the same security on their networks that would be in place in a corporate environment, or that enterprises haven’t deployed the right technologies or corporate security policies to ensure that all corporate-owned or corporate-managed devices have the exact same security protections, regardless of whether they’re connected to an enterprise network or an open home WiFi network.
Both business leaders and individual employees have critical roles and responsibilities in securing their organization and in ensuring that cyberattacks do not further compound the already disrupted work environment.
How businesses can respond
In this critical time, business leaders have a heightened responsibility to set clear expectations about how their organizations are managing security risk in the new work environments, leveraging new policies and technologies and empowering their employees. It’s important that messages on security come from the very top of an organization, and that good examples are set from the start. Here are three recommendations for business leaders.
Understand the threats to your organization. Business leaders should work with their security teams to identify likely attack vectors as a result of more employees working from home and prioritize the protection of their most sensitive information and business-critical applications.
Provide clear guidance and encourage communication. They must ensure that home-working policies are clear and include easy-to-follow steps that empower employees to make their home-working environment secure. This should include instructing employees to communicate with internal security teams about any suspicious activities.
Provide the right security capabilities. Leaders should ensure all corporately owned or managed devices are equipped with essential security capabilities, extending the same network security best practices that exist within the enterprise to all remote environments. These critical capabilities include:
- An ability to securely connect users to their business-critical cloud and on-premise applications, such as video teleconferencing applications increasingly relevant for remote work environments
- Endpoint protection on all laptops and mobile devices, including VPN tools with encryption
- An ability to enforce multi-factor authentication (MFA)
- An ability to block exploits, malware and command-and-control (C2) traffic using real-time, automated threat intelligence
- An ability to filter malicious domain URLs and perform DNS sinkholing to thwart common phishing attacks
How individuals can respond
Individual users must be empowered to follow the guidance provided to them by organizations and take preventative measures.
Maintain good password hygiene. Employees should use complex passwords and multifactor authentication where possible and change these passwords frequently.
Update systems and software. Individuals should install updates and patches in a timely manner, including on mobile devices and any other non-corporate devices they might use for work.
Secure your WiFi access point. People should change their default settings and passwords in order to reduce the potential impact on their work of an attack via other connected devices.
Use a virtual private network (VPN). VPNs can help create a trusted connection between employees and their organizations and ensure ongoing access to corporate tools. Corporate VPNs provide additional protection against phishing and malware attacks, the same way corporate firewalls do in the office.
Don’t mix personal and work. Employees should use their work devices to do work and their personal devices for personal matters. If you wouldn’t install or use a service while you’re at the office, don’t do it while at home on your work device.
Taking these relatively straightforward steps at both an enterprise and individual level should help address some of the most common security risks facing our home-working environments. We should also recognize that our threat environment is not static, which means it’s important to keep a close eye on evolving threats to avoid unnecessary additional costs and disruptions in a time when we can least afford them.