What lessons can we learn from the pandemic as we move towards 2021? Are businesses taking cybersecurity seriously? What can we expect in the future? These questions and more were addressed by a panel of security experts during a virtual session at CompTIA’s 2020 EMEA Member and Partner Conference. COVID-19 caused chaos in our lives this year. Businesses and individuals had to adjust quickly to remote working environments, changing social habits, and COVID-19 created a lot more confusion. Cybercriminals also sought to profit from the situation. This result put a spotlight on cybersecurity strategies of companies, both good and bad.
As we approach 2021, a pandemic that seems to be lingering, what lessons can we learn? Are businesses taking cybersecurity seriously? What can we expect in the future? These questions and more were addressed by a panel of security experts during a virtual session at CompTIA’s 2020 EMEA Member and Partner Conference.
Social Engineering is Front and Center
COVID-19, for one, has shed new light about the social engineering capabilities of cybercriminals. They are taking advantage the power of the pandemic’s staying power in news cycles. According to David Emm, Kaspersky’s principal security researcher, employees and consumers still click on malicious links that claim to provide new information or insight about the coronavirus.
“Social engineering has been a key attack vector. COVID-19 offers a more persistent topic than Black Friday or the Olympics. Emm stated that COVID-19 has a large number of potential victims, so it’s a perfect storm. “Criminals have remained the same, but many people have been forced into working from home. It’s around 48% in the UK. This is a lot of people without the protection of a corporate network.
Phishers have claimed to be the World Health Organization, a delivery company with status on an ordered, or an agency providing assistance. All of these can lead to people becoming curious and opening malicious links.
Merium Khalid, senior cybersecurity analyst from SKOUT Cybersecurity, observed a marked rise in legitimate documents, software platforms, and websites that have malicious links embedded in PDFs. He also noted that it’s estimated that 18 million COVID-19 phishing email are being blocked every day.
“There is a lot of exploitation human emotion. People are anxious and fearful about the future. She said that people are clicking more on urgent requests tactics because they are anxious.
Tope Aladenusi (department head, cyber risk services at Deloitte West Africa), said that the emotional fragility that COVID-19 has caused has played a major role in cybercriminals attacking. “These guys thrive off fear, uncertainty and doubt. They also love greed. He said that they capitalized on this to launch multiple attacks.”
Companies Face New Challenges as Criminals Get Creative
Cyjax Limited’s CISO Ian Thornton-Trump said that cyberattacks have become more sophisticated and complex since March, when COVID-19 was first distributed globally. He said that bad actors are trying to steal credentials via phishing or smishing.
“We are seeing a pivot because large email providers are getting quite good at quashing spam mails. COVID has one thing in common. It allows people to attack infrastructure using automated, sometimes BOT, attacks. Phishing email is a threat, but I’m also seeing more insidious uses of internet-exposed devices.
Remote workers have created tremendous technical challenges for organizations, such as VPNs that employees can use at home. This can cause productivity issues and security vulnerabilities.
“Unfortunately, a VPN can cause performance to drop, especially if the company isn’t ready to scale up to hundreds of VPN points. It is almost impossible to use some network-intensive operations over a home DSL line. The security architecture community has learned a lot. Thornton-Trump said that IT overall went through a major shakeup.
It is also unrealistic to assume that all employees will use VPNs every day. Aladenusi said that COVID-19 is forcing many companies accelerate their IT plans. This may include more remote usage and VPNs in five, ten, or even ten years.
“We are being forced into bringing the future to the past and there is not enough time to go through a design phase. We had to have access to people. Aladenusi stated that some used VPNs, others used multi-factor authentication, while some simply looked for a way of connecting. “Another problem was getting secure devices to employees. Many were forced to use thei