How to adapt COVID-related threats and attack surface changes
By: Zen Chan
Tags: How To, Covid 19, Security, Mindset, Cybersecurity

“You must be shapeless, formless, like water. When you pour water in a cup, it becomes the cup. When you pour water in a bottle, it becomes the bottle. When you pour water in a teapot, it becomes the teapot. Water can drip and it can crash. Become like water my friend.”

― Bruce Lee

While the COVID-19 pandemic is far from over, it already created a massive effect on companies and the security teams that strive to defend them. New threat surfaces are coming out and lead to new tactics for protection.

Yet we are human, and as Bruce Lee said, we can become like water. Some things are worth learning and adapting to the new reality at every stage of this pandemic. This time let me introduce the changes with the perspective of Cybersecurity to illustrate the situation.

Here are the critical cybersecurity considerations around the pandemic and how this might help you think about the Security Concepts such as people, processes, and technology — PPT in your organization both now and in the future.

Transitioning to remote work

Image by the darknet from Pixabay

Most companies prepared some tools and procedures for remote work before COVID-19. However, it is for a small group of users only. The scale and speed are out of scale now to adapt to the new normal.

According to ESG’s The Impact of the COVID-19 Pandemic on Cybersecurity report, remote employees need connectivity, device security, and policy management oversight are driving more effective communications and coordination between security and IT teams.

Before the Pandemic, the mobile workforce had already moved to the mainstream. Bring-Your-Own-Device — BYOD is already handled by most enterprises. But for now, its concerns resurface due to more business operation requirements for the WFH situation.

The transition needed investment ($$$)

According to Infoblox’s COVID-19 Challenges for the Borderless Enterprise report and CSO Online’s Impact of COVID-19 Survey:

46% of organizations shifted IT resources toward cybersecurity

38% moved resources away from cybersecurity to remote setup

22% of organizations have bought new security solutions/services to address the unique WFH situation

COVID-related threats and attack surface changes

Image by Stand some from Pixabay

ESG’s report also asked cybersecurity professionals regarding the main challenges for security staff about the transition to work from home went smoothly. The concerns below can be explained under the PPT framework.

Secure configuration of employee devices Secure access Remote monitoring

The WFH situation puts stress on the network and IT resources; connecting to the company from home also increases the security risk. Allowing employees to access the home network, which is unsanctioned, is like letting anyone come to your office with the door open 24x7.

Another reason why secure access is hard to achieve is related to the 1# problem as employees' devices are not all protected. Hackers can leverage insecure devices to gain access to the company’s network.

Assume you have adopted a best practice in system configurations; it is still a challenge for Security Team to manage and monitor every system's changes. It is nearly impossible to track and manage all devices that are not within the premises.

Since the introduction of BYOD, the IT department does not have permission to fully-manage all configurations of those devices due to the ownership problem. As a result, a secure configuration is more challenging than before to achieve.

New Attack Vectors

Image by Pexels from Pixabay

With new opportunity comes new risk. While firms rushed to adopt remote-work technology and digitize processes, hackers act quickly, too! Knowing the Changes are inevitable; we should then be prepared on how to mitigate those risks. I will summarize the WFH technological trend as below.

1# Phishing

Photo by Mohamed Hassan from PxHere

According to F5’s Phishing and Fraud report, attackers doubled down on phishing attacks, both COVID-themed and more broadly. Phishing incidents rose 220% during the height of the global pandemic compared to the yearly average.

The Palo Alto report showed that over 86,000 high-risk COVID-related domains were registered between March and April 2020. Hackers can use these fake websites to launch phishing attacks via emails or advertisements on other platforms.

Many employees will probably be more relaxed and distracted at home, making them more prone to fall for such social engineering attacks. The target of this kind of attack is most likely the credentials of user accounts, which can be used for further attack stages.

2# Sensitive Data & Privacy

CC0 Public Domain | Free for commercial use.

The changed attack surface and new risk profile from more remote workers also alter the calculations around successful cyberattacks. IBM’s most recent Cost of a Data Breach report cautions that remote access increases the average cost of a data breach by $137,000.

The transition to remote work also caused complications around endpoints and data. According to IAPP, the leading privacy promoting organization in cybersecurity, 60% of organizations that adopted WFH technology having accelerated or bypassed the regular privacy/security reviews.

Netskope advises that 7% of users intentionally uploaded sensitive data to personal instances of cloud applications. Yet, 35% of companies relaxed their policies to promote productivity, according to Hysolate’s The CISO’s Dilemma report.

3# Supply chain

Photo by Matt Moloney from StockSnap

Other threat vectors also increased. Hackers would try to get access to your company using the already established highways. Vendors and Partners become the possible targets and as a new way to penetrate.

Top management should understand that vendors, partners, and clients are going through similar challenges and transformations. Attacks related to the supply chain rose 38% since the start of the pandemic, reports Bitdefender (A Security Vendor).