Maintaining an effective cybersecurity program during COVID-19

As can be seen in recent news headlines, COVID-19 is on the rise again. As a result, it can be predicted that cybersecurity incidents related to COVID-19 will be on the rise again as well. For many, the ongoing pandemic is a source of anxiety and panic, which leaves them especially vulnerable to COVID-19-related cyberattacks. In turn, their employers and their data are at a higher risk of compromise. In this blog, we will discuss how COVID-19 is being used as an effective vector of attack and what you as a small to medium sized business (SMB) can do to mitigate these risks as much as possible. Specifically, we will look at the rise of phishing attacks and the exploitation of remote working.

Due to the pandemic, a large increase in phishing attacks on businesses has been seen, many of which have content related to the pandemic. The goal of these COVID phishing attacks is to exploit the ones most worried about the virus by posing as a source of valuable information about it. These phishing emails often pretend to have information about nearby outbreaks, financial relief, remote working protocols, and other related topics. Those who are especially worried about the virus are at a higher risk of being phished in these attacks, and as a result leave their employer vulnerable. There are actions that SMBs can be taken to help mitigate the risk of one of their employees falling victim to a COVID-19, or any, phishing attack. The primary method of mitigating phishing risks is by enrolling employees in regular phishing exercises and training. By having employees trained to look for, then practicing looking for, the signs of a phishing email, they are much more likely to spot phishing emails before they fall victim to them. Other ways of mitigating phishing risks include implementing sophisticated email filters and warnings on any emails that have originated outside of the organization.

Remote working has become the new normal for most organizations. As a result of this, however, the risk of organizations falling victim to cyberattacks is much higher. This is due to the attackers’ ability to breach organization networks unsuspected as a result of the large amount of traffic from outside the organization’s networks. For organizations with little internet traffic monitoring services watching traffic requesting to reach sensitive networks (typically SMBS), an attacker’s malicious activity can go unnoticed which can lead to devastating damage. For SMBs obtaining a traffic monitoring service may be unaffordable, but there is something that can be implemented. Having every remote employee use a virtual private network to access organization servers is a great way to both monitor who is on the network as well as make it much harder for attackers to access the network remotely. Configuring servers to only allow external traffic when it comes through a VPN essentially extends secure internal company networks to the homes of the organization’s employees.

The COVID-19 pandemic has led to a rise in cybersecurity incidents, mostly in part due to increased phishing susceptibility and lowered Internet traffic visibility. This does not mean, however, that all is lost, and organizations have no methods of mitigating the now more present risks. Ensuring that all employees receive training in how to spot phishing attacks as well as implementing network safeguards such as VPNs for remote workers are fantastic starting blocks. We here at Harbor Technology Group hope that you will stay safe and secure as the pandemic is seemingly picking up once again.