The coronavirus pandemic (COVID-19) has hit the world hard. Sectors and industries around the globe have been significantly impacted with various cancellations, postponements, closures and restrictions.
Huge numbers of organizations have been forced to implement working from home measures across entire enterprises for staff so that they can do as much as possible remotely to keep business wheels turning, whilst offices are in ‘lock down’ to help reduce the spread of the virus.
The impact this fast, mass move to remote working has had on a great deal of organizations is stark. In working from home, employees are more susceptible to cybersecurity threats, whilst a huge rise in tailored COVID-19 cyber-scams that seek to take advantage of the current situation has only added to the risks being faced.
Asked how cyber-criminals are exploiting people working from home at this particular time, Ilia Kolochenko, founder & CEO of web security company ImmuniWeb, said:
“It is a convoluted mix of infrastructural unreadiness and overly susceptible human physiology during the spiraling crisis. Some cyber-criminals mostly exploit uncertainty and aptly forged emails or SMSs from state authorities, imposing or demanding certain actions such as sharing confidential data or clicking on a malicious link to infect victims with malware."
Others exploit an overall lack of security hardening of home, or home-placed, computers, he added, and deploy various well-known attacks, ranging from large-scale spear-phishing campaigns to sophisticated BEC targeting C-level executives.
“Sadly, all these vectors are highly efficient, while breach investigation is hindered by suddenly disorganized IT and security teams trying to adapt themselves to the new reality.”
“Breach investigation is hindered by suddenly disorganized IT and security teams trying to adapt themselves to the new reality”
The Infosec Response
In response, a number of companies in the information security industry have taken steps to offer free resources and support to organizations and employees at this difficult time.
For example, Irish cybersecurity awareness training company Cyber Risk Aware has provided free COVID-19 phishing tests for businesses, inviting companies to run a phishing simulation in which up to 100 staff can learn how to avoid falling for COVID-19 lures. Along with the free simulation, companies can also download a checklist of Do’s and Don’ts designed to keep employees who are working remotely cyber-safe.
Similarly, information security training provider SANS Institute has released a free training kit and additional resources designed to offer organizations, individuals and parents some best practice advice on working from home securely as the COVID-19 pandemic spreads.
The Security Awareness Work-from-Home Deployment Kit will help to fill knowledge gaps as organizations rapidly transition to new distributed remote working set-ups and highlights three main risks to remote employees: social engineering, weak passwords and unpatched machines.
It’s not just security awareness training providers that have displayed generous acts of responsibility to help ease the current situation either; several security vendors have made available a raft of free services as well.
Coveware and Emisosft have teamed up to offer free help to critical care hospitals and other healthcare providers that are on the front lines of COVID-19 and have been impacted by ransomware, whilst zero trust network provider Odo Security announced free subscriptions to its secure remote access solution.
Furthermore, Trend Micro is offering companies six months’ free access to its consumer security product for employees who are working from home but may not have a work laptop and are using a personal, and possibly unprotected, computer. According to Trend Micro, companies can request a free product download URL which can be installed on personal devices without any long-term or financial commitments.
“These are unprecedented times and require acts of unprecedented generosity and compassion”
Speaking to Infosecurity, Raef Meeuwisse, ISACA speaker and author of Cybersecurity for Beginners, said that companies that are gifting free cybersecurity and infosec products or services at a time of financial hardship and business distress, are showing brilliant signs of compassion.
“It is vitally important that any infosec enterprise that has the financial strength and capability to support organizations that are fighting for survival do all they can to help. These are unprecedented times and require acts of unprecedented generosity and compassion,” he added.
Similarly, Avinash Singh, principle, EasyTechCare, highlighted the importance of the infosec community pulling together to offer free assistance to struggling organizations.
“We’ve been seeing third-party vendors offer longer-than-normal trial periods for products, and we ourselves are offering free consulting and advise to customers who need to suddenly transform their businesses to a distributed remote model,” he told Infosecurity.
This has the potential to be less of a temporary situation and more of a permanent paradigm shift in how companies operate, he explained.
“This will be the new normal for a long time, and depending on how people respond to working remotely they may not want to go back to the way things were before. As a result, companies of all shapes and sizes will have their infrastructure security span society in ways they never had to consider before.”
More Harm Than Good?
However, holding a somewhat contrasting view, Joseph Carson, chief security scientist and advisory CISO at Thycotic, warned that infosec companies who are bombarding businesses with emails such as offers to help with free products and services could actually be causing more harm than good.
“With budgets on hold, no resources available and infrastructure at it maximum limits most businesses are not flexible,” he added. “The best things infosec companies can do is make the transition of existing customers to working remotely easier and to let prospects know that we are here for you when you need us. Most companies want a sense of normal, and infosec companies should continue the path of business as usual.”
With most businesses now just a few days into the their remote working strategies, and with some yet to fully move to a working from home procedure at all, it remains to be seen what the long-term impact of the current situation will be.
Two things that are sureties are that mass remote-working is a new, unprecedented challenge for most organizations, and that cyber-criminals with malicious intent will continue to attempt to take advantage of the fear and uncertainty surrounding COVID-19.
It is encouraging then to see that a number of infosec companies are providing free help and support as the pandemic worsens and, whilst caution should indeed be taken over potential upselling or empty promises, if the free help and support being offered goes at least some way to easing the pressure on organizations and their employees at the current time, it will be for the benefit of many.