The rise of remote work and increased adoption of digital platforms has significantly raised risks of digital threats. Sam Small, Chief Security Officer at ZeroFOX takes a look at emerging digital threats and explores how enterprises can deal with challenges posed by new digital tools and work to mitigate them.  Â
January 2020 brought the excitement of a new decade, but no one would have ever predicted that a global pandemic such as COVID-19 would have an everlasting impact on organizations and individuals across the world. It’s no secret that the current pandemic has caused disruption in many industries. What’s more, it has put some at higher risk for cyberattacks as organizations adapt to the changing environments caused by stay-at-home orders. Many have had to rapidly shift their operating models, and security teams have had to adopt new technologies and protocols.
With these changes and surge in the use of digital platforms, an uptick in digital risks targeting those platforms, from phishing to data leakage to fraud and scams, has also emerged. According to recent researchOpens a new window by ZeroFOX, between January and April 2020, digital threat activity increased by 9%, and fraud and scam incidents online increased by 60%.Â
The increased adoption of digital platforms, both familiar and new, provides an expanded attack surface for bad actors to leverage. In order to operate securely in this new remote-first work environment, security teams must first understand the emerging digital risks that are facing their industry, but also review previously established security protocols and evolve practices to meet new standards. This article will explore both of these topics in more detail so enterprises can fully understand the top threats and outline a digital risk protection plan to mitigate them.
Learn More: 8 Tips for SMBs to Reduce Cyber Risk in 2020 and BeyondOpens a new window
Digital Threats Can Catch Your Employees UnawareÂ
As people continue to spend more time in the comfort of their own homes, it comes with no surprise that everyone is also spending more time online — whether that’s on social media, video conferencing and collaboration tools, and even online shopping. As a result, new threats and attacks have emerged that specifically target these platforms and forums that are getting the most use. Video collaboration tools such as Zoom, Slack and Microsoft Teams have seen an uptick in use both personally and professionally, and are also prime targets for attackers. Let’s dig into three specific threats/types of attack that have become more prominent during this time.
As noted above, with more users staying indoors, and many brick-and-mortar businesses closed, consumers have also taken to shopping and ordering goods online from clothes, to food, to even DIY home improvement tools. This increase in online shopping puts consumers at risk for sharing sensitive information and data, and attackers have noticed an opportunity to steal, leak and sell everything from credit card numbers to account credentials to personal identifiable information (PII). Of note, ZeroFOX observed a 145 percent increase in leaked, sensitive data between January and April 2020.
In addition to an uptick in leaked sensitive data, we’ve also seen bad actors looking to leverage COVID-19 to personally profit from the pandemic. Unfortunately, this is something we see all too often – when disaster hits and people around the world spring into action to help, attackers will take advantage of people’s generosity and willingness to help to make some fast cash. Phishing links diagnosed as COVID-19 relief funds have sadly become the norm during this time. The World Health Organization (WHO) noted that it saw a dramatic increase Opens a new window in the number of cyberattacks towards its staff, and email scams targeting the public. WHO estimated these attacks increased fivefold during the COVID-19 pandemic.
Finally, phishing attacks continue to be a go-to for attackers. Tactics such as phishing and domain-based attacks have always been prevalent, but with the current state of the world, and the increase in internet users, attackers have been leaning on these tactics more so than before. Phishing attacks in particular have increased 125 percent as the audience of internet users cyberattackers are able to reach has increased along with WFH mandates.
Learn More: Cybercriminals Turn to Fake News, Hoax Websites, Email ScamsOpens a new window
4 Steps to Safeguard Against Remote-First Digital Threats
With this in mind, what can security teams do to improve their digital risk protection? In light of COVID-19 and work-at-home orders, many security teams have been forced to adopt new processes and technologies seemingly overnight without the luxury of time to evaluate, monitor, or address security concerns and risks. With security teams having less visibility and control into what employees are being exposed to, it is critical for these teams to adapt to new protocols that meet the new standards and address new digital risks, to ensure security and success in this new normal. Fortunately, there are actions that security teams can take to mitigate these risks and prepare their organizations.
- Create a Remote-First Strategy: While many organizations may have already had work-from-home policies in place, it is critical now for security professionals to begin developing policies that put remote workers as top priority. Security teams can start by equipping remote workers with secure, but productive, tools so that they can easily collaborate, conference and message. Cloud applications are particularly suited for times like these as the vendors already accommodate varying devices, connection speeds, etc. Multi-factor authentication (MFA) via phone is also relatively easy. Organizations must also accelerate patching for externally exposed systems, and carefully evaluate permissions and access-control options and enforcement across each of their Cloud/SaaS applications, especially those with access to more sensitive data.
- Understand and Weigh Risk and Reward: When selecting new solutions, it’s important for security teams to weigh risk and reward by working with decision-makers to choose solutions that balance efficiency, collaboration and security. Security teams must not place too many restrictions on access as remote workers can lose patience quickly and productivity can suffer. Alternatively, employees may seek to workaround overly restrictive or burdensome controls by standing up shadow IT or using other unapproved and unprotected communication channels.
- Acknowledge Risks and Reassess: With new reliance on cloud-based services, security teams must realize the increase in susceptibility to exposed assets or increased risk due to third-party data breaches and account takeover attempts. It is critical to acknowledge that the public attack surface is probably more complicated than previously considered due to blurred lines of work and home usage and expand your concept of digital risk footprint. To do this, reassess asset monitoring, controls, visibility and leverage threat intelligence communities to identify changes in tech and industry risks quickly for your organization.
- Evolve and Adapt: As the environment continues to change, you must be ready to evolve and adapt policies and treat different elements of business differently when it comes to processes, technologies and security procedures. Security teams must continually work to find a balance between risk and necessary operations, and use it as an opportunity to build stronger, more resilient and agile organizations.
Learn More: How to Maintain AWS Cyber Hygiene in Quarantine EraOpens a new window
Weigh the Risks Against BenefitsÂ
As the global pandemic continues to shift how organizations do business, forcing industries to increase their usage of digital platforms, security teams must remain aware of the bad actors seeking to capitalize on this new normal. For organizations that continue to adopt remote-first work policies and digital transformation, it’s imperative that they create and disseminate clearly defined policies, and weigh the risks and rewards in order to remain successful and secure. Following these steps and being receptive to evolving, security teams will be able to safeguard against emerging digital threats like phishing, fraud and scams, all while becoming a more digitally savvy business.
Let us know if you liked this article on LinkedInOpens a new window , TwitterOpens a new window , or FacebookOpens a new window . We would love to hear from you!