Not too long ago things were looking bleak for the world, still under the dark cloud of the COVID pandemic, but with vaccine rollouts now taking place worldwide, there is finally a light at the end of the tunnel. It’s important to remember, however, as we slowly transition back into some semblance of normality, that there will be new challenges to face in all facets of life, and the Cyber Security sector is no exception.
The Rise in Cyber Threat
While the COVID pandemic loomed, the world was simultaneously dealing with a slightly different type of pandemic - a cyber one. The number of cyber attacks on businesses rose dramatically over the course of the last year, with estimated increases as high as 90%.
Organisations were forced to quickly adapt and move operations out of the office and into home environments, often bypassing best practices for a secure migration. Hackers took advantage of this confusion and chaos and focused on exploiting the vulnerabilities of those at home, who were working more independently and potentially on devices that did not align with critical security controls.
The pandemic offered new opportunities for cybercriminals to develop more sophisticated attacks, with the number of novel attack techniques rising to 35%, 15% greater than pre-pandemic. The good news is that the increase in cyber attacks has likely brought to light the importance of cyber security and implementing effective measures to protect against these threats.
Hybrid Working
The pandemic has proved that remote working is indeed possible and it is probable that not all businesses will return to the office post lockdown, at least not full time. There may be more leniency with employees wanting to work from home more frequently, but this new world of hybrid working could create challenges for cyber security.
Organisations will have to be wary that employees may be moving from a secure office environment to vulnerable home environments where they could be operating with inadequate security measures in place. In the rush to home working, companies were forced into being less restrictive with security policies and plenty of staff were using their own personal devices and network. But with such little visibility and control, there was no way of knowing what vulnerabilities there may have been - devices may not have been patched, home networks were potentially insecure, and company policies and processes ignored.
“This is all about understanding how we control an environment that is now a bigger risk because our network has increased from perhaps one or two locations to potentially hundreds.” CTO, Cyber Tec Security
If businesses are going to operate effectively in this hybrid working style, they will need to bear in mind certain security considerations. Many will find it beneficial to introduce a home working policy or alter other company security policies to reflect new vulnerabilities. While employees will still need to access company data at home, it is imperative that this is done securely, with data protection tools and policies put in place and the use of a VPN for secure communication channels. Companies might consider providing company hardware to remote employees, but if personal devices are used at home to access data, they will need to be securely set up and regularly audited.
Human error is still the number one cause of cyber attack and home working could make this even more prominent. In 2020, Verizon found that 67% of cyber attacks were down to phishing and Business Email Compromise. Phishing links are still clicked on and while this is likely due to poor cyber awareness, the situation could be worse in a home environment with greater dependence on email for work requests and less support and supervision.
Ultimately, organisations will need to cultivate a culture of security awareness and provide employees with relevant cyber training and resources to help minimise cyber risk and ensure individuals are fully equipped as they transition to this hybrid working style.
A Shift in Priorities
After a hard-hitting 12-14 months and a spike in cybercrime, businesses that may have not considered their cyber security before will now have it on their radar. Certain advancements can and should be made internally post-pandemic, such as developing new policies to incorporate home working and BYOD, and ensuring an incident response plan is in place.
Recent Supply Chain attacks like SolarWinds should also compel businesses to start looking at managing the security of their third parties, which are a common way for cybercriminals to gain access and cause disruption to multiple organisations in a supply chain.
Although some businesses will have the luxury of investing big money into more advanced security solutions and cyber insurance as a response to the pandemic, others will be facing budget limitations after a hard year. Regardless, no business can afford to ignore the cyber threat post-pandemic, but for most, it will be a case of identifying and prioritising risk reduction strategies to best fit your company’s funds and resources.
The pandemic has forged a new security landscape and businesses have been forced to see the importance of being able to quickly adapt to changes in our working styles and environments. Cybercrime is not going anywhere in the post-pandemic world but by being well prepared in the face of these new security challenges, businesses can stay secure and successfully protect against the cyber threat.
No comments:
Post a Comment