There has been a spike in cybercrime in 2020, and at least some of it can be directly linked to the pandemic and the lockdown. I wanted to unpack this from the perspective of a cyber expert to see what type of threats have been most prevalent this year, as well as what CISOs and workers should be doing about it before they too become another statistic.
A Look Back at the Year 2020 in Cybersecurity
Earlier this year, the FBI announced that its Internet Crime Complaint Center (IC3) had seen a major spike in cybercrime reports since the start of the COVID-19 pandemic. The increase went from 1000 reports per day to around 3000 – 4000 per day. They cite the massive migration to telework as one of the main reasons for this increase, as it opens up plenty of vulnerabilities for attackers to exploit.
A new Cisco report revealed that 3 in 4 organizations in India experienced a 25%-plus increase in cyber threats during the shift to remote work due to the pandemic. Meanwhile, Microsoft reported that there had been a 35% increase in IoT attacks during the first half of 2020, compared to the second half of 2019, which might also have something to do with the fact that everyone’s at home, thus shifting attackers’ efforts to those areas.
Clearly, 2020 has been a stellar year for cybercriminals.
Threats on the Rise: Is Just Covid to Blame?
It’s hard to not blame the current pandemic for a lot of the dreadful things that are happening in 2020, but has it really been the only cause of a spike in cybersecurity incidents this past year?
Covid has had a discernible influence on many types of cyber threats, including web application attacks, social engineering, and network security attacks. There’s no doubt about that. Scams increased by 400% during the month of March, and Google announced that they had blocked 18 million phishing emails related to the Coronavirus during the month of April.
Yet, the pandemic isn’t the only thing affecting cybercriminals’ targeting decisions this year. For instance, during the US elections concerns were voiced around an uptick of ransomware that could interfere with the US election. So, while it’s certainly had an incredibly powerful impact (in a very negative way, of course) on the cybersecurity front, the pandemic is only one symptom of a much larger cyber threat disease.
Social Engineering Takes Advantage
There’s no denying that people, regardless of their demographics or educational background, have always been susceptible to social engineering. The pandemic didn’t suddenly bring that on. What it did manage to do, however, was to provide a globally-relevant event that attackers could capitalize on.
It’s not uncommon for cybercriminals to take advantage of major events like that. For instance, there was a well-known surge in World Cup-themed phishing scams during the 2018 FIFA World Cup. As was the case with almost every FIFA, Olympics, and other World Cup event.
Unfortunately, with the amount of covid-related misinformation that almost instantly started making the rounds online, it wasn’t exactly hard for scammers to find a way to take advantage of people, especially via email – which accounted for the majority of phishing attempts.
A World Unprepared for Mass Remote Workers
Having employees work from home doesn’t undermine a company’s security systems – being unprepared for a sudden increase in WFH employees does. It isn’t just cybersecurity experts like myself that pick up on this either, but workers have started voicing their concerns over how their companies are handling security during this pandemic.
The “Consumer Privacy” and the “Global Future of Secure Remote Work” reports have responses from a combined number of 5600 professionals across the world, and both reveal that the majority of respondents were concerned about the protections built into the tools they use and felt that the information they were sharing was not being protected properly while they were busy working and learning remotely.
Sadly, this isn’t too hard to believe because many businesses were heavily unprepared for the switch to remote work. I can even say with some certainty that a sizeable collection of them didn’t have proper cybersecurity protections in place before the pandemic either.
Why Awareness Continues to be Crucial
October was Cybersecurity Awareness Month, but truly, this has been more like a Cybersecurity Awareness Year- to me, at least. The theme of this year’s Cybersecurity Awareness Month was “Do Your Part. #BeCyberSmart” and it’s more applicable now than ever, seeing as every remote worker is a potentially vulnerable – and harder to control – endpoint.
Obviously, I’m of the belief that cybersecurity has always been vital to a company’s continued existence – at least in the digital age. But this fact has never been more evident than today, where companies have to make changes to their systems if they want to retain their employees, want to continue to function normally (at least, according to the new normal), and renew customer trust.
With all of the new attack angles that have appeared this year and continue to appear every day, being negligent or uninformed about current threats just aren’t valid excuses anymore – not that they ever really were, to begin with. Customers are now more aware of the value of their data and their privacy, and they will shift their support to companies that they feel can be trusted with their data.
Cybersecurity in This New Reality
There are quite a number of things CISOs and decision-makers can do to ensure their teams are staying aligned with best security practices. Working from home might complicate things a bit more than usual, but putting safeguards in place while working remotely isn’t an impossible task. Security isn’t just a responsibility that management or the IT department is accountable for either. Every employee needs to be informed and understand the role they play in protecting company and customer data. Employers need to provide their staff with the right tools to do so.
Continued vigilance and efforts from everyone in the company is crucial, contrary to what Cloudflare’s COO recently said with regards to cybersecurity being a thing of the past in the next decade. Cloud-based cybersecurity systems aren’t going to evolve to the point where they can automatically route out all threats or make up for human error. You will always have to put additional measures in place and make sure people are trained to be aware of and act against the cybersecurity threats they’re likely to encounter or even (accidentally) cause.
CISOs Needs to…