Can They See You Now?

Remote Working Requires a Security-First Approach Against Cyberattacks —

The COVID-19 pandemic resulted in a significant shift in the workplace worldwide, with more people working from home than ever before. This dispersed workforce is a reality that will continue long into the future, and has had a huge impact on how organizations, and their employees, must approach security, as the risk of cyberattacks on critical networks and devices increases. 

According to a 2021 report from Cybersecurity Ventures, global cybercrime costs are expecting to grow by 15% per year over the next 5 years, with the size, cost, and sophistication, of attacks also rising thanks to hackers utilizing emerging technologies. This includes artificial intelligence and machine learning, and the proliferation of people working from home. 

When in a physical office, networks and devices were within a secure facility. Now, with workforces spread out across the world, home networks and individual devices have become the new de facto security perimeter for huge volumes of sensitive data. To combat this trend, a security-by-design approach is needed.

Today’s Working-From-Anywhere Realities

The COVID-19 pandemic provided an opportunity for people to overhaul their working environments, with many of us setting up new offices in our spare bedrooms, living rooms, or kitchens. As a result, the workplace transformed from one office, or a number of offices, into a huge network spanning an entire country, and internationally. 

This has opened up a new discussion about the long-term future of remote working, with Fortune reporting that nearly a third of workers will not want to ever return to the office. But the risks of working from home cannot be forgotten. It is crucial that home networks and devices are kept as secure as possible since hackers use this new reality as a golden opportunity. 

At home, employees are often working on computers connected to a network that is shared by multiple family members. With the rise of the Internet of Things, workers are using a variety of devices on untrusted networks, that are also connected to numerous other consumer gadgets, many of which have a low security status. A connected-home environment can open the door to cyberattacks, as one unprotected device can potentially bring down the entire network. Even worse, it can then be used as a springboard to launch further persistent attacks.

This means employees must be given the essential knowledge for device protection while at home, while employers must simultaneously improve their overall approach to remote device security. 

There was a time when security awareness was restricted to specific roles. Now, every job role at every level must have knowledge that enables employees to protect themselves, and their work, against breaches. Organizations should consider investing in training for all workers to increase user awareness, as well as investing in rigorous backup systems. Preventive measures can be taken on an administrative level, such as using unique access codes to attend virtual meetings or limiting the use of universal default passwords. Since hackers are given the opportunity to access data by unsuspecting employees, the risks of an attack can be reduced if leaders give staff members the tools to learn about vulnerabilities and expand their knowledge. 

Sophisticated Attacks

Phishing attacks, the email-focused form of social engineering, rose by a staggering 220% in 2020 compared to the yearly average, according to a phishing and fraud report by F5 Labs, with many phishing incidents taking advantage of the confusion surrounding COVID-19. By educating employees about phishing and the things to look out for, the likelihood of enabling an attack of this type is significantly reduced. They can also help the organization by sounding the alarm if they do receive anything suspicious. 

The SolarWinds attack, discovered by FireEye, is a terrifying example of the increasing sophistication of cyberattacks. A group of hackers secretly gained access to SolarWind’s widely used platform Orion, which is used to manage IT resources, and added malicious code. When SolarWinds started to send out updates to its 33,000 customers, the hacked code was included and provided an opportunity for the hackers to gain access to those customer’s systems. By remaining undetected for months, the hackers were able to install even more malware and gain access to more data, causing further damage. Rather than stealing data and leaving, hackers were able to go undetected within the customer’s infrastructure for a long period of time. Due to the nature of the attack, the exact damage caused is not necessarily known, or able to be tracked. As the stakes get higher, security must be top of the agenda. 

To ensure all networks and devices are kept as safe as possible, organizations must have secure systems in place, with a consistent plan to share updates and knowledge with their employees. However, the buck stops with the developers and manufacturers.