Your Cyber Infrastructure is not Immune to the Coronavirus

A large portion of the U.S. workforce is now “working from home.”  In fact, you are probably reading this article from your home office. Many of us have never worked remotely before. As a CIO, I naturally think of all the ways this new working arrangement significantly raises an organization’s cyber security risk. Increased security challenges for remote work are not new, IWP’s Cyber Intelligence Course, “Insider Risk” addresses these issues  What is new, is that practically overnight, up to 88% of organizations have encouraged or required remote work, according to a recent Gartner Survey leaving IT teams without sufficient lead time to plan a safe rollout.

When employees are not educated on cyber risk, they unwittingly become an internal threat to your organization. Employees may inadvertently visit a dark website, or send an email to another employee, the content of which should not be transmitted across the internet.

The use of personal equipment and the increased number of devices due to IoT (Internet of Things) also raises risk. It would be an ominous task to check the Operating System level of all employee’s home computers and an even greater job and cost to upgrade them. An additional concern is what software do employees have running on their home system and if any are infected with a computer virus. More organizations than ever are relying on remote working tools for collaboration which can present their own risks as you may have seen in the news recently if not properly vetted and implemented.

This transition to working from home is disruptive and may result in employees making mistakes that they would not normally make. Added to the workload, some employees may simply need additional handholding, especially if they are using a VPN (Virtual Private Network) and are unfamiliar with what to do.  These out of the ordinary circumstances may not only create a strain on an organization’s technology staff, but operational departments as well.

Make no mistake, cyber criminals are already coming out of the woodwork to take advantage of this unique situation. On April 3, 2020, U.S. cyber officials released an advisory warning companies to update their Virtual Private Networks (VPNs) and be on guard against a surge of malicious emails aimed at an already disoriented workforce. Followed closely on the heels of that warning was one by Britain’s National Cyber Security Centre on April 7, 2020, which issued a six-page leaflet to businesses who are managing remote employees.

The types of attacks that these bad actors may engage in are limitless.  Perhaps they will wage a phishing campaign and masquerade as the CEO saying they are stuck in an airport, lost their wallet and need a wire transfer of money? With the technology crew working overtime to address end user requests and problems, perhaps they will attempt to create a DDoS (Distributed Denial of Service) which is the disruption that occurs from an attack on a network?

Even before the coronavirus, criminals were dressing up password stealing messages. Some have masqueraded as commercial companies (e.g., Nordstrom, Macy’s, etc.) while others try to pass themselves off as your ISP (Internet Service Provider), gas company, IRS and various other entities.

So what can be done to ameliorate this problem?

The first thing to manage through this ordeal is communication. Don’t assume what your workforce knows, without information or instructions employees may unintentionally open the organization up to risk. It is also important to ensure that the standard housekeeping processes and procedures continue to be followed. All employees should be asked to verify that they have anti-virus running on any home computers they may be utilizing. If they don’t, they should be instructed how to download anti-virus types of software. There are some that are very reputable and free. The technology people should apply any security patches to the corporates systems/network. While the situation may be a little exacerbated, try to maintain calm so that people do not try to do their jobs with additional stress.

Finally, it is important to learn from this situation. Write down issues and solutions so that they can be reviewed later. Creating a “lessons learned” folder is a good practice. Many of the new ways of working, will lead to new processes or procedures to be implemented in future.

Written by Dean Lane, Senior Vice President for Cyber Intelligence at The Institute of World Politics. Mr. Lane brings a wealth of knowledge to his role at IWP. He has founded his own company, taught courses at Universities in California, was the Chief Information Officer for multiple companies, worked for a Big Four Consulting firm, and spent his time in the military with the Special Forces. Mr. Lane has a Bachelor of Arts from UCLA and a Master’s degree in Business Administration from National University.  He is the author of three #1 best-selling books related to information technology.