“In times of crises, we unfortunately always see bad actors taking advantage of people’s fear and confusion for personal gain. We’ve seen this happen during or after disasters and tragedies in the past, and we’re seeing this happen again amidst the ongoing COVID-19 pandemic.”
So said Sumit Bansal, Senior Director of ASEAN and Korea, Sophos, who also noted that since early March, there has been a surge in email scams and malicious domains using COVID-19/coronavirus themes as a hook to reel in unsuspecting victims.
Reported common attack techniques include:
- COVID-19 news – emails, SMS, and WhatsApp messages from unknown sources, or sources that impersonate legitimate news or government organizations, pretending to have information on the coronavirus.
- Malicious apps – purporting to offer useful information on the coronavirus, these apps enable crooks to access all the information on the device – and even hold the owner to ransom.
- Home delivery scams – with many people waiting on home delivery of essential items, hackers are impersonating delivery services. Their goal: to trick you into clicking on malicious links or con you into paying extra ‘delivery’ fees.
- Extortion attempts – criminals threaten to infect people with the coronavirus unless they pay them. Often these threats include a small piece of personal information to make it more believable.
- Malicious documents – these documents claim to contain coronavirus-related information. Upon opening them you’re asked to ‘enable editing’ and ‘enable content.’ Doing so installs malicious software onto your computer.
TECH RELIANCE
The challenges come with the territory.
“Our everyday reliance on technology has significantly evolved over the past 20 years, especially on the personal technology front, which has certainly been revolutionized with the mass popularity of the smartphone. This has greatly helped people stay far more connected and informed during this time compared to other tech and natural disasters of the past,” Bansal said. “And while this greater connectivity provides endless benefits for users, it also provides more opportunities for cybercriminals. With the right security technology in place and knowledge at hand on how to stay safe, the benefits can outweigh the risks.”
On the business front, today sees many more businesses using the cloud, more financial transactions happening online, and more data being collected and stored remotely. This digitization of business has allowed many businesses to pivot to a remote workforce almost seamlessly helping to ensure business continuity while protecting employees from the virus.
“Of course,” Bansal said, “the downside of this greater digitization and online activity is that it opens up more businesses to the threat of cyberattack. As the business online landscape becomes more connected, cybercriminals continue to evolve their attack methods to keep up and even leverage machine learning and automation to raise the stakes for their exploits. The good news is that cybersecurity has also significantly advanced. Sophos employs cloud-native and AI-enhanced solutions that can adapt and evolve to secure endpoints and networks against never-before-seen cybercriminal tactics and techniques.”
NAVIGATING CHALLENGES
For Bandal, there are some three security-related tips for companies/businesses as they move forward for them to successfully navigate or face similar pandemics like COVID-19.
1. Patch early and patch often
Don’t delay applying software updates and patches. As cybercriminals continue to identify new security holes, businesses that delay their security updates are vulnerable to attacks. Given this, Sophos encourages companies to auto-update so they are running the latest software.
2. Promote cyber awareness within your organization
In 2019, 78% of organizations in the Philippines said that the biggest challenge to their security in the next 24 months would be improving cybersecurity awareness and education amongst their employees and management. We believe this challenge has been heightened by many organizations’ shift to remote operations resulting from the pandemic.
To address this, Sophos recommends companies to have cybersecurity training courses or webinars so that their employees can be their first line of defense against cyber breaches and attacks.
3. Revisit backup strategies
While backing up is one of the most important practices against cyberattacks, organizations should consider that backups happening in real-time and kept on the cloud may still be accessed and destroyed by cybercriminals. To prevent this, Sophos advises companies to keep backup copies offline and offsite by unplugging backup devices and logging out of cloud backup accounts.
But Sophos has – of course, offerings to also help organizations deal with unforeseen instances like COVID-19.
“With its pioneering Synchronized Security platform, Sophos is uniquely equipped to help customers deal with unforeseen circumstances. Synchronized Security is the world’s first – and best – cybersecurity system that allows companies to secure their endpoint, network, mobile, Wi-Fi, email, and encryptions from one platform. Before, in the face of cybersecurity attacks or sudden changes in operations (such as the recent shift to remote working due to lockdowns), companies’ IT managers would have to deal with each separately, which is tedious and frustrating.”
With Synchronized Security, companies “can secure all fronts seamlessly and efficiently as Sophos products share information in real time and respond automatically to each other, giving businesses one less thing to worry about in a time of crisis.”
MOVING FORWARD
Knowing that something like Covid-19 may happen again, what is the best lesson that companies/businesses can learn from this experience?
“This pandemic has taught many businesses the hard way that disruption can happen to any business and industry, no matter how big or small they are. Whether it’s caused by a physical human virus or an electronic one, disruption can come when you least expect it,” Bansal said. “Therefore, organizations need to adopt a ‘when’ not ‘if’ approach to their crisis planning. While the nature/cause of the crisis may be out of our control, how we secure and protect ourselves to ensure our business continuity, is certainly something we can put in place now. In addition, while cybersecurity has often been relegated to an organization’s IT team, this pandemic has shown that it needs to involve everyone – from management to individual employees – as they are the front line to keeping a company going even in the midst of uncertainty.”
