In a flash, the world has been thrust into a new way of working. All of us are facing a new normal and when the pandemic is over, the general consensus is that we will have changed our modus operandi forever. Although exactly how this will impact us, no one can say).
Some professionals, like software engineers and writers, have experience working from home. But for so many, it’s an unfamiliar world. There’s the financial adviser who switched from in-person client meetings to Zoom video calls. Or the dermatologist who’s doing telemedicine for the first time.
Millions of educators are navigating online, pretty much learning as they go.
All are facing new logistical and productivity challenges ... and cybercriminals are leveraging remote working due to Covid-19 by launching campaigns that aim to take advantage of the new reality.
Unprecedented threats
Our threat intelligence team is seeing the cumulative volume of coronavirus-related email lures, representing the greatest collection of attack types and united by a single theme that they have seen in years, if not ever. The coronavirus-themed messages we’ve observed are truly social engineering at scale, and each is carefully crafted to convince potential victims to click a malicious link, complete a fraudulent payment, or download nefarious attachments. These coronavirus email examples are, at their core, focused on tricking the people receiving these messages based on urgency, fear or the promise of a miracle cure.
To date, we have seen over 500,000 messages, 300,000 malicious URLs, 200,000 malicious attachments with coronavirus themes across more than 140 campaigns (and the numbers continue to increase). The challenge is that attackers persist in sending Covid-19 related threats because their tactics are clearly working.
Insulate yourself
Working remotely 100 per cent of the time is different than working from home once or twice a week. Extra vigilance is required especially regarding the links being clicked on, or the actions you take on the attachments. Remote working can often mean that you are not protected by the same safeguards the office has in place.
It’s extremely important that individuals approach their inbox with the same level of caution they use in their non-digital, real life. In addition to email caution, if you have a VPN, it should always be turned on and connected. We anticipate threat actors will increasingly pursue corporate VPN log-ins as large parts of the population continue to work from home and a compromised VPN can result in direct access to all email, data, and cloud apps.
We recommend configuring VPN access so remote users are restricted to only necessary systems.
Keep it to yourself
This new population of remote workers is also faced with something they aren’t used to: many are at home with their family — where they feel safe. We always recommend keeping family members away from your remote office computer, because they haven’t been properly trained by your security awareness department and don’t understand the security controls you should take.
This creates the perfect storm for cybercriminals to strike. Don’t make their job easy.
Cybersecurity may not seem like a priority where matters of global health are concerned. On the contrary, it’s more important than ever. Just as we all have a part to play in stopping the spread of a virus, so too does everyone in your organisation have a role in keeping it safe.
— Martin Mackay is Senior Vice-President for EMEA at Proofpoint.
