Data Security Threats During COVID-19

COVID-19 is changing everyone’s life. People are concerned, and everybody wants to feel safe and supported in this pandemic time. On the other hand, crime groups exploit the fear, doubt, and uncertainty which COVID-19 brings in a variety of ways to target both individuals and organizations.

What Are The Threats That Organizations & Employees Face During COVID-19?

In this pandemic, several organizations have witnessed the rapid development of cyber criminal’s infrastructure, used to launch COVID-19 spear phishing attacks and to trap targets to fake websites and gather Office 365 authorizations.

Some of the examples of such threats are:

  • Numerous phishing emails luring target users to fake copies of the Center for Disease Control (CDC) website which solicit user passwords and credentials.
  • COVID-19 themed phishing emails attaching malicious Microsoft documents which exploit a known Microsoft weakness to run malicious code.
  • Phishing emails purporting to come from various government Ministries of Health or the World Health Organization directing precautionary measures, again inserting malware.
  • COVID-19 tax rebate phishing lures encouraging recipients to browse to a fake website that collects tax and financial information from unsuspicious users.
  • A selection of phony customer advisories purporting to provide customers with updates on service disruption due to COVID-19 and leading to malware download
  • COVID-19 themed phishing emails attaching macro-enabled Microsoft word documents containing health information that triggers the download of Trickbot or Emotet malware.

Several crime groups have changed their strategies to use COVID-19 related materials on fake cures, health updates, emergency benefits, fiscal packages, and supply shortages.

Regular giveaways that an email may be suspect include:

  • Design and quality of the email isn’t what you would expect.
  • Directly solicits personal or financial information.
  • Poor grammar, punctuation, and spelling.
  • Includes a veiled threat or a false sense of urgency.
  • Not addressed to you by name but uses terms such as “Dear friend,” “Dear colleague,” or “Dear customer.”

If it sounds too good to be true, it probably is.

What You Need To Do To Avoid These Threats?

Following are some of the actions you should take to decrease the risk to your company and your employees, especially as you are working from home.

  • Share conclusive sources of advice on how to stay safe and provide regular communications on the approach your organization is taking to the COVID-19 pandemic.
  • Provide remote workers with straightforward guidance on how to use remote working solutions including how to make sure they remain secure and tips on the identification of phishing.
  • Raise awareness amongst your team warning them of the heightened risk of COVID-19 themed phishing attacks.
  • Disable USB drives to avoid the risk of malware, providing employees an alternate way of transferring data, like a collaboration tool.
  • Make sure to have strong passwords, and preferably two-factor authentication, for all remote access accounts; particularly for Office 365 access.
  • Run a helpline or online chat line which they can easily access for advice or report any security concerns including potential phishing.
  • Ensure that all provided systems must have the best VPN service
  • Encrypt data at rest on laptops used for remote working given the risk of theft.

Moreover, make sure the funding processes allow finance teams to validate any major payment requests during the COVID-19 pandemic. This confirmation will help protect against the increased risk of breach from company email and CEO fraud. Ideally, use another channel for confirming an email request, such as texting or phoning.

Working with a specialised services company will allow you to relocate your IT assets
comfortably. This will ensure that your data is not only safe, but is being handled in a way,
which is not going to get you into any troubles. You need to understand that almost all
security and data experts have stated how cyber attacks is on the rise during the pandemic.
This is why it is important that businesses, both big and small, work with experts.

Ensure that essential security updates are installed and firewalls, VPN software and anti-virus applications are modified through the IT assets, including any laptops in remote use. In this pandemic, you would expect organized crime organizations to exploit any shortcomings in maintaining the IT systems.

Be sure that you backup all critical systems and validate backup integrity, ideally arranging regular backups for off-line storage. Expect an increased risk of ransomware as organized crime groups exploit COVID-19 thematic phishing during the COVID-19 pandemic.

To conclude

Work with your incident and crisis management team to make sure that an alternative audio and video conferencing environment for your organization is available. If you have a ransomware incident that disrupts your IT systems, this alternative platform will be required. And, if your primary conference provider has availability issues, it will also provide additional redundancy.