A new frontier for cybersecurity

As businesses continue to convert to remote work environments, hackers see more weaknesses to exploit.

By WP BrandStudio

November 20, 2020

When the covid-19 pandemic hit in March, employers scrambled to help their workers set up home offices so they could continue their business uninterrupted. Within a matter of days, employees settled into their new workspaces and routines for what would end up being months. Meanwhile, hackers started to realize that this dispersed workforce was a vast new opportunity for cyberattacks.

Suddenly, corporations were grappling with the cybersecurity threat to their physical location, as well as across hundreds—in some cases thousands—of virtual private networks (VPNs) and devices. As of this summer, 56% of employees are using their personal computers for remote work.

For many businesses, the sheer volume of employees suddenly working remotely proved overwhelming. And more computers connected to a company’s VPN means more backdoors that hackers can exploit.

Phishing attempts, attacks on improperly secured WiFi, malware, ransomware and payment fraud has surged. According to a recent survey by VMWare, 91% of respondents say they’ve seen an increase in cyber attacks since employees started working from home. “Attackers are looking to expose corporations through vulnerabilities that arise out of rapid change with a lot of money at stake,” said Dusko Djukic, senior vice president and group head of institutional bank payments at KeyBank.

That’s why the opportunity for payment fraud is particularly concerning. “Think about how organizations process dollars that are either going out of the company or coming in. A lot of those processes have been built using workflows designed for the office itself and performed on corporate equipment. We’ve had customers schlep these big machines to their homes and now they’re printing checks and financial information from their home networks,” Djukic said.

Human behaviors are also different at home than in the office. Employees may feel comfortable reading a funny email supposedly sent from a friend during work hours when they aren’t worried about their boss walking by. That innocent behavior could open the door to a phishing attempt, for example.

What’s more, third party partners also present a threat. Vendors themselves are working from home, dealing with their own cybersecurity challenges. It’s hard for organizations to gauge how robust cybersecurity protections are among their partners.

“We’ve definitely seen cyberattacks where attackers are monitoring vendor emails, understanding how they interact with the entity that’s paying them,” says Djukic. That can open the door for impersonation and redirecting payments elsewhere.

And while companies of all sizes are vulnerable, small and middle market companies may have less infrastructure in place for this shift to remote work, and less ability to respond once an attack happens. These smaller organizations tend to lack the equipment, software and funds that larger businesses have. They are also less likely to invest in cyber insurance, which can cover a business’ liability in a data breach involving sensitive information like credit card or routing numbers. Unfortunately, hackers know to exploit this—a recent report by Verizon showed that 58% of cyber attack victims were small businesses.

A game plan for ramping up security

With the proliferation of cyber intrusions over the last decades, businesses understand that a cyber attack is only a matter of time. And during a pandemic that has most businesses reassessing their infrastructure, flexibility is key.

“One of the things that covid-19 made clear for companies is the need for operational resilience and fundamental to that is cyber resilience,” says Piyush Dwivedi, head of enterprise payments risk & portfolio management at KeyBank. “The pandemic has accelerated the roadmap for organizations large and small.”

Fortifying defense in this new cybersecurity landscape will require a new approach to best practices:

Start with education. In the past, employees could have walked over to the IT department if they suspected fraudulent activity on their devices or checked with a colleague about a questionable email. But the remote workforce means employees don’t have immediate access to expertise when they have a question or concern. Currently, 25% of remote employees don’t know what security protocols are on their device.

“Employees are central to any organization’s security program,” said Dwivedi. Often, they’re the first line of defense against attacks like phishing or malware.

“Ongoing training, conversation and awareness is of vital importance —it’s not a one-time activity,” said Dwivedi.

Understand the equipment. In a perfect world, corporations would supply all equipment and require workers to segregate their work data from any personal information. But that’s not always feasible. This is particularly relevant as work and home life have started to blend. Family members may share devices or use the same networks for anything ranging between work and children playing video games.

“Businesses need to understand what devices are being used to access their network, and for what functional purpose,” says Djukic. “If it’s not possible for corporates to control that entire dissemination and infuse their own security protocols on those devices, then it becomes very important to understand and regulate what data can be accessed and shared from which devices and by which employees.”

Move to the cloud. Companies had already started their migration to cloud security to enable a mobile workforce. Now, that trend has accelerated at an unprecedented pace because of the pandemic. Cloud-based security lets companies spread protection widely to their workforce no matter where they are. And IT security professionals can manage this protection remotely while still allowing employees to access and share necessary data.

Implement multi-factor authentication. Along with strong passwords, companies should adopt two-factor or multi-factor authentication that verifies the user, sometimes by requiring a code to be entered or a biometric scan in order to provide an additional layer of protection. This simple measure can have big results. Recent data shows that multi-factor authentication can block up to 99% of account compromise or automated attacks.

Limit access. By limiting who can authorize payments, organizations can reduce the number of potential vulnerabilities. Requiring dual approvals can also help to thwart attacks. “Don’t give one single employee access rights to be able to do everything across all accounts, all subsidiaries and all businesses,” says Djukic.

Get cybersecurity insurance. Most companies understand that a cyberattack is inevitable. Not only can these be highly disruptive, but pricey too. A ransomware attack, for example, can easily cost a business $50,000 on top of any lost revenues that result from downtime. A data breach could cost more—up to an average of $177,000. This is an incidental cost that most small and midsize businesses in particular can’t afford to lose.

Cybersecurity insurance can help a company respond by paying the ransom, performing recovery and perhaps even covering any litigation that arises from an attack. It’s an increasingly important risk mitigation strategy for a digital world and could mean the difference in a business surviving an attack.

Cyberattacks have been around for decades. But the surge in work from home arrangements due to coronavirus have undeniably increased their reach and frequency. “This is a subject that is evolving. All organizations, big and small, are starting to build a strategic posture and learning,” Dwivedi said. “Ultimately, the solution will be a combination of people, process and technology that we continue to evolve and fine tune as a response.”

This content is paid for by an advertiser and published by WP BrandStudio. The Washington Post newsroom was not involved in the creation of this content. Learn more about WP BrandStudio.