Approximately one year after much of the global workforce was pushed from offices to remote work by COVID-19, many things remain unclear while other pandemic-induced habits are here to stay. After having employees and their devices scatter around regions, and in some cases, the world, cybersecurity was one of the things that companies had to double down on during the pandemic. As we approach a “new normal” in which remote work is becoming more widespread, securing digital infrastructure – no matter where in the world it is – is a habit that is sure to stay with companies for many years to come.
The past year has made clear that enhanced digital security measures have become fundamental to business operations, regardless of where those operations might take place. It has also made clear that IT divisions must proactively address challenges on the horizon rather than wait for them to come to a head and risk long-term damage to intellectual property and systems.
The FBI recorded a significant uptick in cybersecurity complaints since the beginning of the pandemic, which nearly quadrupled from their rates prior. The increase in attacks has reverberated with information security leaders internationally. A survey by Fudo Security found that of a diverse group of global information security leaders, 42% agreed that the pandemic has changed their cybersecurity priorities, and almost a quarter said that their own companies had been the victim of cyber-attacks.
As businesses begin the transition to a post-pandemic era of work, it is critical that cybersecurity be at the heart of every company’s digital infrastructure. The models that companies put in place for remote work and technology will likely be with us for decades, so putting cybersecurity at the forefront is a proactive way to combat issues that are still on the horizon.
Significant Threats
The cyber threats that stem from remote work present the biggest security threats to companies of any size, and with each remote device the potential of a breach grows. According to Pew Research, the number of people working from home jumped to 71% during the coronavirus outbreak, up from 20% prior to it. About 54% of workers say that they would like to work from home in some form after the pandemic is over.
While those statistics are helpful for businesses looking to cut operational costs and expenditures related to running an office, companies should ensure that the right investments are made into digital security before running to cut costs.
- Not preparing employees to identify and disarm cybersecurity threats is one of the biggest voids that hackers can use to plant malware and ransomware via phishing attacks, which grew by 350% in frequency worldwide during the pandemic. IT departments need to be intentional about training every person with access to their network on how to avoid and report phishing emails, a practice that will go a long way towards encouraging a culture of digital safety that will protect an organization.
- Remote device security is another major security issue for companies. While in an ideal world each employee would have a work-issued computer and work exclusively on that machine, in reality it is commonplace for people to use personal devices for work business. Whether it is checking emails via a smartphone or using a personal computer to view privileged information, each device that an employee uses to access data is another backdoor for cybercriminals to insert themselves into corporate systems.
- The cloud has become a tool synonymous with information security. Though it does offer more protection than on-site computing, investments in cloud security such as dual- or multi-factor authentication and digital identity management should be a priority to make a hack even more of a remote possibility.
- Password protection is simple but bears repeating. Each employee should be trained on best practices, and companies should ideally regulate those practices by requiring passwords to have certain characters. Employers should implement enterprise-wide dual- and multi-factor identification tools, encourage employees to use a certified password management tool to protect their information, and reiterate the very real risks related to sharing passwords and digital information in general.
A Proactive Approach to the Future of Cybersecurity
The most likely post-COVID-19 operational outcome for most organizations will be a hybrid workforce that allows employees to work from home on some days and work in the office on others. In addition to the risks of working from home outlined above, returning to the office will present new cybersecurity challenges.
There are several approaches that companies can use to confront the very real challenges that this presents, but chief among them is enhancing a VPN so that employees can access the networks securely and remotely. Zero-trust and two-factor authentication policies are also helpful. Even though they require a few seconds more effort every time an employee logs in, they are extremely effective means to stop cyberattacks.
Keeping up with routine updates is another basic, yet critical measure that IT divisions can take to mitigate cyber risks. Pushing out updates to devices across the organization will patch security flaws and protect employee and company data. Using endpoint management tools are another common step that companies take that replicate in-house security for remote devices, no matter their location. While remote IT systems will not be able to repel 100% of the attacks that a firewall would, it still is a useful tool to provide enterprise-level security to a remote workforce.
Threats That Are on the Horizon
Even though cybercrime has risen exponentially during the pandemic, there continues to be no end in sight. Threats will evolve and hackers will become more sophisticated, and while there is no way to be certain about what the future of cybersecurity has in store, there are several that are beginning to take shape.
- Phishing threats are only continuing to become more sophisticated and harder to detect. Hackers will continue to use things like COVID-19 related headers and vaccination updates as clickbait, hoping to trick just one unsuspecting employee.
- Supply chain attacks target the third-party software developers that a company uses and seek to infiltrate networks and servers with flaws or unpatched security holes. Attackers plant malicious code into legitimate apps and software, and when an employee goes to update the software it infects their computer and network.
- Home network attacks will also likely target employees where they live, instead of where they work. Home networks are far easier to access and have the potential to gain the same reward.
- Distributed denial of service (DDoS) attacks use botnets to synchronously access a company’s web server, overwhelming standard capacity. Best practice for mitigating the attacks is to retain a third-party service with expertise in DDoS defense, which will differentiate bot traffic from friendly traffic, something that can be accomplished through blackhole routing, rate limiting, network diffusions, and strong firewalls.
- IoT attacks are another next-generation threat that will only become more prominent as companies continue to automate everything from on-site security to manufacturing plants. A report from Nokia found that IoT devices made up nearly 33% of infections in 2020, and the number will only rise from there. As use of such devices rises in companies, so should investment in protection.
The transition to remote work has been difficult for companies and employees alike, and rightfully so. Businesses went through a 10–20-year shift in operations in a sharply compressed timeline, and many were working without a playbook or, best practices. As companies continue to adapt to the remote working lifestyle and build the foundation for the next generation of workers, it has never been more critical that they invest in cybersecurity to ensure that they can do so safely.
