Across the country, parents are juggling working from home and home-schooling. Equally, companies are facing the prospect of functioning with skeleton teams and limited resources, including important IT support functions.

While the world has been focused on battling the various threats posed by COVID-19, cyber criminals have been exploiting the current crisis for their own gains. Since the outbreak began, cyber-crime has increased significantly, with hackers taking advantage of the increasing amount of time people are spending online.

In particular, we have seen a steep rise in phishing attacks and credential or identity theft over the past few weeks. Against this current backdrop, you need to take the utmost care to protect your employees and their families, as well as the business and any confidential company information.

Protecting the business

Having all (or most of) your staff working remotely puts your business at higher risk of cyber-attacks. A lot of companies are currently struggling with weak credentials, old technologies, and failing VPN systems with a limited number of connections. Home security networks also tend to have fewer firewalls and endpoint protections in place than corporate networks.

This sudden migration from enterprise networks to largely unmonitored and often unsecure home Wi-Fi networks has created a valuable target of opportunity for cyber criminals.

Hackers are also increasingly using phishing to target and disrupt businesses — for example, by sending fraudulent invoices purporting to be from legitimate vendors or tricking employees into downloading malware.

As such, good cyber hygiene and proper access management will be more important than ever over the next few months. It is also important to encourage employees to stick to company guidelines on internet use and use of devices while working from home, too. Although this might not be quite so easy at the moment…

Keeping the whole family safe

With entire families now working or learning from home, chances are your employees are having to share devices — even if it goes against company guidelines and policies.

However, cyber criminals are taking advantage of children having to carry out schoolwork using their parent’s computer or downloading mobile apps such as Houseparty to stay connected with their friends — knowing full well that they won’t be as safety conscious as you might be!

While it is difficult for companies to enforce all IT policies given the current situation, you need to be careful and ensure all workers understand their personal obligation for protecting company information. This is an excellent time to encourage them to educate their entire family, using resources from sites like Net-Aware and Parent Zone to help keep everyone safe online.

The World Health Organization (WHO) has also recently warned about suspicious email messages using the coronavirus emergency to lure individuals in and steal their money or sensitive information. Many people have received emails disguised as offers, refunds and various forms of support as well.

To stay safe, there are a few key things you should urge your teams to look out for:

  • Is the communication addressed directly to them? If it addresses them using a generic salutation, there’s a high chance it is not legitimate.
  • Does the language seem professional? Phishing attempts are often littered with spelling mistakes or poorly written.
  • Does the email address match the company the communication is claiming to be from? In many cases, the email address will be a mixture of random letters and numbers, although some will appear more genuine.
  • Do links take you to a reputable site from the company claiming to have sent the email?

A ‘zero-trust’ approach

As with all data security, remote access is only as strong as its weakest link. However, security not only concerns itself with stopping the ‘bad guys’, but also making sure the authorised staff can access systems and work — the keyword here being ‘authorised’. This is where a ‘zero-trust’ approach comes in.

‘Zero trust’ means that every user, device, service or application is implicitly untrusted and must go through an identity and access management process to gain access. In its simplest form, a zero-trust approach could mean encouraging users always to question the legitimacy of communications (for example, by asking the above questions when receiving an email).

On a higher level, this tactic means using tools and software to grant or deny access to users. A number of our partners — One Identity, Entrust Datacard, Okta and Twilio — offer advanced access management and control solutions, while CyGlass and Fidelis provide endpoint and network security software.

Keep an eye out for our next blog. We’ll be diving deeper into how security, the Cloud and zero trust can help improve your business continuity in times like these.

If you have any questions or queries about your business’ security, please get in contact with us today.