Article By Ian Sherratt, Services Director – Cloud Centres
Earlier this year, the world embarked on a remote working experiment that was probably last undertaken on such a scale when Europeans set up trading posts for spices and silks in the East Indies in the 15th century. These adventures on the high seas ushered in an era of huge advances in technology, competitive opportunities for risk takers and, inevitably, ruthless criminality, extortion and piracy.
Welcome to 2020.
Actually, the example of trading with the Indies is not as far-fetched as it sounds. With the sudden, almost overnight trend for remote working that has become a permanent feature of our lives, it’s not surprising that criminal attacks have risen as a response.
In the US, a recent study by the University of Maryland reported that in the last few months the computers of one in three Americans had been attacked at home on average every 39 seconds. Similarly, 64% of businesses had experienced web-based attacks; 62% phishing and social engineering attacks; 59% malicious code and botnet attacks. The current global average cost of breaches for small and medium-sized businesses is $3.9 million, while for publicly traded companies this increases to $116 million.
Here in the UK, the statistics match almost perfectly with those in the US and with more than half of all staff now working from home for the foreseeable future—according to a recent study by Computing magazine—the increase in cyberattacks in the UK, US and worldwide is clearly set to continue.
Increasing the attack surface
The physical and technological perimeter of almost all organisations has widened beyond recognition in the past six months, with the trend towards home working—a trend which will continue even after the C-19 pandemic has passed. As this perimeter has widened, so has the attack surface for cyber criminals. Let’s be clear; very few organisations expected or prepared for this large scale remote working experiment until March this year.
As a result of this, the formerly easy-to-implement solutions that IT departments and Risk departments used to manage security must be urgently re-evaluated, to make sure these huge attack surfaces are speedily diminished and controlled.
What lockdown has achieved
What lockdown has achieved is to radically change and speed up the way we do business and how we use the technologies that support us. People at home have to adapt and so those organisations supporting them have to adapt. But the inevitable frenzy in which these changes were introduced now needs to be adapted and sustained in a measured, risked-based way, particularly since they are here to stay.
For example, technology firm CybSafe reported that 65% of UK employees had no cybersecurity awareness training when working outside a corporate environment. One in five (20%) said they didn’t have up-to-date video conferencing software, while 23% never update software on devices connected to their home WiFi network.
All this bad practice has given huge opportunities to criminals who prey on the unwary and unprepared. This is compounded when a company moves its operations to the cloud, using enabling technologies to work in a smarter, more efficient and cost-effective way.
Get off of my cloud
Cloud technology has become the backbone of how we have been able to continue doing business. But as we’ve increased the risk surface, we’ve pushed people away from the core technologies, and onto technologies they probably haven’t used before.
Let’s not forget that in the past decade—with the advancement of technology at home and in the workplace—we are all now wholly dependent on technology to carry out our personal and professional lives.
And criminals have a business model that is perfect for extorting money from the unwary. They’ll steal data or disable system access, hold it to ransom and then give it back when you pay them what they want (probably). And as the networks get larger, so does the attack surface and so do the payment demands. Additionally, with data having a commoditised value all of its own, they equally steal data to sell to other criminals which in turn ramps up the online scams which are becoming so prevalent.
So, technology is the great enabler helping us to combat communication problems, provide business continuity and to fight C-19 in many different ways. However, it’s also created two attack vectors. The criminals now rely on the inexperience and overwork of IT professionals to oversee and keep safe this huge remote working model – with IT engineers trying hard to find solutions to manage this sudden data tsunami that has come their way.
The other vector is the system users and their inexperience dealing with these new circumstances; how to understand the security of this new world we live in.
Unprotected home devices
Another survey by an insurance firm called Protect Your Bubble found that out of 2,000 UK employees across a diverse number of sectors, more than 40% were using unprotected devices while home working, with no password protection; 20% of employees admitted they had downloaded confidential company files to any available personal device. The survey found that employees under 24 years old were most likely to be at risk—30% said they used any personal device that came to hand for work.
Business leaders need to make big decisions – they need to keep the lights on and they need to ensure their employees are working in a secure environment. Importantly, these employees need to be safe and properly educated about the risks they’re taking with their different home devices and software packages.
Cybercriminals are smart
The important message we have to get across is that cyber criminals are smart people and they are using a combination of psychology, human factors and technology to get what they want. As a business manager you need to seriously think about how you’re managing change because normally change and risk go hand in hand. This change has been enforced and the risk, in most cases, was not necessarily assessed in the ways it should have been for most organisations in normal times.
The key functionality of an IT department is to provide access to required data and ensure the systems that hold and process it remain useable. Cybercrime for most people is a vague concept. They can’t visualise it. They don’t know what it looks like. But they know what a lock on the door looks like and they know what a physical safe looks like. Because of this, employees often fail to act against an unseen threat in an unfamiliar environment. Cloud technology is an unfamiliar place for most people – it’s a strange, intangible, unseeable entity and you have a huge number of potential security problems unless people adhere to protocols.
Most security innovations during the past decade have focused on identifying and reacting to individual attacks; little work has focused on hardening infrastructure itself or using the infrastructure to better protect an organisation. The way forward is an intrinsic security approach that combines detecting and responding to threats while supporting a home workforce to help organisations stay better protected and avoid any costly mistakes.
We’re here to help
If any of the above resonates with you, we have 3 services designed to strengthen your security. To see the details click on the link below:
*The title of this article and the animated GIF were inspired by a Rolling Stones Song, you can listen to it here: https://youtu.be/QYgJZ79FmBo?t=41
Podcast with Brian Lord, CEO of PGI: