If ever there was a scenario that would enable those who exploit the cyber environment for nefarious activities, then the COVID-19 pandemic hits just about ever wish on an attackers or exploiters wish list.

First, we see a massive increase in work coming from unsecured networks with virtually uncontrolled IoT devices connected to those networks. This increases the endpoint attack surface exponentially with so many people working from home through home broadband.

Then we see a massive growth in the use of apps such as Zoom and Skype for business. Many of these were not designed to meet such a rapid rise in volume and to meet that demand have had to grow, possibly with some of the security checks and balances not completed as comprehensively as one would like.

Thirdly, we have an environment where intellectual property, the processing of personally identifiable data and sensitive data and sensitive business operations are being conducted remotely. Many of these processes have not been rehearsed through robust business continuity plans and across networks and are not audited by corporate security systems.

Next we have a fear and an over demand for certain products such as face masks, hand sanitisers and more, creating a perfect environment for fraudulent selling. Finally, the thirst for knowledge, the hope for solutions, the time to read more, watch more and listen to more, creates a breeding ground for the only thing that spreads fasted than the virus itself, fake news or mis and disinformation.

If ever there was a time for a virus to cause a cyber enabled challenge, this is it and unfortunately it is not a virus than can be eradicated through software or uninstalling 2020 and reinstalling 2019.

The WHO have put warning reports out saying, “Hackers and cyber scammers are taking advantage of the coronavirus disease (COVID-19) pandemic by sending fraudulent email and WhatsApp messages that attempt to trick you into clicking on malicious links or opening attachments.”

In early March the threat was identified by the NCSC in a report titled, “Cyber experts step in as criminals seek to exploit Coronavirus fears,” where Experts at the NCSC revealed phishing attacks exploiting worries over COVID-19.

At the end of April Trend Micro put a warning report out titled, “Coronavirus Used in Spam, Malware File Names, and Malicious Domains,” which said, “COVID-19 is being used in a variety of malicious campaigns including email spam, BEC, malware, ransomware, and malicious domains.  As the number of those afflicted continue to surge by thousands, campaigns that use the disease as a lure likewise increase.”

At the end of April, Civil Service World also reported that, “Since the start of the coronavirus crisis, the National Cyber Security Centre has taken down 2,000 internet scams seeking to dupe people looking for advice or services related to the pandemic.”

UNESCO added that during this coronavirus pandemic, ‘fake news’ is putting lives at risk. “Unreliable and false information is spreading around the world to such an extent, that some commentators are now referring to the new avalanche of misinformation that’s accompanied the COVID-19 pandemic as a ‘disinfodemic’.”

In a joint advisory from the UK’s National Cyber Security Centre (NCSC) and the United States Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA), information on exploitation by cyber-criminal and advanced persistent threat (APT) groups was also outlined.  Many of the APTs are aligned to nation state actors.

So, the collective answer is the threats are very real. Mitigation is relatively straight forward.  There is a lot of free advice from any of the large cyber security providers but also from the UK NCSC and this should be the first stop for all.  Key to staying safe is recognising the threat is real, being aware of your digital exposure and taking measures to minimise it to the essential only and then applying good basic cyber hygiene.  The NCSC, (https://www.ncsc.gov.uk) is the place to go for sound, free, clear advice to keep you safe.

 

And at the end of the year the live event, International Cyber Expo, is the place to visit to hear detailed presentations by industry experts and to meet experts who can help you first hand with your challenges.
Find out more here www.internationalcyberexpo.com