Although it’s been over a year since life as we knew it dramatically came to a halt, businesses are still navigating uncharted territory. While the sudden migration to a work-from-home culture created a nightmare for businesses, it became cybercriminals’ dream. So much so, that global cybercrime rates more than doubled at the onset of the pandemic.

This new digital era has inherently opened the door to many more security threats, especially stemming from employees’ personal home networks. Still, talks surrounding the “new normal” have organizations across the globe buzzing over a hybrid working model. What security measures must organizations take in order to avoid these evolving cyber attacks?

1. Be Mindful of Personal Computers and Home Networks

Insecure home networks are among the top remote work risks to any organization. Not only personal computers but WiFi networks also pose a great risk to a company’s assets. While companies typically have firewalls in their office to monitor network traffic and block malicious activity, many people do not have them safeguarding personal computers and WiFi networks at home.

Unpatched personal computers harbour many vulnerabilities in OS and browsers, with some product versions even on end-of-life support.  Many malicious actors now exploit browser and OS weaknesses in their attacks, including a new Russian malware that deliberately seeks to infect computers being used to work from home by detecting usage of a virtual private network (VPN).

While most firms acknowledge concerns by providing remote workers with company computers that have all essential security software, few consider how the WiFi networks may also jeopardize the security of corporate data. Ranging from home routers to surveillance cameras, these IoT devices usually lack the ability to be patched remotely, causing updates to be overlooked.

In return, these devices have become a new target for botnets over the last few years. They can be recruited to the “botnet army” via unprotected network ports, trojans, or other malware spread by spam, which can lead to corporate data breach risks over time.

It is recommended that company computers and laptops be used even for remote work. Companies should provide remote employees with company computers that come pre-installed with all of the essential security software to enable them to stay away from their family networks and personal devices, where infection risks are higher.

2. Invest in Zero Trust Security

The recent remote/hybrid work concept, the adoption of BYOD and cloud computing have widened organizations’ attack surfaces. This new, zero-trust concept is encouraging organizations to shift away from the concept of perimeter security. Zero-trust security now aims to shift access controls from the network perimeter to individual users through user and device-based authentication.

Becoming an umbrella term for controlling access to company resources, zero trust is not intended to make a system trusted, but rather eliminate trust. The resource-based model eliminates the default belief that everything, including people within a company’s network, should be trusted. Putting a greater emphasis on dispersed security measures, a few measures include:

  • Multi-factor authentication (MFA)
  • Distributed user & device identity management
  • Micro-segmentation of networks
  • Least privilege access

3. Patch, Patch, Patch!

According to Security Boulevard, 60% of breaches involved vulnerabilities for which a patch was available, but not applied. Whether it is a remote worker’s computer or company assets, unpatched vulnerabilities dominate as an initial vector in most cyber attacks. For small and medium-sized enterprises especially, software vulnerabilities are by far the most common ransomware attack vectors.

Does your vendor ecosystem contain signals that suggest it could fall victim to a ransomware attack? Find out today with our Ransomware Susceptibility Index™.

Get a Free RSITM Rating

Hundreds of vulnerabilities are published each month. With a sea of bugs including CVE codes, severities, patches and workarounds, IT teams become overwhelmed and miss critical updates. Insufficient resource management as a result of lack of risk prioritization also causes significant problems.

As with any cyber risk-related issue, teams do not find themselves comfortable with risk prioritization and have difficulty addressing vulnerabilities. While manual patch management can be inefficient for a secure system, an effective process requires a combination of automation and best practices.

4. Consider the Human Element

Most of the time, colleagues count on audio and video calls to communicate with coworkers during instances where they would normally speak face-to-face. Vishing attacks take the standard phishing attack to the next level, combining phone calls seemingly from the corporate’s IT department and custom phishing sites to steal VPN credentials from employees.

A scammer impostering a corporate IT staff  could easily ask an employee to enter his or her credentials into a fake site. Scammers have also created fake LinkedIn profiles, adding as many contacts as possible from the target company becoming virtually legitimate workers, combining these attacks with SIM swapping to bypass multi-factor authentication.

The criminals have created dozens if not hundreds of phishing pages targeting some of the world’s biggest corporations in 2020. Companies must make sure their employees understand the “vishing” threat, and establish ways for employees to verify that the person to whom they’re talking is who they say they are—especially if they claim to be from the IT help desk.

Any effective cybersecurity program, whether remote or on-site, requires full visibility into your cyber ecosystem. Achieve full visibility into your entire digital supply chain with the only platform that observes networks from a hacker’s perspective.

Request a Free Cyber Rating
Additional Resources