In a flash, the world has been thrust into a new way of working. All of us are facing a new normal and when the pandemic is over, the general consensus is that we will have changed our standard modus operandi forever (although exactly how this will impact us, no one can say).
Some professionals, like software engineers and writers, have experience working from home. But for so many workers, it's an unfamiliar world. There's the financial advisor who switched from in-person client meetings to Zoom video calls. Or the dermatologist who's doing telemedicine for the first time. Millions of educators are navigating online, pretty much learning as they go.
All are facing new logistical and productivity challenges and cybercriminals are leveraging remote working due to COVID-19 by launching campaigns that aim to take advantage of the new reality.
Unprecedented Threat Volumes
Our threat intelligence team is seeing the cumulative volume of coronavirus-related email lures representing the greatest collection of attack types united by a single theme that they have seen in years, if not ever.
This includes attacks that don’t outright mention coronavirus in the subject or body of a message, but instead reference it within attachments, links or lures.
The coronavirus-themed messages we’ve observed are truly social engineering at scale and each is carefully crafted to convince potential victims to click a malicious link, complete a fraudulent payment, or download nefarious attachments. These coronavirus email examples are, at their core, focused on tricking the people receiving these messages based on urgency, fear or the promise of a miracle cure.
To date, we have seen over 500,000 messages, 300,000 malicious URLs, 200,000 malicious attachments with coronavirus themes across more than 140 campaigns (and the number continues to increase). The challenge is that attackers persist in sending Covid-19 related threats because their tactics are clearly working.
Remote Work Security Provides Protection for Yourself and Others
Working remotely 100 percent of the time is different than working from home once or twice a week. Extra vigilance is required especially regarding the links you are clicking on, the actions you take or the attachments you open. Remote working can often mean that you are not protected by the same safeguards your office has in place.
It’s extremely important that individuals approach their inbox with the same level of caution that they use in their non-digital, real life. In addition to email caution, if you have a VPN – or better trust a zero trust network solution - it should always be turned on and connected. We anticipate threat actors will increasingly pursue corporate VPN log-ins as large parts of the population continue to work from home and a compromised VPN can result in direct access to all email, data, and cloud apps. We recommend configuring VPN for secure remote access so remote users are restricted to only necessary systems.
This new population of remote workers is also faced with something they aren’t used to: many are at home with their family—where they feel safe. We always recommend keeping family members away from your remote office computer, not because they are malicious, but because they haven’t been properly trained by your security awareness department and don’t understand the security controls you should take.
This creates the perfect storm for cybercriminals to strike. Don’t make their job easy.
Top Tips for Remote Work Security
Cybersecurity may not seem like a priority where matters of global health are concerned. On the contrary, it’s more important than ever. Just as we all have a part to play in stopping the spread of a virus, so too does everyone in your organisation have a role in keeping it safe.
Here are some top remote work security tips you can share with your employees today:
For more information on how to protect your organisation, visit www.proofpoint.com.