RISK MANAGEMENT: As coronavirus spreads, factor cybersecurity into remote-work policies

Over the past few weeks, we’ve seen individual businesses and entire industries swiftly – and sharply –curtail operations to slow the spread of the COVID-19 coronavirus. These efforts to limit contagion have upended global commerce and shifted operating models in ways that are intensifying IT risks, including cybersecurity. 

In the wake of the coronavirus outbreak, many organizations are hastily shifting to a remote-work operating environment to accommodate scattered workforces. But most corporate processes, policies, and culture were not designed for a remote workforce, and that can introduce a raft of new risks to their information systems and data. Bad actors have developed new phishing campaigns based on coronavirus lures, preyed on distracted employees, and leveraged chaotic workplace conditions to slip through the cracks of cybersecurity defenses. 

The World Health Organization (WHO), for instance, recently warned that scammers posing as WHO employees are sending phishing emails that encourage workers to open malware-bearing email attachments or links. Similarly, new email updates purportedly from the Centers for Disease Control and Prevention (CDC) prompt recipients to click a malicious link that lists new coronavirus cases in the recipient’s area. 

Even more tempting are attacks that lure users with a live map of global coronavirus infections. Once users click the interactive map created by Johns Hopkins University, malware designed to steal credentials is installed on the user’s device, according to security site Krebs on Security. 

If these threats have one thing in common, it’s this: They all rely on a persuasive combination of misinformation and fear to spur employees to action. Making matters worse, the 24/7 stream of information – and frequent misinformation – is highly distracting, creating a chaotic environment in which workers may be less vigilant about cybersecurity, even as cyberattacks intensify. 

Government and private-sector organizations alike will need to address the risks associated with employees working from home during the pandemic. Hastily implemented remote-work policies can change business processes and increase threats in unanticipated ways. Increased remote connectivity, for example, expands the cyberattack surface by creating additional endpoints. These new endpoints may lack consistent security controls because businesses often initially prioritize functionality over security in times of crisis. To overcome gaps in remote-work safeguards, organizations will need to review current cybersecurity policies to make sure that the basics – strong password policies, secure file transfers, secure remote-access connectivity, and up-to-date incident-response plans – are in place and effective in a remote environment.

Compounding matters, staff may be asked to assume unfamiliar roles and responsibilities when other employees work from home or become sick. Cyber-risks can increase because employees are forced to wear multiple hats and may be unaware of security risks outside their traditional roles. Similarly, business executives are likely to be consumed with contingency management planning and may back-burner cybersecurity and privacy initiatives. Together, these factors can present the perfect opportunity for cybercriminals.