Trying to uncomplicate the complicated

Throughout April, COVID-19 continued its spread around the world. Some countries and industries are attempting to migrate back towards some sense of ‘normal’, while others continue to be greatly impacted. One of the many way’s organizations are attacked is from users trying to get updated, accurate information about COVID-19. There are many fake sites offering COVID-19 information, products, and applications. Some of this information is copied from other sites, some of it is conspiracy theories, and some of it is deliberate disinformation.

A timeline of viral spread and cyberattacks

The May 2020 Monthly Threat Report includes a timeline of the spread of COVID-19, along with related cyberattacks. If we can keep in mind the facts it can help us better determine what is fake, and better prepare us to recognize these attacks. It can also help us see how attackers are using COVID-19 information as lures, distractors, and disinformation in support of attacks.

This is important since both organizations and end users are being actively targeted. Organizations are being targeted with ransomware, Trojans, DNS attacks and more. Users are mostly being attacked through their vulnerability to phishing emails related to COVID-19, playing on their desire to understand what is going on around them. Of course, if a user is successfully attacked, it opens up the organization to exposure. That is only one reason organizations strive to protect their users.

Change from office worker to virtual comes with cyber challenges 

But, in most cases, the organization needs the help of those users to maximize the effectiveness of their security controls. In the current era where everyone seems to work from home, this is more complicated than it has ever been. That change from office worker to remote worker may not be a natural, or easy, step for all users. Part of making their security controls effective is ensuring end users understand the controls and policies the organization is providing.

Some of it is managing data, communications and conversations in manners to protect that data. Two doctors would not discuss a patient’s medical condition in the middle of a public coffee shop – so some of this is discipline, but it may be a discipline which some people are not used to.

Steps to protect your people and your organization

Following policies, being aware and protecting your organizational data are all important, but for the new remote user, communications may be the most important step. The organization and its users must regularly communicate about policies, capabilities, awareness and needs to make sure users are properly supported, since not every risk has a fix based in technology.

In fact, technology risks were missing from the World Economic Forum’s review of global risks, published in January of this year. While certainly no-one could have predicted the situation we find ourselves in today. The fact that technology risks were not in the top five highlights a potential sense of complacency around technology and cybersecurity – and also the interconnectedness of risks to the world overall.

To read more about these topics, please download and read the May 2020 Global Threat Report, published by NTT Ltd.