Focusing on Virtual Private Networks and Phishing Schemes Can Help Solve These Problems
Your jobs as chief information officers (CISOs) were already tough.
Then the pandemic hit.
And your jobs got much more complicated.
The main reason is a paradigm shift in the working world.
Now most corporate employees work from home. Before the pandemic, most worked in corporate offices.
This unprecedented remote working explosion amounts to a dramatic game changer for corporate security officers and cyber attackers.
Corporate cyber security strategies, policies, penetration testing procedures, and technologies need to be reconsidered and reevaluated and, in many cases, revamped.
Where to begin.
A smart place to start is by identifying the technology changes and challenges caused by the skyrocketing number of remote workers. Then it’s important to consider the psychological factors facing human beings struggling to work in new ways amid a global pandemic.
With all this in mind, corporate security leaders can then consider effective initial steps for preventing cyber security gaps and weaknesses.
The rest of this blog will address these issues in more detail.
Technology challenges
Think of what recently transpired. Some companies were forced to send their workers home with desktops because laptops were unavailable to buy. This isn’t how business is normally done.
In many cases they didn’t have time to set up the security policies and procedures to help make the machines less vulnerable to cyber criminals. Cyber criminals know this. That’s why these remote worker laptops are prime and vulnerable targets for cyber attackers to penetrate the corporate systems.
Companies may have to spend the time and money to re-engineer this equipment. But many are financially stressed because much economic activity was halted by the global shutdown.
So should corporate security professionals hope for the best or pay the money to prevent an attack? That’s a tough business decision during these highly uncertain economic times.
Maze of information mayhem
With huge numbers of employees working from home, it’s more difficult for chief information security officers to stay knowledgeable about the activities taking place on their corporate networks.
Before they had more control and understanding of which employees were on the network and communicating with whom, when and for how long, what information was shared over which channels and using which devices. Now that’s become a more intractable predicament, a maze of information mayhem.
That’s not all. It’s become more difficult for CISOs to track which employees are connecting to the corporate network and identifying security policies they have in place with vendors and contractors.
Psychological challenges
Compounding the technical challenges with remote working are the personal and psychological affects of the pandemic on human beings.
People have survival on their minds. They don’t want to catch the coronavirus. They’re worried about losing their jobs and paying their mortgages and rents.
All these concerns leave less time and energy for them be concerned about whether their remote working networks are secure from cyber attacks. It’s not their highest priority right now.
Cybercriminals know peoples’ guards are down. They’re exploiting peoples’ fears and anxieties. They’re sending out phishing emails promising more information about the coronavirus and vaccines. In these stressful times, employees are more prone to click on these emails.
More people are becoming cyber criminals
This spells trouble for remote workers. More people are trying to confuse and manipulate them into clicking on malicious email links. The employees are scared and want to know more about the virus, and the attackers know that so they prey on these psychological dynamics to trigger havoc.
Steps To solve these problems
This pandemic situation and the network security vulnerabilities of remote workers is a lot to process. The key at this stage is to take proactive steps to address the biggest threats.
More VPN equipment and services
A smart place to start is in the virtual private network arena. More companies are using more types of virtual private network (VPN) equipment and services that enable remote workers to connect to their corporate networks.
Many of these VPN technologies have security gaps. With more VPN equipment using more VPN services, cyber attackers have more ways to succeed in penetrating and disrupting corporate networks.
Companies deploying all this new VPN equipment need to make sure it is as secure as possible at preventing cyber attacks. Addressing this VPN security problem is one of the most important for companies to address right now.
Ensure no gaps in security policies
Companies should also make sure there are no gaps in their cyber security policies and procedures. Those gaps need to be closed so cyber attackers cannot exploit them. A careful assessment of these policies and procedures, checking off all the boxes that increase corporate security, needs to be done now.
The whole corporate security system has been rearranged with the growth in remote workers. All the policies and procedures need to be double- and triple-checked to ensure adherence.
But that’s still not enough. Corporate security officers also need to align the policies and processes with the company’s goals and objectives.
Improve prevention of phishing attacks
Cyber criminals use phishing attacks more than any other method to break into corporate networks, because they’re especially effective at helping them quickly steal valuable corporate data.
CISOs need to make prevention of phishing attacks of remote workers a major priority. Whatever phishing training corporate employees have had is probably not enough and should be repeated. Employees need to become more astute and vigilant at spotting fraudulent emails and not clicking on suspicious email links.
You May Also Like This Blog: Don’t Fall for Coronavirus Scams
Final thoughts
Like the pandemic itself, this crisis cannot be solved with only one quick action. Multiple actions must be taken. And there are no panaceas.
But what is paramount now is to focus on the problems that have the most potential to reduce losses of revenue, data, and corporate reputations caused by cyber attacks.
High on this list should be checking the security of virtual private networks and training employees not to fall for phishing scams.
Cyber security penetration testing services can be used to find VPN and phishing vulnerabilities before criminals.
The services can report to you on those problems and offer recommendations for how to solve them. The costs for these services can be below $10,000 – a far smaller investment than the millions of dollars your company may have to pay if victimized by a cyber attack.
Patrick Barry is the chief information officer for Rebyc Security based in Charlotte, North Carolina. He can be reached at pbarry@rebycsecurity.com.
