Do Not Be Caught with Your Pants Down
Along with the change of many people's work environment in 2020, there are rising trends companies need to be aware of in 2021. The shift into remote learning and working has allowed hackers to easily access employees that are no longer surrounded by encrypted computers or protected networks in their typical workspaces.
1) Phishing Attacks
As the year progressed, different phishing attacks and social engineering tactics used fraudulently in 2020 increased. The Anti-Phishing Working Group (APWG) published data showing that in the third quarter of this year, the most targeted industries were Software as a Service (SaaS) and emails at 31.4%. This year’s increasing demand for remote meetings called for a rise in phishing attacks using fake Zoom links sent to install malware. Scammers have also begun requesting personal bank information claiming that they will assist with receiving the government stimulus check. Previously, companies have used Social Engineering Testing to train employees on the dangers of phishing attacks.
2) Ransomware Attacks
Ransomware Attacks increased in popularity throughout this year as well. One of the industries with the highest risk is Healthcare. The Cybersecurity and Infrastructure Security Agency (CISA) have warned hospitals to encourage Healthcare providers to enforce and improve security guidelines. Healthcare systems can prevent ransomware attacks through a series of evaluations to discover their weaknesses, such as a Security Risk Assessment, Vulnerability Assessment and Penetration Testing.
3) Insider Threats
Ransomware isn’t just a situation when hackers withhold private information; it also has to do with gaining control or access to networks and devices. In healthcare, a compromise of medical devices can have life-threatening implications. Often ransomware may be initiated from Insider Threats when employees willingly or accidentally cause loss or destruction of data with their authorized access, or they can cause infiltration of malware onto devices that contain personal data. The Department of Homeland Security's Science and Technology Directorate’s (S&T) Insider Threat project is avidly working to diminish Insider Threats and enforce more restrictions.
During the pandemic, cyber-attacks instilled fear in the community especially if hospitals or medical centers were impacted. While hospitals and law enforcement agencies investigate the attack, hospitals often have patients relocated to nearby facilities, which in turn, could impact their treatment.
As an employer, some signs can indicate which employees may pose a threat to the company. Some signs include:
- Accessing Work Data Outside of Usual Hours (Collecting Information)
- Unusual Overseas Travel
- Sudden and Unexplained Financial Gain
- Questionable Loyalty (Company/US)
- Conflict with Staff
- Attempting to Gain Higher Security Access
4) Cloud Security Attacks
Data Clouds have become more common in the last few years. Cloud solutions often offer two-factor authentication option, data backup and encryption options. In distributed cloud environments, multiple users may have access to view and edit the same files. This is becoming more useful in remote working environments. Following best practices in security and privacy is a crucially important requirement while working on cloud environments.
It is always recommended to log off when stepping away from your computer (never leave devices that contain sensitive information unlocked or unattended), connect only to Wi-Fi networks you trust, and make sure your Software is up to date.
5) Medical and Personal Device Attacks
As technology continues to develop, it is important to ensure that all devices containing sensitive data are protected. Ransomware attacks are often aimed at Healthcare devices because medical records can be sold on the black market for Bitcoin, which is not easily traceable. Covered Entities can use this Guide to HIPAA Compliance to assist with achieving compliance and assuring all devices used are encrypted.
6) Increase in Data Privacy Regulations
Data Privacy regulations allow businesses to obtain private information lawfully and ethically. Companies that don’t follow these regulations and have data breaches often suffer an adverse impact on their reputation. Companies that have remote workers must take the necessary steps to ensure that their employees are following and implementing the necessary security and privacy practices.
7) Work from Home Safety
When working remotely, consider the following best practices:
- Use a VPN, which encrypts all internet traffic.
- Connect to trusted Wi-Fi networks only. Public networks have fewer safety measures and can allow others connected to the same network to view your information.
- Do not use the same password for all accounts. Using strong passwords can make it more difficult for hackers to access accounts. If the same password is used across several accounts, it is easier for password spraying attacks to be successful.
- Use two-factor authentication, when available, use two-factor authentication since it provides another layer of protection.
- Backup files regularly.
- Encryption. Use encrypted devices, and messaging services that use end to end encryption.
- Do not click on content coming from an untrusted source, oftentimes people receive emails that look authentic and official but after verifying the sender's email address it becomes obvious it’s an unknown sender.
Summary
What types of cyber threats are expected in 2021? Phishing, ransomware, cloud security, medical/personal devices attacks, and insider threats. What can be expected to change to prevent or reduce these threats? Implementation of new regulations to prevent attacks and exposure to data breaches.
What tips can be applied to home offices or work routines? Do not leave devices unattended in public areas, use a VPN, connect to trusted Wi-Fi networks only, do not use the same password for all your accounts, use two-factor authentication when available, backup files regularly, use devices/programs that use encryption, and do not click on content received from unknown senders.
As time progresses there will be new ways for hackers to try to gain access to sensitive data, it is important to maintain software up to date and continue to keep up with cybersecurity trends. This allows you as a user and your business to always be a step ahead and lower the risk of experiencing a data breach.
